PCI New Rules: Reading The Tea Leaves
Written by Walt Conway and Evan SchumanAugust 19th, 2010
When the PCI Council periodically sends out sanctioned teases about an upcoming version, the fun part is the tea-leaf-like reading of its deliberately vague hints. And the Council has offered us quite a bunch to choose from, including "expanded definition of systems components to include virtual components," "recognize that issuers have a legitimate business need to store sensitive authentication data" and the especially intriguing "update requirement to allow business justification for copy, move and storage of CHD during remote access."
The most powerful change from the hints was a warning that too much encryption may actually weaken network security. (See this week's PCI column from Walt Conway.) But let's delve into some of the more mysterious and intriguing elements first.
This Story Is Only Available For Premium Subscribers. Click Or Login In Below To Read The Rest Of This Story.
Already a Subscriber? Login Here
Leave a Reply
Readers, specifically those who want to comment on a story:
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
I have strong reservations about the 'individual' certification and posting of that information for merchants. Can you imagine the potential employee poaching that might occur? The implications when competitors can look up how many are certified with each of their competitors? 
-Christine
