Perimeter
8/24/2011
09:47 AM
Commentary
Commentary
Commentary
Connect Directly
RSS
E-Mail
50%
50%

PCI QSA Status Revocation A Shot Across The Bow For QSAs?

The PCI Security Council's move spells trouble for unscrupulous QSAs and shows that the Council means business in enforcing its quality standards

The Payment Card Industry Security Standards Council's recent revocation of the status of a Qualified Security Assessor as part of the Council’s quality assurance process. Was this a one-time event a sign that the Council is cracking down on QSAs that are sloppy or too lenient in their assessments, or a warning signal to QSAs that there really is a sheriff in town and that they had better clean up their acts?

It's probably a bit of both. Effective August 3, 2011, the PCI Security Council revoked the QSA and PA-QSA status of CSO for failing to follow processes that “ensure consistency, credibility, competency and professional ethics.” According to the PCI Council’s letter on the subject, the revocation follows a process where the Council required remediation of deficiencies in CSO’s practices, but were not completed to the Council’s satisfaction. Clearly, this is not what either CSO or the Council wanted.

What does this mean to CSO and its customers?

As a result of the revocation, CSO is no longer allowed to validate merchants’ and service providers’ security practices, nor can it validate products for compliance with the PA-DSS. The Council was careful not to revoke the validated status of CSO’s customers that had completed the process. However, that doesn’t mean that those customers in the midst of the validation process are so fortunate. Companies assessed by CSO and in the quality assurance queue awaiting confirmation are out of luck. They need to find a new QSA.

What about customers of CSO’s customers?

The revocation calls to question the methods used by CSO and the effectiveness of the company’s techniques used to evaluate the organizations and products it assessed in the past. This casts doubt on the security of the products and organizations, even if they continue to appear on the list of validated vendors and products.

The Council recommends to all of CSO’s customers that they find a new QSA (or PA-QSA) to review their practices and ensure that deficiencies in CSO’s processes do not result in real security weaknesses. The problem is a customer of one of CSO’s validated customers can’t know for certain whether the product or service is truly flawed, and the beneficiary of a weak assessment process or the unfortunate victim of an undisciplined assessor. The hope is that product and service weaknesses with be exposed and addressed quickly as a result of PCI’s annual assessment requirement.

What does this mean to other QSAs?

The QSA community should see the revocation as a wake-up call. QSAs who take shortcuts, do not follow the assessment process thoroughly, or interpret the rules in the most lenient way, will have a higher probability of getting caught. The damage to the QSA’s reputation might be devastating to the its entire business (most QSA companies are involved in more than just assessments).

The result may be that assessments may become more expensive, but the improvement of quality and consistency will benefit consumers, merchants, service providers, and the honest assessors who have had a hard time competing on price with organizations that take shortcuts.

Richard Mackey is vice president of consulting at SystemExperts Corp.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0914
Published: 2014-07-30
Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 6.2 through 6.2.8 and 6.x and 7.x through 7.5.0.6, Maximo Asset Management 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk, and Maximo Asset Management 6.2 through 6.2.8 for Tivoli IT Asset Management f...

CVE-2014-0915
Published: 2014-07-30
Multiple cross-site scripting (XSS) vulnerabilities in IBM Maximo Asset Management 6.2 through 6.2.8, 6.x and 7.1 through 7.1.1.2, and 7.5 through 7.5.0.6; Maximo Asset Management 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk; and Maximo Asset Management 6.2 through 6.2.8...

CVE-2014-0947
Published: 2014-07-30
Unspecified vulnerability in the server in IBM Rational Software Architect Design Manager 4.0.6 allows remote authenticated users to execute arbitrary code via a crafted update site.

CVE-2014-0948
Published: 2014-07-30
Unspecified vulnerability in IBM Rational Software Architect Design Manager and Rational Rhapsody Design Manager 3.x and 4.x before 4.0.7 allows remote authenticated users to execute arbitrary code via a crafted ZIP archive.

CVE-2014-2356
Published: 2014-07-30
Innominate mGuard before 7.6.4 and 8.x before 8.0.3 does not require authentication for snapshot downloads, which allows remote attackers to obtain sensitive information via a crafted HTTPS request.

Best of the Web
Dark Reading Radio