Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

8/24/2011
09:47 AM
Commentary
Commentary
Commentary
50%
50%

PCI QSA Status Revocation A Shot Across The Bow For QSAs?

The PCI Security Council's move spells trouble for unscrupulous QSAs and shows that the Council means business in enforcing its quality standards

The Payment Card Industry Security Standards Council's recent revocation of the status of a Qualified Security Assessor as part of the Council’s quality assurance process. Was this a one-time event a sign that the Council is cracking down on QSAs that are sloppy or too lenient in their assessments, or a warning signal to QSAs that there really is a sheriff in town and that they had better clean up their acts?

It's probably a bit of both. Effective August 3, 2011, the PCI Security Council revoked the QSA and PA-QSA status of CSO for failing to follow processes that “ensure consistency, credibility, competency and professional ethics.” According to the PCI Council’s letter on the subject, the revocation follows a process where the Council required remediation of deficiencies in CSO’s practices, but were not completed to the Council’s satisfaction. Clearly, this is not what either CSO or the Council wanted.

What does this mean to CSO and its customers?

As a result of the revocation, CSO is no longer allowed to validate merchants’ and service providers’ security practices, nor can it validate products for compliance with the PA-DSS. The Council was careful not to revoke the validated status of CSO’s customers that had completed the process. However, that doesn’t mean that those customers in the midst of the validation process are so fortunate. Companies assessed by CSO and in the quality assurance queue awaiting confirmation are out of luck. They need to find a new QSA.

What about customers of CSO’s customers?

The revocation calls to question the methods used by CSO and the effectiveness of the company’s techniques used to evaluate the organizations and products it assessed in the past. This casts doubt on the security of the products and organizations, even if they continue to appear on the list of validated vendors and products.

The Council recommends to all of CSO’s customers that they find a new QSA (or PA-QSA) to review their practices and ensure that deficiencies in CSO’s processes do not result in real security weaknesses. The problem is a customer of one of CSO’s validated customers can’t know for certain whether the product or service is truly flawed, and the beneficiary of a weak assessment process or the unfortunate victim of an undisciplined assessor. The hope is that product and service weaknesses with be exposed and addressed quickly as a result of PCI’s annual assessment requirement.

What does this mean to other QSAs?

The QSA community should see the revocation as a wake-up call. QSAs who take shortcuts, do not follow the assessment process thoroughly, or interpret the rules in the most lenient way, will have a higher probability of getting caught. The damage to the QSA’s reputation might be devastating to the its entire business (most QSA companies are involved in more than just assessments).

The result may be that assessments may become more expensive, but the improvement of quality and consistency will benefit consumers, merchants, service providers, and the honest assessors who have had a hard time competing on price with organizations that take shortcuts.

Richard Mackey is vice president of consulting at SystemExperts Corp.

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11498
PUBLISHED: 2020-04-02
Slack Nebula through 1.1.0 contains a relative path vulnerability that allows a low-privileged attacker to execute code in the context of the root user via tun_darwin.go or tun_windows.go. A user can also use Nebula to execute arbitrary code in the user's own context, e.g., for user-level persistenc...
CVE-2020-11499
PUBLISHED: 2020-04-02
Firmware Analysis and Comparison Tool (FACT) 3 has Stored XSS when updating analysis details via a localhost web request, as demonstrated by mishandling of the tags and version fields in helperFunctions/mongo_task_conversion.py.
CVE-2020-7628
PUBLISHED: 2020-04-02
install-package through 1.1.6 is vulnerable to Command Injection. It allows execution of arbitrary commands via the device function.
CVE-2020-7629
PUBLISHED: 2020-04-02
install-package through 0.4.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument.
CVE-2020-7630
PUBLISHED: 2020-04-02
git-add-remote through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the name argument.