Feeds

E-commerce smackdown as PCI standards revised

Comply or die pay fines

Choosing a cloud hosting partner with confidence

Virtual reality

Other vendors welcomed the recognition for the increased use of virtualisation and cloud-based technologies in revised standards. Sumedh Thakar, director of engineering at vulnerability assessment firm Qualys, welcomed this attempt to align payment industry security standards with 21st century IT infrastructure realities.

Thakar explained: "The standards were not keeping pace with advances in technology, especially the use of virtualisation in a card holder data environment. The existing standards talk about the notion of having 'One primary function per sever'. In a virtualised environment, this becomes a problem because the environment can be pretty dynamic and you could have virtual servers with different primary functions, like web servers and database servers, on the same physical server."

Merchants sometimes hold back on introducing virtualisation in their PCI environments for fear of being deemed non-compliant, according to Qualys. The revised regulations remove that uncertainty but are likely to have a knock-on effect on other requirements - such as firewalls, pen testing and performing vulnerability scans - that need to be factored into testing regimes.

Rafe Pilling, PCI Consultant at SecureWorks, agreed that the approach to virtualisation in the e-commerce regulations remains somewhat unclear.

Pilling said: "Although there are no groundbreaking changes to PCI 2.0, there have been some clarifications made to the standards and some developments on how companies using virtualisation must comply with the PCI Data Security Standards (DSS).

"However, organisations looking for clear guidance on storing PCI and non-PCI systems in a virtualised environment might be disappointed, as the boundaries are not clearly defined."

Compliance conundrum

The previous version (1.2.1) of the PCI DSS guidelines was released in July 2009. The council has now settled on a three-year release cycle, which means that PCI DSS 3.0 can be expected in October 2013. Merchants have the choice of applying either version 1.2.1 or 2.0 throughout 2011 before the older standard is pensioned off at the end of next year and version 2.0 becomes the only game in town.

Log management and regulatory compliance specialist LogRhythm notes that many organisations have yet to meet the PCI SSC’s previous recommendations. A survey by Redshift Research back in March revealed that just 11 per cent of UK organisations were PCI DSS compliant, an observation LogRhythm holds true even after September’s PCI compliance deadline for level one merchants

"Some of the anticipated changes by the PCI SSC can’t come too soon," said Ross Brewer, VP and MD of international markets at LogRhythm.

"Reports show high rates of non-compliance, a fact often viewed as a reflection of the lack of clarity which has negatively affected the standard in the past. Guidance on virtualisation and the alignment between PCI DSS and the Payment Application Data Security Standard will also be welcome, while the evolving requirement for centralised logging of payment transactions is a definite plus."

Brewer added that complaints about the clarity of PCI DSS are nothing new and sit alongside a much larger compliance headache many firms face. ®

Remote control for virtualized desktops

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
DRUPAL-OPCALYPSE! Devs say best assume your CMS is owned
SQLi hole was hit hard, fast, and before most admins knew it needed patching
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
BlackEnergy crimeware coursing through US control systems
US CERT says three flavours of control kit are under attack
prev story

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
New hybrid storage solutions
Tackling data challenges through emerging hybrid storage solutions that enable optimum database performance whilst managing costs and increasingly large data stores.
Website security in corporate America
Find out how you rank among other IT managers testing your website's vulnerabilities.