Why Harmonizing Cloud Security Standards will Accelerate Cloud Adoption

February 20, 2015 Added by:Evelyn De Souza

As the public cloud becomes mission-critical, business and government applications, many standards bodies and government entities worldwide are issuing stronger security guidance and new standards.

Comments  (8)


Council Surveys QSAS on SSL

February 19, 2015 Added by:PCI Guru

The dilemma we have is that while SSL is dead, it is baked into so many products and appliances.

Comments  (7)


New PCI Compliance Study

February 16, 2015 Added by:PCI Guru

Dr. Branden Williams and the Merchants Acquirer Committee (MAC) have issued a new report on PCI compliance and the impact of breaches on merchants and MAC members.

Comments  (3)


PCI Security Standards Council Statement on White House Cybersecurity Summit

February 13, 2015 Added by:InfosecIsland News

The PCI Security Standards Council applauds the progress made by The White House Cybersecurity Summit at Stanford University.

Comments  (7)


Anthem Breach: How Hackers Stole Credentials and Why Two-Factor Authentication May Help Prevent Future Phishing Scams

February 09, 2015 Added by:Thu Pham

If the Anthem attack was carried out as the result of using a single password, their access security wasn’t up to industry standards. Two-factor authentication may have thwarted attacks by requiring the use of a personal device to verify the identity of a system administrator or other technical employee with access to their database of millions of sensitive records.

Comments  (3)


ACTUAL Domestic and International ICS Cyber Incidents From Common Causes

February 09, 2015 Added by:Joe Weiss

There is still minimal identification of, much less, “connecting the dots” on ICS cyber incidents.

Comments  (3)


Merchant, Service Provider or Both?

February 02, 2015 Added by:PCI Guru

Apparently there are a lot of newcomers to the PCI compliance business and are asking bizarre questions regarding PCI. One of the most common is if their organization is a merchant or a service provider or both?

Comments  (1)


Thought Experiment: Mandatory Online Banking Security Standards

January 28, 2015 Added by:Tripwire Inc

Banks are required by law to follow government regulations; these subject the banks to specific requirements, restrictions and guidelines. The end goal being, among other things, transparency.

Comments  (3)


End of Life

January 27, 2015 Added by:PCI Guru

This topic has started to come up again as we go through PA-DSS research on applications and find that the listings contain operating systems that are at or past end of life (EOL).

Comments  (4)


Three Compliance Trends to Watch in 2015

January 26, 2015 Added by:Mav Turner

Continuous compliance involves constantly reviewing processes and quickly making any necessary updates as a result of deviations from their intended performance. However, despite the fact that continuous compliance is effective at eliminating the gaps between compliance and security, it also greatly increases the complexity of managing compliance.

Comments  (2)


SAQ A and SAQ A-EP Clarification

January 08, 2015 Added by:PCI Guru

With the advent of SAQ A and A-EP, there seems to be confusion as to what meets what for each SAQ. I thought I covered this rather well in my post titled ‘Of Redirects And Reposts’. But apparently that was not clear enough.

Comments  (5)


Does Your Valuable Data Belong to Hackers?

January 05, 2015 Added by:Thu Pham

Every organization, regardless of size, is comprised of a variety of sensitive data - from HR and payroll handling medical, financial and personally identifiable employee data to your precious intellectual property. And each of these data types can be sold for a price on the black market, making them valuable to attackers financially as well as for blackmail purposes.

Comments  (6)


Moving from Alert-Driven to Intelligence-Driven Security

January 05, 2015 Added by:Paul Lipman

The emergence of smart, integrated, cloud-based security services will enable a transformation from an alert-centric to an intelligence-centric approach to security. This will vastly enhance the Chief Information Security Officer's (CISO’s) visibility and ultimately deliver substantial improvements in the robustness of the overall security posture.

Comments  (1)


The Three Hop Rule

January 05, 2015 Added by:PCI Guru

At the 2014 Community Meeting, the PCI SSC responded to a question about network segmentation with what has come to be termed the “Three Hop Rule”.

Comments  (2)


PCI Compliance Is Getting More Rigorous

December 29, 2014 Added by:PCI Guru

When Visa and MasterCard trotted out their security standards back in 2002 and 2003, the large eCommerce merchants that got to see them complained that they were too much. Fast forward more than a decade and we still hear complaints that the PCI standards are too much.

Comments  (0)



December 11, 2014 Added by:Wendy Nather

I've always had a problem with compliance, for a very simple reason: compliance is generally a binary state, whereas the real world is not. Nobody wants to hear that you're a "little bit compliant," and yet that's what most of us are.

Comments  (0)

Page « < 1 - 2 - 3 - 4 - 5 > »