My experiences and observations around becoming an Internal Security Assessor. Hi, my name is Marlen, and I’ve been working with a QSA handling PCI Compliance on behalf of my employer, a level 2 merchant retailer of Wine, Beer, Spirits, and as of late, Cannabis (a legal product in our jurisdiction). We are now taking the…
The Council has a blog post about the upcoming revision to the data security standard, version 4. While talking about version 4, the council has specifically identified the following industry feedback related to the DSS: Authentication, specifically consideration for the NIST MFA/password guidance Broader applicability for encrypting cardholder data on trusted networks Monitoring requirements to…
Did you know that the Verizon 2018 Payment Security Report has a PCI DSS Compliance calendar that is a great start to (or supplement to) an organization’s internal compliance calendar? Its not a new feature of the annual report, but its nice to be reminded its there and it appears to be updated for version…
Visa Canada’s document “The Future of Payment Security in Canada” published in October 2017 has a lot of interesting information. In addition to an overview of the fraud landscape in Canada it outlines the steps they are taking to reduce fraud. 1. Devalue Data 100% EMV Chip-Enabled Point-of-Sale (POS) Tokenization 2. Protect Sensitive Data Contactless…
May 2018 will welcome the arrival of a new version of the PCI DSS. The minor update will contain NO NEW REQUIREMENTS and will be given the version number 3.2.1. The requirements that came into effect in February 2018 will have the following text removed: Note: This requirement is a best practice until January 31,…
PCI DSS V3.2 Requirement 8.2.3 requires 7 character long passwords 8.2.3 Passwords/passphrases must meet the following: Require a minimum length of at least seven characters. Contain both numeric and alphabetic characters. Alternatively, the passwords/ passphrases must have complexity and strength at least equivalent to the parameters specified above. I think its reasonable that…
I think that everyone would agree that the a service provider does not necessarily have to be independently “assessed” as PCI DSS compliant. They could also be assessed as part of the assessed entity’s assessment. But do they need to be “assessed” or “compliant” at all? I think its a risk based decision that depends on…
Just a random question from /r/pcicompliance. PCI Compliance – help with anti-virus, Firewall and Audit Logs Curious if anyone has affordable solutions for anti-virus software, firewall and audit logs. Trying to help two retail stores become compliant. They use a POS software (that is itself PCI Compliance). They have macbooks at each location to swipe…
Technical solutions exist to automate the process of detecting unauthorized wireless access points on a network. These solutions generally work by monitoring radio frequencies to detect new wireless networks and/or monitoring the wired network for wireless access points. Sometimes these features are built into the same equipment that provides the authorized wireless networks. A manual…
Whether you outsource or perform your own penetration tests, you should have a documented penetration testing methodology. This methodology should: Specify a retention period penetration testing results and remediation activities results. Specify coverage for the entire CDE perimeter and critical systems. (referencing your PCI inscope asset list/inventory is probably a good idea.) Specify the frequency…
