Analytics
11/11/2013
07:58 AM
Tim Wilson
Tim Wilson
Quick Hits
50%
50%

New Version Of PCI Compliance Guidelines Released

PCI 3.0 changes focus on compliance as a business-as-usual process, rather than a snapshot

The Payment Card Industry (PCI) Security Standards Council (SSC) Thursday released PCI 3.0, the latest version of the council's security compliance requirements for businesses that accept credit and debit cards.

Available now on the PCI SSC website (PDF), version 3.0 becomes effective on Jan. 1. Version 2.0 will remain active until Dec. 31, 2014, to ensure adequate time for organizations to make the transition.

Many of the key changes to the guidelines are designed to make compliance more of a regular process, rather than a report on a company's compliance at a specific point in time, according to the council and other experts.

"Version 3.0 will help organizations make payment security part of their business-as-usual activities by introducing more flexibility, and an increased focus on education, awareness and security as a shared responsibility," the PCI Council says. "Overall updates include specific recommendations for making PCI DSS part of everyday business processes and best practices for maintaining ongoing PCI DSS compliance; guidance from the Navigating PCI DSS Guide built in to the standard; and enhanced testing procedures to clarify the level of validation expected for each requirement."

"PCI DSS is stressing that their compliance standard is not a set-it-and-forget-it mentality," says Joe Schumacher, security consultant at Neohapsis, which helps enterprises with PCI assessment.

"Some important areas in this new mentality focus on security processes," Schumacher says in a blog. "For example, entities should be validating on their own that controls are implemented effectively for applicable businesses processes and related technologies. Some specific examples related to this new mentality focus on antivirus definitions, logging, vulnerability signatures and ensuring that only appropriate services are enabled on systems.

"With this new mentality, entities should look to take corrective actions when compliance gaps are identified so that PCI DSS compliance can be maintained at all times and not wait until their [auditor] comes to validate their compliance."

Some experts said the new guidelines don't go far enough.

"Overall, the council has made some excellent improvements to the standard, but the risk management area of PCI 3.0 still needs more work," says Michael Aminzade, director of compliance delivery at Trustwave. "The main area of concern is that even though the new standards reference risk management strategies that must be met, the standard doesn't enforce companies to adopt any of those strategies. In particular, the standard doesn't address the fact that risk assessments need to be done by an industry-certified professional and are only performed on an annual basis. Also, PCI DSS 3.0 does not include any changes surrounding mobile security."

Have a comment on this story? Please click "Add a Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Threat Intel Today
Threat Intel Today
The 397 respondents to our new survey buy into using intel to stay ahead of attackers: 85% say threat intelligence plays some role in their IT security strategies, and many of them subscribe to two or more third-party feeds; 10% leverage five or more.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5211
Published: 2015-01-27
Stack-based buffer overflow in the Attachmate Reflection FTP Client before 14.1.433 allows remote FTP servers to execute arbitrary code via a large PWD response.

CVE-2014-8154
Published: 2015-01-27
The Gst.MapInfo function in Vala 0.26.0 and 0.26.1 uses an incorrect buffer length declaration for the Gstreamer bindings, which allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors, which trigger a heap-based buffer overf...

CVE-2014-9197
Published: 2015-01-27
The Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware before 1.60 IR 04 stores rde.jar under the web root with insufficient access control, which allows remote attackers to obtain sensitive setup and configuration information via a direct request.

CVE-2014-9198
Published: 2015-01-27
The FTP server on the Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware through 1.60 IR 04 has hardcoded credentials, which makes it easier for remote attackers to obtain access via an FTP session.

CVE-2014-9646
Published: 2015-01-27
Unquoted Windows search path vulnerability in the GoogleChromeDistribution::DoPostUninstallOperations function in installer/util/google_chrome_distribution.cc in the uninstall-survey feature in Google Chrome before 40.0.2214.91 allows local users to gain privileges via a Trojan horse program in the ...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.