Connect with us

Tech

PCI DSS 3.2 – Important 31 January 2018 Deadline & Clarifications

code

Overview

In April 2016, Version 3.2 of the Payment Card Industry Data Security Standard (PCI DSS) was released. This new version of the standard contains a number of new requirements which come into full force as of 1 February 2018. This document provides an overview of what is new in Version 3.2, separated by:

  • Clarification of requirements that came into force for all Version 3.2 reports.
  • New requirements that come into force for all parties (merchants and service providers) as of 1 February 2018.
  • New requirements that come into force for service providers only as of 1 February 2018.
  • Sunset date for SSL and Early TLS.

This document summarises what Confide has seen from assessments undertaken since Version 3.2 was released and the information that has been provided by the PCI Security Standards Council.

Clarification (Applicable for all 3.2 reports)

1.1.6.a: Identify the firewall and router configuration standards document(s) reviewed to verify the document(s) contain a list of all services protocols, and ports necessary, including a business justification and approval for each.

These approvals should be granted by someone other than a person who is responsible for managing the configuration. For example, this might include a Security Officer or other role who is responsible for overseeing the PCI DSS process internally, or by someone outside of the standard team of people who are responsible for performing the day to day management of network devices.

6.5: Address common coding vulnerabilities in software-development processes as follows:

  • Train developers at least annually in up-to-date secure coding techniques, including how to avoid common coding vulnerabilities.
  • Develop applications based on secure coding guidelines.

The requirement for developer training is not new. However, in Version 3.2, it was clarified that this training must take place for all developers at least annually. We also recommend that testers attend this training as well to ensure that they are adequately equipped to test for basic security vulnerabilities.

11.3.4.c: Verify that the [segmentation penetration test] was performed by a qualified internal resource or qualified external third party, and if applicable, the organisational independence of the tester exists (not required to be a QSA or ASV).

The requirement for segmentation testing is not new. However, in Version 3.2, a clarification was made that brings the requirement for how segmentation penetration testing into line with the requirements for internal and external penetration testing. The person performing the segmentation testing must be either a qualified internal resource or external third party, and there must be sufficient organisational independence (e.g. the penetration testing should not be done by individuals who are responsible for the day to day management of the systems or who report directly to staff who are responsible for these teams).

12.3.3: Verify that the usage policies define:

  • A list of all critical devices, and
  • A list of personnel authorised to use the devices

The wording of this requirement has been adjusted to ensure that it is clear that the usage policies must include both a list of the critical devices in the environment and a list of the personnel authorised to use the devices. This needs to be documented and cannot be considered “self-documenting” as part of a system such as Active Directory or LDAP.

Additional Requirements for All Parties (as of 1 February 2018)

There are several new requirements that come into force for both merchants and service providers.

6.4.6: Upon completion of a significant change, all relevant PCI DSS requirements must be implemented on all new or changed systems and networks, and documentation updated as applicable.

To ensure that this requirement is met, Confide recommends that a clear definition of what constitutes a “significant change” be defined within the processes so that it is possible for staff to identify when this level of review is required. While the PCI Council does not provide a definitive definition of what constitutes a significant change, guidance from Requirement 11.2 suggests this includes (but is not limited to):

  • New system component installations
  • Changes in network topology
  • Firewall rule modifications
  • Product upgrades
  • Operating system upgrades
  • Sub-networks being added to the environment
  • New web servers

Once significant changes have been defined, we recommend developing a set of templates for reviewing the relevant PCI DSS requirements to ensure that both (1) the relevant requirements have been put in place prior to the system going live, and (2) sufficient testing has been done to meet the requirements for PCI DSS (e.g. penetration testing, vulnerability scanning, etc.) Incorporating this into the change control process is one option.

8.3.1: Incorporate multi-factor authentication for all non-console access into the CDE for personnel with administrative access.

The PCI Security Standards Council recently published a guidance document on what constitutes multi-factor authentication (see: https://www.pcisecuritystandards.org/pdfs/Multi-Factor-Authentication-Guidance-v1.pdf.

In this document they provide a number of examples of what does and does not constitute multi-factor authentication and where multi-factor can be placed in the environment. We also recommend reviewing the PCI Security Standards Council’s guidance on Segmentation and Scoping (see:

https://www.pcisecuritystandards.org/documents/Guidance-PCI-DSS-Scoping-and-Segmentation_v1.pdf as the way that multi-factor is implemented may be influenced by how you have decided to segment the environment.

