Perimeter
8/24/2011
09:47 AM
Commentary
Commentary
Commentary
Connect Directly
RSS
E-Mail
50%
50%
Repost This

PCI QSA Status Revocation A Shot Across The Bow For QSAs?

The PCI Security Council's move spells trouble for unscrupulous QSAs and shows that the Council means business in enforcing its quality standards

The Payment Card Industry Security Standards Council's recent revocation of the status of a Qualified Security Assessor as part of the Council’s quality assurance process. Was this a one-time event a sign that the Council is cracking down on QSAs that are sloppy or too lenient in their assessments, or a warning signal to QSAs that there really is a sheriff in town and that they had better clean up their acts?

It's probably a bit of both. Effective August 3, 2011, the PCI Security Council revoked the QSA and PA-QSA status of CSO for failing to follow processes that “ensure consistency, credibility, competency and professional ethics.” According to the PCI Council’s letter on the subject, the revocation follows a process where the Council required remediation of deficiencies in CSO’s practices, but were not completed to the Council’s satisfaction. Clearly, this is not what either CSO or the Council wanted.

What does this mean to CSO and its customers?

As a result of the revocation, CSO is no longer allowed to validate merchants’ and service providers’ security practices, nor can it validate products for compliance with the PA-DSS. The Council was careful not to revoke the validated status of CSO’s customers that had completed the process. However, that doesn’t mean that those customers in the midst of the validation process are so fortunate. Companies assessed by CSO and in the quality assurance queue awaiting confirmation are out of luck. They need to find a new QSA.

What about customers of CSO’s customers?

The revocation calls to question the methods used by CSO and the effectiveness of the company’s techniques used to evaluate the organizations and products it assessed in the past. This casts doubt on the security of the products and organizations, even if they continue to appear on the list of validated vendors and products.

The Council recommends to all of CSO’s customers that they find a new QSA (or PA-QSA) to review their practices and ensure that deficiencies in CSO’s processes do not result in real security weaknesses. The problem is a customer of one of CSO’s validated customers can’t know for certain whether the product or service is truly flawed, and the beneficiary of a weak assessment process or the unfortunate victim of an undisciplined assessor. The hope is that product and service weaknesses with be exposed and addressed quickly as a result of PCI’s annual assessment requirement.

What does this mean to other QSAs?

The QSA community should see the revocation as a wake-up call. QSAs who take shortcuts, do not follow the assessment process thoroughly, or interpret the rules in the most lenient way, will have a higher probability of getting caught. The damage to the QSA’s reputation might be devastating to the its entire business (most QSA companies are involved in more than just assessments).

The result may be that assessments may become more expensive, but the improvement of quality and consistency will benefit consumers, merchants, service providers, and the honest assessors who have had a hard time competing on price with organizations that take shortcuts.

Richard Mackey is vice president of consulting at SystemExperts Corp.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-0360
Published: 2014-04-23
Memory leak in Cisco IOS before 15.1(1)SY, when IKEv2 debugging is enabled, allows remote attackers to cause a denial of service (memory consumption) via crafted packets, aka Bug ID CSCtn22376.

CVE-2012-1317
Published: 2014-04-23
The multicast implementation in Cisco IOS before 15.1(1)SY allows remote attackers to cause a denial of service (Route Processor crash) by sending packets at a high rate, aka Bug ID CSCts37717.

CVE-2012-1366
Published: 2014-04-23
Cisco IOS before 15.1(1)SY on ASR 1000 devices, when Multicast Listener Discovery (MLD) tracking is enabled for IPv6, allows remote attackers to cause a denial of service (device reload) via crafted MLD packets, aka Bug ID CSCtz28544.

CVE-2012-3062
Published: 2014-04-23
Cisco IOS before 15.1(1)SY, when Multicast Listener Discovery (MLD) snooping is enabled, allows remote attackers to cause a denial of service (CPU consumption or device crash) via MLD packets on a network that contains many IPv6 hosts, aka Bug ID CSCtr88193.

CVE-2012-3918
Published: 2014-04-23
Cisco IOS before 15.3(1)T on Cisco 2900 devices, when a VWIC2-2MFT-T1/E1 card is configured for TDM/HDLC mode, allows remote attackers to cause a denial of service (serial-interface outage) via certain Frame Relay traffic, aka Bug ID CSCub13317.

Best of the Web