thePCI Portal

Functionality testing to verify that the change does not adversely impact the security of the system

What are Assessor’s thoughts on requirement 6.4.5.3? 6.4.5.3 Functionality testing to verify that the change does not adversely impact the security of the system. 6.4.5.3.a For each sampled change, verify that functionality testing is performed to verify that the change does not adversely impact the security of the system. Thorough testing should be performed to…

eye on PCI v4

full speed ahead on PCI v4

August 25 2020: The council is still analyzing feedback from previous RFC (plan is to comment on all feedback).  Council is preparing the next RFC while updating supporting documents (glossary, prioritized approach, SAQs, etc) and training.   An extended transition period is planned. 3.2.1 to be retired 2 years AFTER the release of v4.0.  Future…

What is e-Commerce?

If I take payments from customers only via an application on their mobile handheld device, is that ecommerce?     (Should my assessor check e-commerce off in my ROC and AOC?)  The application is one I distribute and not a browser. What is e-Commerce? The term ecommerce is not in the PCI SSC Glossary.  There…

Vulnerability scans are not for req 6.1

Requirement 6.1 is my favourite PCI DSS requirement!  No fancy tools required.  No specialized knowledge.  It can be largely executed by a person on the helpdesk.    And the impact to the overall security posture organization can be huge.  More than that expensive network appliance.  More than that fancy SIEM.  More than that overpriced vulnerability…

PCI compliance and big P Politics

What is behind MPI’s decision to stop the acceptance of preauthorized credit card payments? Politics? Lobbyists? Pressure from the broker association? Lucrative broker commission payments? Maybe according to the Winnipeg Free Press. Saving money?  Apparently, but the savings are coming from the reduced scope of PCI DSS compliance by eliminating cardholder data storage (according to CBC reporting). …

The upcoming revision to the data security standard, version 4

The Council has a blog post about the upcoming revision to the data security standard, version 4. While talking about version 4, the council has specifically identified the following industry feedback related to the DSS: Authentication, specifically consideration for the NIST MFA/password guidance Broader applicability for encrypting cardholder data on trusted networks Monitoring requirements to…