Comments on: A Look at PCI in 2010 http://storefrontbacktalk.com/securityfraud/a-look-at-pci-in-2010/ Techniques, Tools and Tirades about Retail Technology and E-Commerce Sun, 20 May 2012 01:49:40 +0000 hourly 1 http://wordpress.org/?v=3.2.1 By: Walt Conway http://storefrontbacktalk.com/securityfraud/a-look-at-pci-in-2010/comment-page-1/#comment-64535 Walt Conway Sat, 30 Jan 2010 22:35:51 +0000 http://www.storefrontbacktalk.com/?p=4501#comment-64535 Don, Thanks for your comment and question. My understanding is the same as yours. That is, you would revalidate your app against the new/revised PA-DSS when you next assessed, whether that is at the current expiry date, or when you either introduce a new version or make a significant change to the app. Don't forget those last two events, either which triggers a revalidation. Don,
Thanks for your comment and question. My understanding is the same as yours. That is, you would revalidate your app against the new/revised PA-DSS when you next assessed, whether that is at the current expiry date, or when you either introduce a new version or make a significant change to the app. Don’t forget those last two events, either which triggers a revalidation.

]]> By: Don Giddens http://storefrontbacktalk.com/securityfraud/a-look-at-pci-in-2010/comment-page-1/#comment-64323 Don Giddens Fri, 08 Jan 2010 19:46:06 +0000 http://www.storefrontbacktalk.com/?p=4501#comment-64323 Interesting article. I’m curious. What happens to the PA-DSS validation status of a payment application once the Security Council implements a new standards version? Does it have to be re-validated under the new standard in order to remain compliant? It was my understanding that an application would remain compliant and acceptable for new deployments until it hits the re-validation date listed on the Security Councils web-site for that application even if a new standard was issued. Once that date is reached, it would then have to be re-validated under the current standard. Is this a correct interpretation? Interesting article. I’m curious. What happens to the PA-DSS validation status of a payment application once the Security Council implements a new standards version? Does it have to be re-validated under the new standard in order to remain compliant? It was my understanding that an application would remain compliant and acceptable for new deployments until it hits the re-validation date listed on the Security Councils web-site for that application even if a new standard was issued. Once that date is reached, it would then have to be re-validated under the current standard. Is this a correct interpretation?

]]> By: Walt Conway http://storefrontbacktalk.com/securityfraud/a-look-at-pci-in-2010/comment-page-1/#comment-64320 Walt Conway Thu, 07 Jan 2010 23:10:58 +0000 http://www.storefrontbacktalk.com/?p=4501#comment-64320 @Dave, The focus of DSS is data at rest, but as you observe, data in transit can be vulnerable. Like you, I would not be surprised to see some move by the Council addressing unencrypted data over private/internal networks. I just don't know when. I can think of two arguments for sooner rather than later. First, they update the DSS to reflect current attack vectors, which as you point out applies here. Second, the Council is looking at "emerging technologies," a couple of which can in theory address this issue. Will PCI DSS reflect this as a new requirement? I'd say it will someday. The uncertainty is when that day will be. Merchants and processors truly interested in security will address this issue without waiting for the Council to mandate it. @Dave,
The focus of DSS is data at rest, but as you observe, data in transit can be vulnerable. Like you, I would not be surprised to see some move by the Council addressing unencrypted data over private/internal networks. I just don’t know when. I can think of two arguments for sooner rather than later. First, they update the DSS to reflect current attack vectors, which as you point out applies here. Second, the Council is looking at “emerging technologies,” a couple of which can in theory address this issue.

Will PCI DSS reflect this as a new requirement? I’d say it will someday. The uncertainty is when that day will be. Merchants and processors truly interested in security will address this issue without waiting for the Council to mandate it.

]]> By: Janice Gaines http://storefrontbacktalk.com/securityfraud/a-look-at-pci-in-2010/comment-page-1/#comment-64317 Janice Gaines Thu, 07 Jan 2010 16:26:14 +0000 http://www.storefrontbacktalk.com/?p=4501#comment-64317 Anyone else here reading “I.T. WARS”? I had to read parts of this book as part of my employee orientation at a new job. The book talks about a whole new culture as being necessary – an eCulture – for a true understanding of security, being that most identity/data breaches are due to simple human errors. It has a great chapter on security. Just Google “IT WARS” – check out a couple links down and read the interview with the author David Scott. (Full title is “I.T. WARS: Managing the Business-Technology Weave in the New Millennium”). Anyone else here reading “I.T. WARS”? I had to read parts of this book as part of my employee orientation at a new job. The book talks about a whole new culture as being necessary – an eCulture – for a true understanding of security, being that most identity/data breaches are due to simple human errors. It has a great chapter on security. Just Google “IT WARS” – check out a couple links down and read the interview with the author David Scott. (Full title is “I.T. WARS: Managing the Business-Technology Weave in the New Millennium”).

]]> By: Dave CISA/M/SP http://storefrontbacktalk.com/securityfraud/a-look-at-pci-in-2010/comment-page-1/#comment-64316 Dave CISA/M/SP Thu, 07 Jan 2010 15:39:01 +0000 http://www.storefrontbacktalk.com/?p=4501#comment-64316 Is anyone seeing movement towards revoking the "free pass" for transferring data unencrypted over private networks? In both Heartland and Hannaford data was being sniffed "on-the-fly". Will the continuing trend towards malware-based data collection attacks drive the council to consider requiring the encryption of data "in flight"? Is anyone seeing movement towards revoking the “free pass” for transferring data unencrypted over private networks? In both Heartland and Hannaford data was being sniffed “on-the-fly”. Will the continuing trend towards malware-based data collection attacks drive the council to consider requiring the encryption of data “in flight”?

]]>