Risk
11/19/2009
11:15 AM
Connect Directly
LinkedIn
Google+
Twitter
RSS
E-Mail
50%
50%

Lessons Learned From PCI Compliance

Assessors reveal mistakes companies make with data security standard.

3. Take Advantage Of Overlaps

Companies large enough to process millions of credit card transactions are likely to be subject to other regulations, such as Sarbanes-Oxley, or standards such as ISO and the SAS 70 security audit, as well as state laws that mandate the protection of consumer information. Many companies treat each requirement separately, so that every audit becomes a disruptive event, says the Neohapsis QSA. A more proactive approach is to dovetail as many requirements as possible so that audits are less of an issue.

For instance, regulation X might mandate seven-character passwords, while regulation Y says eight. "Set it to nine and satisfy all those controls," he says. "I haven't seen a lot of effort there. People wait for the auditor to come through and correct you instead of doing it as a unified effort."

4. Your Assessor Isn't The Enemy

It's hard for overworked and underfunded IT and security teams to watch some dude stroll in with a scorecard and tell them where they've failed--and then send a bill. A certain coolness, if not downright animosity, is to be expected.

But your company has an obligation to protect cardholder data, and the assessor can help achieve that goal. Companies should view assessors "not as opponents, but as partners in developing sound security programs," says Fabian J. Olivia, a QSA and global PCI competency leader at IBM.

Some IT teams realize that they can use the findings from an assessment to get funding they've been asking for to implement critical projects, says Branden Williams, a QSA and senior director of consulting at AT&T Consulting's PCI group. If you know a PCI assessment is coming, document areas where your controls are weak, outline a plan to address them, and get that information in front of management immediately. Once the assessment is over, you'll have third-party validation that the issues you've raised are important, and funding may come your way.

3 Typical
PCI Compliance Errors
> PCI requires companies to maintain a network diagram that shows how card data flows through IT systems, but assessors say companies often don't have one or it lacks critical details.
> According to PCI, companies must install critical security patches, but patches sometimes break systems, or one IT group requests a patch but another forgets to install it.
> Sometimes IT runs external scans but neglects to scan inside the firewall, which PCI requires. Organizations also must show that vulnerabilities have been remediated by running a scan after patches are deployed, but many skip this step.

5. This Is A Pass/Fail Test

Unlike many regulations that emphasize risk management, PCI is a prescriptive compliance standard. It requires specific controls and processes, and organiz- ations have to meet all the requirements, or they won't pass. "There is no partial compliance," says the Neohapsis QSA. "You either are, or you are not. It's not something the QSA can change for you."

PCI critics say the standard is complex and costly, and that compliant companies can still lose data. We agree. But despite its flaws, PCI is an opportunity for companies to get serious about their obligation to protect cardholder data and implement sensible controls. "PCI compliance should be a by-product of sound security practices and programs," says IBM's Olivia. We also agree.

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "I've seen worse.  Last week Tim had a dragon."
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.