PCI DSS

37d5f81e2277051bc17116221040d51c

Nearly 80% of Retailers' Data at High Risk

November 24, 2011 Added by:Robert Siciliano

Now, after five years of pushing standards out to merchants and retailers, a Verizon study has found that 79% of retailers are noncompliant. No matter how you slice it, retailers are a target and must employ multiple layers of fraud protection to thwart cyber criminals...

Comments  (0)

Ad5130e786d13531cc0f2cde32dacd0f

Decrypting QSA Qualifications in a Diluted Market Place

November 21, 2011 Added by:Andrew Weidenhamer

One of the biggest challenges is how to determine which 3rd party QSA company to use. With 120+ QSA companies certified to perform On-Site Assessments in the USA, there is not an easy answer, unless of course price is the only consideration. Unfortunately, sometimes this is the case...

Comments  (0)

7fef78c47060974e0b8392e305f0daf0

Webcasts: PCI DSS Demystified and Mobile Device Security

November 14, 2011 Added by:Infosec Island Admin

This SC magazine free webcast was inspired by the spate of smaller companies being caught out recently by PCI loopholes then incurring massive reputational and financial damage as a result, plus another on what to do about security as iPads, Smartphones proliferate in the workplace...

Comments  (0)

Fc152e73692bc3c934d248f639d9e963

This Year’s PCI SSC SIG Proposals

November 02, 2011 Added by:PCI Guru

This SIG is to be created to guide merchants and service providers in what should be the result of a proper risk assessment, not create another risk assessment methodology. While such an Information Supplement is an admirable ideal, you understand why this SIG is a losing proposition...

Comments  (0)

37d5f81e2277051bc17116221040d51c

Javelin Study Shows Increased Credit Card Fraud Risk

November 01, 2011 Added by:Robert Siciliano

Not a week goes by when we don’t hear of another major breach affecting thousands or even millions of customer accounts. Criminal hackers are getting smarter and savvier all the time, and they often have better technology than the banks and retailers tasked with protecting your data...

Comments  (0)

1156f97fa8f23821bd838fe7d9283d90

Welcome to the PCI Prioritization Approach

October 27, 2011 Added by:David Sopata

Organizations often start implementing security controls on all of their systems throughout the company without really knowing what systems should be in scope or which systems should not be in scope for PCI. Hence, the PCI DSS Prioritization Document and Tool was developed...

Comments  (0)

Fc152e73692bc3c934d248f639d9e963

PCI and the Insider Threat

October 24, 2011 Added by:PCI Guru

The biggest problem with the insider threat is that it does not matter how much technology you have to protect your assets as it only takes one person in the right place to neutralize every last bit of your security solutions. Just ask anyone any of the recently breached organizations...

Comments  (0)

Fc152e73692bc3c934d248f639d9e963

PCI Defense In Depth

October 17, 2011 Added by:PCI Guru

It has been more than five years since the “sa” default password debacle and yet you still encounter applications that use service accounts to access their database and those service accounts have no password. The rationale? “We did not want to code the password into the application..."

Comments  (0)

07c90faf3632560a12dd6e98069813f2

Avoid Becoming a Security Statistic

October 12, 2011 Added by:Konrad Fellmann

Some organizations hoard data, but have no idea why. A business owner needs to figure out why the data needs to be kept, who will use the data, and how long it needs to be kept for business, legal or contractual reasons. Once defined, IT can implement proper controls to protect the data...

Comments  (0)

Fc152e73692bc3c934d248f639d9e963

The EMV-Contactless World According to Visa

October 11, 2011 Added by:PCI Guru

If Visa were to work with the industry to produce a common API for EMV and contactless cards with PIN online, that would drive adoption of more secure cards in the US because there would be a business reason for adoption. Without such a driver, they are still a solution looking for a problem...

Comments  (8)

Fc152e73692bc3c934d248f639d9e963

Notes on the 2011 Verizon Breach Report

October 07, 2011 Added by:PCI Guru

Breaches occur because organizations get sloppy and, even with defense in depth in their security, there are too many controls where execution consistency has dropped leaving gaping holes in the various levels of security. However, once addressed, attackers will find other ways in...

Comments  (1)

Ad5130e786d13531cc0f2cde32dacd0f

The Holy Grail and the PA-DSS Implementation Guide

October 04, 2011 Added by:Andrew Weidenhamer

As a QSA it is very frustrating to walk in, ask the merchant for the PA-DSS Implementation Guide, and receive a glazed over eye look. It's even more frustrating when you then ask the Vendor/Reseller for the Implementation Guide and they look at you as if you have three heads....

Comments  (0)

Fc152e73692bc3c934d248f639d9e963

Requirements that Cannot be Marked ‘Not Applicable’

October 01, 2011 Added by:PCI Guru

QSAs are questioning the relevance of this clarification in outsourced and environments totally operated through bank-owned terminals and networks. TPCI SSC is clarifying these requirements is to ensure that QSAs are confirming that outsourced environments truly are out of scope...

Comments  (0)

Fc152e73692bc3c934d248f639d9e963

It is Time to Address PCI Compliance Reporting

September 22, 2011 Added by:PCI Guru

The QA process: it all comes down to having used the correct language in responding to the ROC, rather than whether or not you actually assessed the right things. To add insult to injury, the PCI SSC advises QSACs to develop a template for the ROC with all the correct language written and proofed...

Comments  (3)

Fc152e73692bc3c934d248f639d9e963

Why Visa Is Upset

September 13, 2011 Added by:PCI Guru

Visa’s beef with my post is the implied connotation by using the term ‘Chip and PIN’ that a PIN would be required. All I was trying to do was to provide an easily Google-able term for people interested in EMV. Such a complaint from Visa is laughable if it were not so sad...

Comments  (2)

Fc152e73692bc3c934d248f639d9e963

Card Brand Merchant Level Tables

September 08, 2011 Added by:PCI Guru

Sometimes you can negotiate with your processor or acquiring bank to get your multiple legal entities treated as a single entity and do one compliance filing. The key is that you need to negotiate this change before you start your PCI compliance efforts, not after the fact...

Comments  (1)

Page « < 8 - 9 - 10 - 11 - 12 > »