Analytics
11/11/2013
07:58 AM
Tim Wilson
Tim Wilson
Quick Hits
50%
50%

New Version Of PCI Compliance Guidelines Released

PCI 3.0 changes focus on compliance as a business-as-usual process, rather than a snapshot

The Payment Card Industry (PCI) Security Standards Council (SSC) Thursday released PCI 3.0, the latest version of the council's security compliance requirements for businesses that accept credit and debit cards.

Available now on the PCI SSC website (PDF), version 3.0 becomes effective on Jan. 1. Version 2.0 will remain active until Dec. 31, 2014, to ensure adequate time for organizations to make the transition.

Many of the key changes to the guidelines are designed to make compliance more of a regular process, rather than a report on a company's compliance at a specific point in time, according to the council and other experts.

"Version 3.0 will help organizations make payment security part of their business-as-usual activities by introducing more flexibility, and an increased focus on education, awareness and security as a shared responsibility," the PCI Council says. "Overall updates include specific recommendations for making PCI DSS part of everyday business processes and best practices for maintaining ongoing PCI DSS compliance; guidance from the Navigating PCI DSS Guide built in to the standard; and enhanced testing procedures to clarify the level of validation expected for each requirement."

"PCI DSS is stressing that their compliance standard is not a set-it-and-forget-it mentality," says Joe Schumacher, security consultant at Neohapsis, which helps enterprises with PCI assessment.

"Some important areas in this new mentality focus on security processes," Schumacher says in a blog. "For example, entities should be validating on their own that controls are implemented effectively for applicable businesses processes and related technologies. Some specific examples related to this new mentality focus on antivirus definitions, logging, vulnerability signatures and ensuring that only appropriate services are enabled on systems.

"With this new mentality, entities should look to take corrective actions when compliance gaps are identified so that PCI DSS compliance can be maintained at all times and not wait until their [auditor] comes to validate their compliance."

Some experts said the new guidelines don't go far enough.

"Overall, the council has made some excellent improvements to the standard, but the risk management area of PCI 3.0 still needs more work," says Michael Aminzade, director of compliance delivery at Trustwave. "The main area of concern is that even though the new standards reference risk management strategies that must be met, the standard doesn't enforce companies to adopt any of those strategies. In particular, the standard doesn't address the fact that risk assessments need to be done by an industry-certified professional and are only performed on an annual basis. Also, PCI DSS 3.0 does not include any changes surrounding mobile security."

Have a comment on this story? Please click "Add a Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Threat Intel Today
Threat Intel Today
The 397 respondents to our new survey buy into using intel to stay ahead of attackers: 85% say threat intelligence plays some role in their IT security strategies, and many of them subscribe to two or more third-party feeds; 10% leverage five or more.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-1978
Published: 2015-05-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Simple PHP Agenda 2.2.8 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add an administrator via a request to auth/process.php, (2) delete an administrator via a request to auth/admi...

CVE-2015-0741
Published: 2015-05-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Cisco Prime Central for Hosted Collaboration Solution (PC4HCS) 10.6(1) and earlier allow remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCut04596.

CVE-2015-0742
Published: 2015-05-21
The Protocol Independent Multicast (PIM) application in Cisco Adaptive Security Appliance (ASA) Software 9.2(0.0), 9.2(0.104), 9.2(3.1), 9.2(3.4), 9.3(1.105), 9.3(2.100), 9.4(0.115), 100.13(0.21), 100.13(20.3), 100.13(21.9), and 100.14(1.1) does not properly implement multicast-forwarding registrati...

CVE-2015-0746
Published: 2015-05-21
The REST API in Cisco Access Control Server (ACS) 5.5(0.46.2) allows remote attackers to cause a denial of service (API outage) by sending many requests, aka Bug ID CSCut62022.

CVE-2015-0915
Published: 2015-05-21
Cross-site scripting (XSS) vulnerability in RAKUS MailDealer 11.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted attachment filename.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.