Perimeter
8/24/2011
09:47 AM
Commentary
Commentary
Commentary
50%
50%

PCI QSA Status Revocation A Shot Across The Bow For QSAs?

The PCI Security Council's move spells trouble for unscrupulous QSAs and shows that the Council means business in enforcing its quality standards

The Payment Card Industry Security Standards Council's recent revocation of the status of a Qualified Security Assessor as part of the Council’s quality assurance process. Was this a one-time event a sign that the Council is cracking down on QSAs that are sloppy or too lenient in their assessments, or a warning signal to QSAs that there really is a sheriff in town and that they had better clean up their acts?

It's probably a bit of both. Effective August 3, 2011, the PCI Security Council revoked the QSA and PA-QSA status of CSO for failing to follow processes that “ensure consistency, credibility, competency and professional ethics.” According to the PCI Council’s letter on the subject, the revocation follows a process where the Council required remediation of deficiencies in CSO’s practices, but were not completed to the Council’s satisfaction. Clearly, this is not what either CSO or the Council wanted.

What does this mean to CSO and its customers?

As a result of the revocation, CSO is no longer allowed to validate merchants’ and service providers’ security practices, nor can it validate products for compliance with the PA-DSS. The Council was careful not to revoke the validated status of CSO’s customers that had completed the process. However, that doesn’t mean that those customers in the midst of the validation process are so fortunate. Companies assessed by CSO and in the quality assurance queue awaiting confirmation are out of luck. They need to find a new QSA.

What about customers of CSO’s customers?

The revocation calls to question the methods used by CSO and the effectiveness of the company’s techniques used to evaluate the organizations and products it assessed in the past. This casts doubt on the security of the products and organizations, even if they continue to appear on the list of validated vendors and products.

The Council recommends to all of CSO’s customers that they find a new QSA (or PA-QSA) to review their practices and ensure that deficiencies in CSO’s processes do not result in real security weaknesses. The problem is a customer of one of CSO’s validated customers can’t know for certain whether the product or service is truly flawed, and the beneficiary of a weak assessment process or the unfortunate victim of an undisciplined assessor. The hope is that product and service weaknesses with be exposed and addressed quickly as a result of PCI’s annual assessment requirement.

What does this mean to other QSAs?

The QSA community should see the revocation as a wake-up call. QSAs who take shortcuts, do not follow the assessment process thoroughly, or interpret the rules in the most lenient way, will have a higher probability of getting caught. The damage to the QSA’s reputation might be devastating to the its entire business (most QSA companies are involved in more than just assessments).

The result may be that assessments may become more expensive, but the improvement of quality and consistency will benefit consumers, merchants, service providers, and the honest assessors who have had a hard time competing on price with organizations that take shortcuts.

Richard Mackey is vice president of consulting at SystemExperts Corp.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5314
Published: 2014-11-23
Buffer overflow in Cybozu Office 9 and 10 before 10.1.0, Mailwise 4 and 5 before 5.1.4, and Dezie 8 before 8.1.1 allows remote authenticated users to execute arbitrary code via e-mail messages.

CVE-2014-5325
Published: 2014-11-23
The (1) DOMConverter, (2) JDOMConverter, (3) DOM4JConverter, and (4) XOMConverter functions in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allow remote attackers to read arbitrary files via DOM data containing an XML external entity declaration in conjunction with an entity refe...

CVE-2014-5326
Published: 2014-11-23
Cross-site scripting (XSS) vulnerability in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2014-6477
Published: 2014-11-23
Unspecified vulnerability in the JPublisher component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality via unknown vectors, a different vulnerability than CVE-2014-4290, CVE-2014-4291, CVE-2014-4292, CVE-2014-4...

CVE-2014-4807
Published: 2014-11-22
Sterling Order Management in IBM Sterling Selling and Fulfillment Suite 9.3.0 before FP8 allows remote authenticated users to cause a denial of service (CPU consumption) via a '\0' character.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?