Posts about:
With more than 510 million records containing sensitive information breached since January 2005, statistics indicate that cardholder data breaches are on the rise, and criminals are increasingly targeting small and medium businesses to obtain cardholder information. To help protect consumers’ payment data the payment card industry created PCI compliance.
Recently, Control Gap posted an article performing a detailed analysis of the recent changes in the DSS due to 3.2. We do this because the high-level change summaries...
Despite the widespread adoption of logging as part of operational security practices, organizations have continued to be challenged in harnessing the value of effective log monitoring. Statistics indicate the average elapsed time between the first intrusion to detection of the compromise is a whopping 167 days. Improvements in technology have allowed malicious individuals to vastly improve their craft.
With the release of PA-DSS 3.2, on June 8th, the PCI Council has provided sunset dates for PA-DSS 3.1 applications and application listing. Key item to note is that ROVs and changes for payment applications validated according to PA-DSS v3.1 may be submitted through 31 August 2016. As of 1 September 2016, all new ROVs must be validated according to PA-DSS v3.2.
To accept credit cards in Canada, businesses need to be PCI compliant. Becoming PCI compliant can be difficult in the first place and keeping up with the changes even more so. In April 2016 the Payment Card Industry (PCI) Security Standards Council (formed to regulate security for the payment card industry) released an updated list of compliance requirements known as the PCI Data Security Standard (DSS) v3.2.
The PCI Security Standards Councils confirmed last week that the updated version of PCI DSS (v3.2) will be released at the end of April 2016. The current version (v3.1)...
Last week the PCI Standards Council commented on the upcoming DSS 3.2 update and what it means for the rest of 2016.
Ever since the sunset of SSL and early TLS was...
If you’ve been struggling with keeping up with various SSL vulnerabilities and planning an orderly cutover to TLS then the recent announcement by the PCI Council has extending the sunset date for the transition from SSL to TLS 1.1 and 1.2 should come as welcome relief.
Previously we looked at Format Preserving Encryption (FPE) its characteristics and suitability for application in solutions intended for PCI DSS. To recap, FPE is an...