Additional Service Provider Requirements (as of 1 February 2018)

These new requirements are currently only applicable to service providers. As defined by the PCI DSS, a service provider is any business that is directly involved in the processing, storage, or transmission of cardholder data on behalf of another organisation, or that otherwise impacts the security of cardholder data.

3.5.1: Maintain a documented description of the cryptographic architecture that includes:

  • Details of all algorithms, protocols, and keys used for the protection of cardholder data, including key strength and expiry date
  • Description of the key usage for each key
  • Inventory of any HSMs and other SCDs used for key management

While policies and procedures for key management and the management of encryption devices has long been required, this requirement set out a new level of detail that must be documented around how cardholder data is protected. In part, this also helps the organisation to keep up with evolving threats to the architecture, and to be able to detect lost or missing keys or associated devices.

10.8: Implement a process for the timely detection and reporting of failures of critical security control systems, including but not limited to failure of:

  • Firewalls
  • IDS/IPS
  • FIM
  • Anti-virus
  • Physical access controls
  • Logical access controls
  • Audit logging mechanisms
  • Segmentation controls (if used)

This requirement is aimed at addressing the increased threat of intrusions going undetected for an extended amount of time. In order to ensure that there is a timely process for detecting failures in place, this requires a proactive process to be in place. There is not yet any clear guidance on what constitutes a timely manner. However, automated tools are likely to make this task significantly easier.

10.8.1: Respond to failures of any critical security controls in a timely manner. Processes for responding to failures in security controls must include:

  • Restoring security functions
  • Identifying and documenting the duration (date and time start to end) of the security failure
  • Identifying and documenting cause(s) of failure, including root cause, and documenting remediation required to address root cause
  • Identifying and addressing any security issues that arose during the failure
  • Performing a risk assessment to determine whether further actions are required as a result of the security failure
  • Implementing controls to prevent cause of failure from reoccurring
  • Resuming monitoring of security controls.

While this requirement relates directly to the incidents identified in Requirement 10.8, this requirement relates to the incident management procedures and extends the procedures in the event that a critical security control fails. Due to the newness of this requirement and the extensive reporting requirements that go along with it, we recommend that this process is tested as part of the process development to ensure that the processes can be embedded within the incident processes for the organisation.

11.3.4.1: If segmentation is used, confirm PCI DSS scope by performing penetration testing on segmentation controls at least every six months and after any changes to segmentation controls/methods.

While this is a new requirement, it extends the exiting requirement for organisations that use segmentation to test the effectiveness of that segmentation. This new requirement increases the frequency with which service providers must perform this testing. While there is no requirement for the testing to be done by an external, third party, any internal party must be both (1) able to demonstrate that they are appropriately qualified to perform the testing, and (2) that they are organisationally independent.

12.4.1: Executive management shall establish responsibility for the protection of cardholder data and a PCI DSS compliance program to include:

  • Overall accountability for maintaining PCI DSS compliance
  • Defining a charter for a PCI DSS compliance program and communication to executive management.

The remaining new requirements are focused on the overarching governance processes to help ensure that PCI DSS is not treated as a point-in-time event, but instead is integrated into the BAU processes. As part of that, there needs to be a commitment at the senior level to ensure that PCI DSS is visible at the executive level.

12.11: Perform reviews at least quarterly to confirm personnel are following security policies and operational procedures. Reviews must cover the following processes:

  • Daily log reviews
  • Firewall rule-set reviews
  • Applying configuration standards to new systems
  • Responding to security alerts
  • Change management processes

This requirement and Requirement 12.11.1 help to ensure that processes are regularly reviewed to ensure that they are being followed. While this requirement is not meant to repeat the testing from the PCI DSS requirements, understanding the underlying intention of each of these requirements should guide how the review process is carried out. This also helps to ensure that failures in processes can be identified early, so as to minimise the risk to PCI DSS compliance.

12.11.1: Maintain documentation of quarterly review processes to include:

  • Documenting results of the reviews
  • Review and sign off of results by personnel assigned responsibility for the PCI DSS compliance program.

This requirement ties together the review documentation from Requirement 12.11 and the governance processes from Requirement 12.4, and helps to ensure that there is a clear visibility into how processes that affect PCI DSS compliance are visible to senior management.

TLS Requirements (1 July 2018)

After 30 June 2016, all entities must have stopped use of SSL/early TLS as a security control, and only use secure versions of the protocol.

Prior to 30 June 2018, existing implementations that use SSL and/or early TLS must have a formal Risk Mitigation and Migration Plan in place.

Appendix 2 covers the requirements for SSL / Early TLS.

Given the impending deadline for disabling SSL and Early TLS, we recommend that reviewing the current need for these protocols is done on a more frequent basis to determine if it is possible to disable them prior to the deadline.

