E-commerce smackdown as PCI standards revised
die pay fines
Other vendors welcomed the recognition for the increased use of virtualisation and cloud-based technologies in revised standards. Sumedh Thakar, director of engineering at vulnerability assessment firm Qualys, welcomed this attempt to align payment industry security standards with 21st century IT infrastructure realities.
Thakar explained: "The standards were not keeping pace with advances in technology, especially the use of virtualisation in a card holder data environment. The existing standards talk about the notion of having 'One primary function per sever'. In a virtualised environment, this becomes a problem because the environment can be pretty dynamic and you could have virtual servers with different primary functions, like web servers and database servers, on the same physical server."
Merchants sometimes hold back on introducing virtualisation in their PCI environments for fear of being deemed non-compliant, according to Qualys. The revised regulations remove that uncertainty but are likely to have a knock-on effect on other requirements - such as firewalls, pen testing and performing vulnerability scans - that need to be factored into testing regimes.
Rafe Pilling, PCI Consultant at SecureWorks, agreed that the approach to virtualisation in the e-commerce regulations remains somewhat unclear.
Pilling said: "Although there are no groundbreaking changes to PCI 2.0, there have been some clarifications made to the standards and some developments on how companies using virtualisation must comply with the PCI Data Security Standards (DSS).
"However, organisations looking for clear guidance on storing PCI and non-PCI systems in a virtualised environment might be disappointed, as the boundaries are not clearly defined."
The previous version (1.2.1) of the PCI DSS guidelines was released in July 2009. The council has now settled on a three-year release cycle, which means that PCI DSS 3.0 can be expected in October 2013. Merchants have the choice of applying either version 1.2.1 or 2.0 throughout 2011 before the older standard is pensioned off at the end of next year and version 2.0 becomes the only game in town.
Log management and regulatory compliance specialist LogRhythm notes that many organisations have yet to meet the PCI SSC’s previous recommendations. A survey by Redshift Research back in March revealed that just 11 per cent of UK organisations were PCI DSS compliant, an observation LogRhythm holds true even after September’s PCI compliance deadline for level one merchants
"Some of the anticipated changes by the PCI SSC can’t come too soon," said Ross Brewer, VP and MD of international markets at LogRhythm.
"Reports show high rates of non-compliance, a fact often viewed as a reflection of the lack of clarity which has negatively affected the standard in the past. Guidance on virtualisation and the alignment between PCI DSS and the Payment Application Data Security Standard will also be welcome, while the evolving requirement for centralised logging of payment transactions is a definite plus."
Brewer added that complaints about the clarity of PCI DSS are nothing new and sit alongside a much larger compliance headache many firms face. ®