Analytics
11/11/2013
07:58 AM
Tim Wilson
Tim Wilson
Quick Hits
50%
50%

New Version Of PCI Compliance Guidelines Released

PCI 3.0 changes focus on compliance as a business-as-usual process, rather than a snapshot

The Payment Card Industry (PCI) Security Standards Council (SSC) Thursday released PCI 3.0, the latest version of the council's security compliance requirements for businesses that accept credit and debit cards.

Available now on the PCI SSC website (PDF), version 3.0 becomes effective on Jan. 1. Version 2.0 will remain active until Dec. 31, 2014, to ensure adequate time for organizations to make the transition.

Many of the key changes to the guidelines are designed to make compliance more of a regular process, rather than a report on a company's compliance at a specific point in time, according to the council and other experts.

"Version 3.0 will help organizations make payment security part of their business-as-usual activities by introducing more flexibility, and an increased focus on education, awareness and security as a shared responsibility," the PCI Council says. "Overall updates include specific recommendations for making PCI DSS part of everyday business processes and best practices for maintaining ongoing PCI DSS compliance; guidance from the Navigating PCI DSS Guide built in to the standard; and enhanced testing procedures to clarify the level of validation expected for each requirement."

"PCI DSS is stressing that their compliance standard is not a set-it-and-forget-it mentality," says Joe Schumacher, security consultant at Neohapsis, which helps enterprises with PCI assessment.

"Some important areas in this new mentality focus on security processes," Schumacher says in a blog. "For example, entities should be validating on their own that controls are implemented effectively for applicable businesses processes and related technologies. Some specific examples related to this new mentality focus on antivirus definitions, logging, vulnerability signatures and ensuring that only appropriate services are enabled on systems.

"With this new mentality, entities should look to take corrective actions when compliance gaps are identified so that PCI DSS compliance can be maintained at all times and not wait until their [auditor] comes to validate their compliance."

Some experts said the new guidelines don't go far enough.

"Overall, the council has made some excellent improvements to the standard, but the risk management area of PCI 3.0 still needs more work," says Michael Aminzade, director of compliance delivery at Trustwave. "The main area of concern is that even though the new standards reference risk management strategies that must be met, the standard doesn't enforce companies to adopt any of those strategies. In particular, the standard doesn't address the fact that risk assessments need to be done by an industry-certified professional and are only performed on an annual basis. Also, PCI DSS 3.0 does not include any changes surrounding mobile security."

Have a comment on this story? Please click "Add a Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Threat Intel Today
Threat Intel Today
The 397 respondents to our new survey buy into using intel to stay ahead of attackers: 85% say threat intelligence plays some role in their IT security strategies, and many of them subscribe to two or more third-party feeds; 10% leverage five or more.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-1421
Published: 2014-11-25
mountall 1.54, as used in Ubuntu 14.10, does not properly handle the umask when using the mount utility, which allows local users to bypass intended access restrictions via unspecified vectors.

CVE-2014-3605
Published: 2014-11-25
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-6407. Reason: This candidate is a reservation duplicate of CVE-2014-6407. Notes: All CVE users should reference CVE-2014-6407 instead of this candidate. All references and descriptions in this candidate have been removed to pre...

CVE-2014-7839
Published: 2014-11-25
DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external-general-entities or (2) external-parameter-entities features, which allows remote attackers to conduct XML external entity (XXE) attacks via unspecified vectors.

CVE-2014-8001
Published: 2014-11-25
Buffer overflow in decode.cpp in Cisco OpenH264 1.2.0 and earlier allows remote attackers to execute arbitrary code via an encoded media file.

CVE-2014-8002
Published: 2014-11-25
Use-after-free vulnerability in decode_slice.cpp in Cisco OpenH264 1.2.0 and earlier allows remote attackers to execute arbitrary code via an encoded media file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?