thePCI Portal

Author: Ed

Best Practices for Securing eCommerce Information Supplement

Best Practices for Securing eCommerce Information Supplement is a great doc full of comprehensive info! The objective of this information supplement is to update and replace the PCI DSS E-commerce Guidelines published in 2013. Its a comprehensive 64 page document.  Useful info for anyone who does or is considering e-commerce.  A couple of the tidbits…

SharePoint users rejoice

It seems like PCI Assessments and large SharePoint file repositories go hand in hand.  I am sure we have all learned a SharePoint trick or two like: How to open SharePoint sites in file explorer for easy file manipulation. Mapping a drive to a SharePoint site. Using Microsoft’s agent to synch a SharePoint site locally.…

The significance of change

  A significant change triggers several required action for PCI DSS compliance. PCI DSS Requirement Annual Significant Change 6.6 •          Web application vulnerability security assessments, AND/OR •          Automated technical solution that detects and prevents web-based attacks, such as web application firewalls. Include tests for the vulnerabilities in 6.5.1 to 5.5.10 YES YES 11.2 internal and…

Whats the 411 on section 4.11 Managed Service Provider?

While completing a version 3.2 PCI DSS assessment, you will eventually get to section 4.11 titled Managed service providers.  (the section formerly known as 4.12 in version 3.1) Presuming that the assessed entity is a service provider, what constitutes a “managed” service provider? Section 4.11 does not shed much light on the topic.  Time to…

the Council Plans to Publish Scoping Guidance!

The latest news update for QSA’s includes news of an upcoming holiday gift for those in the PCI DSS world! The Security Standards Council plans to publish “Guidance for PCI DSS Scoping and Network Segmentation.”  in December 2016.  The Council informs that the guidance “aims to clarify scoping and segmentation principles provided in the PCI DSS”.…

Redirect, but don’t forget

  Thanks to the PCI Guru for bringing this story to my attention with this post. In the continued vein of “Don’t descope your redirecting ecommerce web server!“, the The Foregenix Digital Forensics and Incident Response Team talks about some of the risks that remain in your ecommerce payment channel, even if you are redirecting, using…

Does v3.2 require multifactor authentication to admin my router?

Lets ignore, for now, a risk based answer to the question. Does PCI DSS v3.2 require network device administrators to use multifactor authentication when accessing a router? Lets presume that network traffic containing the PAN traverses the router. PCI DSS v3.2 requirement 8.3.1 states: 8.3.1 Incorporate multi-factor authentication for all non-console access into the CDE…