Clinging to TLS 1.0 Puts Sites Outside PCI DSS Compliance
More than half of organizations could be out of compliance, new research shows.
When an old protocol refuses to die, it can have a major impact on security — and cause an organization to fall out of regulatory compliance. Case in point: New research from Panorays shows more than half of organizations could be out of PCI compliance because they just can't let go of TLS 1.0.
Panorays' review of 1,150 organizations indicated that 52% use TLS 1.0 on all of their websites (a total of 29,000), while another 45% use TLS 1.0 on at least one site. PCI DSS requires organizations to replace TLS 1.0 with TLS 1.1 or 1.2. The older protocol has been shown to be more vulnerable to man-in-the-middle and other attacks than its replacements.
Among the reasons speculated for companies retaining TLS 1.0 on their websites are the need to take care of endpoint users with old browsers and applications that don't support newer versions of TLS, and a lack of awareness of the PCI DSS requirements.
Read more here.
About the Author(s)
You May Also Like
Beyond Spam Filters and Firewalls: Preventing Business Email Compromises in the Modern Enterprise
April 30, 2024Key Findings from the State of AppSec Report 2024
May 7, 2024Is AI Identifying Threats to Your Network?
May 14, 2024Where and Why Threat Intelligence Makes Sense for Your Enterprise Security Strategy
May 15, 2024Safeguarding Political Campaigns: Defending Against Mass Phishing Attacks
May 16, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024