Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

8/24/2011
09:47 AM
Commentary
Commentary
Commentary
50%
50%

PCI QSA Status Revocation A Shot Across The Bow For QSAs?

The PCI Security Council's move spells trouble for unscrupulous QSAs and shows that the Council means business in enforcing its quality standards

The Payment Card Industry Security Standards Council's recent revocation of the status of a Qualified Security Assessor as part of the Council’s quality assurance process. Was this a one-time event a sign that the Council is cracking down on QSAs that are sloppy or too lenient in their assessments, or a warning signal to QSAs that there really is a sheriff in town and that they had better clean up their acts?

It's probably a bit of both. Effective August 3, 2011, the PCI Security Council revoked the QSA and PA-QSA status of CSO for failing to follow processes that “ensure consistency, credibility, competency and professional ethics.” According to the PCI Council’s letter on the subject, the revocation follows a process where the Council required remediation of deficiencies in CSO’s practices, but were not completed to the Council’s satisfaction. Clearly, this is not what either CSO or the Council wanted.

What does this mean to CSO and its customers?

As a result of the revocation, CSO is no longer allowed to validate merchants’ and service providers’ security practices, nor can it validate products for compliance with the PA-DSS. The Council was careful not to revoke the validated status of CSO’s customers that had completed the process. However, that doesn’t mean that those customers in the midst of the validation process are so fortunate. Companies assessed by CSO and in the quality assurance queue awaiting confirmation are out of luck. They need to find a new QSA.

What about customers of CSO’s customers?

The revocation calls to question the methods used by CSO and the effectiveness of the company’s techniques used to evaluate the organizations and products it assessed in the past. This casts doubt on the security of the products and organizations, even if they continue to appear on the list of validated vendors and products.

The Council recommends to all of CSO’s customers that they find a new QSA (or PA-QSA) to review their practices and ensure that deficiencies in CSO’s processes do not result in real security weaknesses. The problem is a customer of one of CSO’s validated customers can’t know for certain whether the product or service is truly flawed, and the beneficiary of a weak assessment process or the unfortunate victim of an undisciplined assessor. The hope is that product and service weaknesses with be exposed and addressed quickly as a result of PCI’s annual assessment requirement.

What does this mean to other QSAs?

The QSA community should see the revocation as a wake-up call. QSAs who take shortcuts, do not follow the assessment process thoroughly, or interpret the rules in the most lenient way, will have a higher probability of getting caught. The damage to the QSA’s reputation might be devastating to the its entire business (most QSA companies are involved in more than just assessments).

The result may be that assessments may become more expensive, but the improvement of quality and consistency will benefit consumers, merchants, service providers, and the honest assessors who have had a hard time competing on price with organizations that take shortcuts.

Richard Mackey is vice president of consulting at SystemExperts Corp.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
Breaches Are Inevitable, So Embrace the Chaos
Ariel Zeitlin, Chief Technology Officer & Co-Founder, Guardicore,  11/13/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-13581
PUBLISHED: 2019-11-15
An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52, as used on Tesla Model S/X vehicles manufactured before March 2018, via the Parrot Faurecia Automotive FC6050W module. A heap-based buffer overflow allows remote attackers to cause a denial of service or execute arbitrary ...
CVE-2019-13582
PUBLISHED: 2019-11-15
An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52, as used on Tesla Model S/X vehicles manufactured before March 2018, via the Parrot Faurecia Automotive FC6050W module. A stack overflow could lead to denial of service or arbitrary code execution.
CVE-2019-6659
PUBLISHED: 2019-11-15
On version 14.0.0-14.1.0.1, BIG-IP virtual servers with TLSv1.3 enabled may experience a denial of service due to undisclosed incoming messages.
CVE-2019-6660
PUBLISHED: 2019-11-15
On BIG-IP 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.1, undisclosed HTTP requests may consume excessive amounts of systems resources which may lead to a denial of service.
CVE-2019-6661
PUBLISHED: 2019-11-15
When the BIG-IP APM 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.4.1, or 11.5.1-11.6.5 system processes certain requests, the APD/APMD daemon may consume excessive resources.