Feeds

E-commerce smackdown as PCI standards revised

Comply or die pay fines

The Essential Guide to IT Transformation

Virtual reality

Other vendors welcomed the recognition for the increased use of virtualisation and cloud-based technologies in revised standards. Sumedh Thakar, director of engineering at vulnerability assessment firm Qualys, welcomed this attempt to align payment industry security standards with 21st century IT infrastructure realities.

Thakar explained: "The standards were not keeping pace with advances in technology, especially the use of virtualisation in a card holder data environment. The existing standards talk about the notion of having 'One primary function per sever'. In a virtualised environment, this becomes a problem because the environment can be pretty dynamic and you could have virtual servers with different primary functions, like web servers and database servers, on the same physical server."

Merchants sometimes hold back on introducing virtualisation in their PCI environments for fear of being deemed non-compliant, according to Qualys. The revised regulations remove that uncertainty but are likely to have a knock-on effect on other requirements - such as firewalls, pen testing and performing vulnerability scans - that need to be factored into testing regimes.

Rafe Pilling, PCI Consultant at SecureWorks, agreed that the approach to virtualisation in the e-commerce regulations remains somewhat unclear.

Pilling said: "Although there are no groundbreaking changes to PCI 2.0, there have been some clarifications made to the standards and some developments on how companies using virtualisation must comply with the PCI Data Security Standards (DSS).

"However, organisations looking for clear guidance on storing PCI and non-PCI systems in a virtualised environment might be disappointed, as the boundaries are not clearly defined."

Compliance conundrum

The previous version (1.2.1) of the PCI DSS guidelines was released in July 2009. The council has now settled on a three-year release cycle, which means that PCI DSS 3.0 can be expected in October 2013. Merchants have the choice of applying either version 1.2.1 or 2.0 throughout 2011 before the older standard is pensioned off at the end of next year and version 2.0 becomes the only game in town.

Log management and regulatory compliance specialist LogRhythm notes that many organisations have yet to meet the PCI SSC’s previous recommendations. A survey by Redshift Research back in March revealed that just 11 per cent of UK organisations were PCI DSS compliant, an observation LogRhythm holds true even after September’s PCI compliance deadline for level one merchants

"Some of the anticipated changes by the PCI SSC can’t come too soon," said Ross Brewer, VP and MD of international markets at LogRhythm.

"Reports show high rates of non-compliance, a fact often viewed as a reflection of the lack of clarity which has negatively affected the standard in the past. Guidance on virtualisation and the alignment between PCI DSS and the Payment Application Data Security Standard will also be welcome, while the evolving requirement for centralised logging of payment transactions is a definite plus."

Brewer added that complaints about the clarity of PCI DSS are nothing new and sit alongside a much larger compliance headache many firms face. ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Backing up Big Data
Solving backup challenges and “protect everything from everywhere,” as we move into the era of big data management and the adoption of BYOD.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.