Confide is New Zealand’s Premier Security Assessment Company for the Payment Card Industry.

BusinessArticles is the popular online Hub for quality business articles. We publish unique articles and share them with our social followers.

Continue Reading

Tech

Top Tools to Help Logistic Professionals

truck

Transporting goods and produce through a shipping fleet can be a too complicated job, particularly if you find yourself managing a large convoy of vehicles. Not only do operational managers in logistical businesses need to organize their drivers, but they also need to manage stock and ensure that deliveries meet their deadlines.

That’s a lot to do, but thankfully in the modern-day, there’s a lot of new technology that can help make this line of work a lot easier to organize and control. With the technology ranging from computer software to devices installed into a vehicle, here are some of the top tools that are helping logistic professionals.

Fleet Tracking

The ability to track an entire fleet through GPS and other measures has made the administrative side of logistics far simpler for drivers and managers. Instead of filling out information such as hours driven manually, these tracking devices do it all automatically, providing an effortless and accurate way to store this data.

These tracking devices, such as the Azuga GPS can also monitor the route that drivers are taking and empower observers to know if the drivers are taking the most effective route. Plus tracking devices can help them plan to be more efficient in getting their goods from one point to another.

The GPS can also be used to measure the quality of a trucker’s driving, being able to pick up on excessive acceleration, hard braking, or hard turning. Knowing that they’re being monitored can deter drivers from bad practices, making them better and more effective.

Stock Management Software

As well as managing vehicles, logistical companies also have to manage and keep tabs of the different types of stock these vehicles are transporting. One of the best ways these businesses track their stock is to record them in various stages of their transportation process through the use of barcodes and barcode scanners.

Doing this provides up-to-date information on where the stuff is and in what stage it’s in. One of the best tools for scanning barcodes is the Scandit mobile app, due to its ability to be used on both Android and iOS devices and how it’s able to scan hard-to-reach or battered barcodes with ease.

Co-Pilot Directions App

When driving large vehicles, sometimes using traditional GPS systems might not be the best option, as a lot of them won’t be able to account for roads where trucks might not be able to travel through, which can lead to decreased efficiency. To combat this, there is the co-pilot mobile app which offers robust and accurate mapping and direct routing.

This app is particularly good as it goes above and beyond with additional algorithms that can help truckers avoid heavy traffic and other obstacles so that they can get to their destination quickly and efficiently. It also takes into account the truck’s height and width so that it knows which tunnels, roads, and bridges it can drive through, on, or under. Tools such as this allow logistical companies to increase their productivity, allowing them to take on a higher volume of contracts which can increase profit.

Final Thoughts

Technology is available to help your logistics business perform to the very best of your ability. It can transform simple processes and streamline more complicated tasks, giving you more time and capacity to deal with more pressing issues.

Someone could say that to ignore the multitude of benefits the technology can bring to your business is to set yourself up to fail, especially in today’s tech-driven world. Take advantage now of the apps and tracking systems ready for you to implement and see how you can go from strength to strength in your company.

Continue Reading

Tech

The Benefits of 3D Scanning in Prototyping

3D Design

The ability to take an object and reverse-engineer it to create an identical copy of it without the schematics of the design has changed the way industry does business.

The technology that enables people to perform this process is called 3D scanning or 3D modeling and it is used in various industries, including manufacturing, VR, healthcare.

By taking multiple snapshots of a real-world object from various angles, 3D scanners can reproduce a virtual model of that object, which can then be viewed from all angles using software such as CAD. These models can then be sent to a 3D printer, now available for purchase commercially, to produce a replica of the scanned object.

There’s no doubting the influence of 3D printing, particularly on the manufacturing industry. The positives include greater scope for creativity in design, less material wastage, the faster process from design to product, the plastic is lighter yet stronger than metals, and it’s cheaper.

In this article, we delve a bit deeper into three areas of business 3D scanning can benefit companies prototypes and products.

Saves Time

Designing new parts, or replacements can be a long process that requires the knowledge and time of an expert such as an engineer who will need to hand-draw the design or design it from scratch using specialized software. With 3D scanning technology, however, the design process can be simplified immensely.

Reputable 3D scanners, such as the Artec Eva, use advanced technology to ensure that every inch of the object that is being scanned is accounted for on the design. Capturing up to 16 frames a second, the scanner also automatically provides the precise dimensions of the object. The designer can then alter the virtual design to better suit their needs without the need to tamper with the original object. What makes the Artec Eva stand out from the rest is its portable design, which allows for quick, high-resolution 3D scanning for almost unlimited applications.

