thePCI Portal

Category: V3.2

MultiFactor and Multistep authentication

Some of the simple common questions regarding what is allowed for multifactor authentication are answered in FAQs from the Council. Some of the more complex ones aren’t and need technical expertise to answer, sorry. FAQ 1425:  Is “two-step” authentication the same as “two-factor” or “multi-factor” authentication? Answer summary:  NO FAQ 1449: Is two-step authentication acceptable…

Rogue Wireless AP detection

Technical solutions exist to automate the process of detecting unauthorized wireless access points on a network.  These solutions generally work by monitoring radio frequencies to detect new wireless networks and/or monitoring the wired network for wireless access points.   Sometimes these features are built into the same equipment that provides the authorized wireless networks.  A manual…

Pen Testing for PCI v3.2

Whether you outsource or perform your own penetration tests, you should have a documented penetration testing methodology.  This methodology should: Specify a retention period penetration testing results and remediation activities results. Specify coverage for the entire CDE perimeter and critical systems. (referencing your PCI inscope asset list/inventory is probably a good idea.) Specify the frequency…

Supplementary validation for “designated” entities

Have you ever heard of the supplementary validation for designated entities (a.k.a DESV)? If not, you should be happy.  According to the Council’s FAQ for designated entities, “A Designated Entity is determined by an Acquirer or Payment Brand as an organization that requires additional validation to existing PCI DSS requirements. “ Organizations that view PCI…

Best Practices for Securing eCommerce Information Supplement

Best Practices for Securing eCommerce Information Supplement is a great doc full of comprehensive info! The objective of this information supplement is to update and replace the PCI DSS E-commerce Guidelines published in 2013. Its a comprehensive 64 page document.  Useful info for anyone who does or is considering e-commerce.  A couple of the tidbits…

The significance of change

  A significant change triggers several required action for PCI DSS compliance. PCI DSS Requirement Annual Significant Change 6.6 •          Web application vulnerability security assessments, AND/OR •          Automated technical solution that detects and prevents web-based attacks, such as web application firewalls. Include tests for the vulnerabilities in 6.5.1 to 5.5.10 YES YES 11.2 internal and…

Whats the 411 on section 4.11 Managed Service Provider?

While completing a version 3.2 PCI DSS assessment, you will eventually get to section 4.11 titled Managed service providers.  (the section formerly known as 4.12 in version 3.1) Presuming that the assessed entity is a service provider, what constitutes a “managed” service provider? Section 4.11 does not shed much light on the topic.  Time to…

Redirect, but don’t forget

  Thanks to the PCI Guru for bringing this story to my attention with this post. In the continued vein of “Don’t descope your redirecting ecommerce web server!“, the The Foregenix Digital Forensics and Incident Response Team talks about some of the risks that remain in your ecommerce payment channel, even if you are redirecting, using…