More Flexibility in Designs

Having a scan of an object during the design phase of a prototype allows the designer greater flexibility in their design from the start as they have the power to edit and make improvements on their system quickly and easily without the need to build multiple physical prototypes. This can save a company both time and money during the design and testing phase of a prototype.

Designs can be Shared Globally

When a product is in the design stage, it is not uncommon to see it being shipped around the world for testing before it enters mass production. With 3D scanning technology, a design can be shared with anyone who has the software to read it, and it can be physically reproduced through 3D printing technology anywhere in the world. This means that a design can be accurately reproduced to its exact specifications without the need for expensive and time-consuming shipping at design shops around the world with just a copy of the 3D file.

When combined with 3D printing, 3D scanning technology has the potential to change the way people design and produce new products as well as make industries more streamlined and cost-efficient.

However, some would say there is still some way to go before 3D printing is ubiquitous in manufacturing and design, particularly with new entrants. The printers are cost-prohibitive for startups struggling with funding. The reliance on plastic doesn’t sit well with everyone, and there’s the ongoing impact it has on jobs. However, there will always be teething problems with new tech, including the displacement of workers.

What do you do with your production staff? Watch this space, new industries will appear with 3D printing, and there will be new jobs.

Continue Reading

Innovation

How To Grab Attention On Video Conference Calls

woman on phone

We are in the age of ‘COVID-19’, and our lives will never be the same again. We’ll be working from home more often and using video conferencing for meetings with colleagues, management and customers. In-person meetings allow for verbal and non-verbal cues. Body language can play a significant role in negotiation, for example.

Changes in body language or small facial expressions can provide observers, i.e. the meeting attendees messages on how to respond to get the right outcome. If you’re someone who uses non-verbal cues to sway discussion in your favour, then video-conferencing is a challenge. So how can we get what we need from these online meetings using what we have at hand, i.e. the small visuals of meeting attendees?

In this article, we provide tips on how you can get your points across, even when the other attendees are more extroverted than you.

Use The Camera

Focus on the camera and what it can do for you. There is a temptation to stare at your screen and the other attendees in the meeting. Get past this action as soon as you can. Allow yourself a few minutes to view all the other participants then turn your attention to the meeting’s contents.

Active listening is required and if it helps you to remember what is being discussed – take notes. To assist this action further say which participant explained the point, for example, Attendee John (Manager): “we will now always work from home two days a week”.

When you’re talking stare into the camera and not at the attendees faces on your screen. While this is very unnatural, and at first, you’ll think you’re rude or ill-mannered by not looking at the attendees like you would if you were in an in-person meeting. However, looking deeply into the camera not only focuses you on what you’re saying, but you also won’t get distracted with attendees non-verbal distractions.

Mastering the skills for video conferencing productivity will take practice. The multi-tasking of taking notes while actively listening and remembering to optimise the time spent looking into the camera will be your juggling act!

What you’re working against is human nature and the obsession we have with ourself. Dale Carnegie says if we’re not thinking about a project, we’re thinking about ourselves. A lot of time is spent and indeed wasted thinking about how we feel, what we want, and what other people think of us, so you can see what you’re up against to master video conference meetings as an active participant or meeting lead.

Use Your Voice

Understanding the basics of human nature can be gained from studying neuroscience or neurolinguistic programming. Introverts are less likely to sit tall or speak up than extroverts; however, they can practice doing both, and without the non-verbal cues getting in the way, video conferencing is a great levelling feature.

When you’re on a video call, always speak louder than your usual speaking voice. Plus use your voice to express yourself through using pitch, high and low, vary it to keep your audience engaged. For extroverts, they are experts in changing tone and adding volume to grab attention and express themselves. Introverts will also master this skill in the knowledge that they are in the room with the meeting attendees and that no one is spending much time thinking about them!

Backgrounds

What is in the background when you’re on a video conference call? Take care to have a bland background, so your frame is not the meeting’s distraction! Ideally use a plain white wall for your background. If that’s not possible, make sure the shelves behind you have only the objects you don’t mind your work colleagues and customers viewing, i.e. do not place intimate or personal items on the shelves that will end up being the topic of discussion.

Visual Appearance

Even though you’re working remotely and most often from your home, avoid wearing your leisure apparel. Your appearance should be what your colleagues would expect to see if they were sitting next to or opposite you in a meeting room. Once again, the objective with your appearance is to avoid being the distraction.

Summary

If you’ve been reluctant to use video conferencing, these tips will boost your confidence to use the technology without distraction.

Continue Reading

Trending