 |
|||
 What's New
|
 Highlights |
||
|
PCI DSS 4.0 Roadmap Update The PCI SSC has updated the timeline for the publication of the PCI DSS v4.0 standard, as it had previously indicated. This update will involve an additional RFC for QSA companies and sets the publication of the standard for March 2022. It also indicates that training for ISAs and QSAs will begin in June 2022. The PCI SCC generates digital badges for PCI SSC certifications Within the PCI SSC certification programs, a new initiative has been launched to generate digital badges that allow online recognition of completed courses and certifications, as there are already a wide variety of certifying companies. More information at the following link: RFC period opens for version 3.1 of the P2PE standard Last May, the PCI SSC launched the RFC for version 3.1 of the P2PE standard, which includes minor changes (mainly in Domain 5) and corrects some typos. Version 1.1 of the PCI Secure Software Standard published Within the PCI Software Security Framework (SSF) program, the PCI SSS, which allows the certification of payment applications, has been updated, including new requirements in a module for terminal software, that is, new requirements for software intended to be deployed on PTS-approved POI devices. |
Carlos Seisdedos and Vicente Aguilera have participated in several events as speakers or interviewees in different media, such as the INTELQUORUM 2021 days or the Debat a Orgull newspaper program. |
||
|
Mario Valiente, from the audit department, explains to us in this attack, aimed at performing a denial of service on the wireless network of an Organization. To do this, he first explains basic network concepts, such as the OSI model, and, step by step, explains how to exploit the attack. |
|||
 Incident Analysis
|
|||
|
American law firm Bailey & Gaylen reports having suffered a data breach.
This law firm based in Texas published last May that, during the month of March, the IT team had identified unusual activity on its networks. After a forensic analysis, it was identified that a malicious actor had accessed the network and had accessed customer information, including payment data. The number of affected people has not been made public. |
|||
|
600,000 card data leaked on an illegal card website
Swarmshop, an 'underground' store dedicated to the sale of stolen cards and data has suffered a data breach, among which are around 600,000 card data. We can say that 'there is no honor among thieves'. |
|||
|
Leak of more than 300,000 payment card data from a gift card store made public
Through deep web forums, the sale of 330,000 payment card data has been discovered. A deeper investigation indicated that they belonged to the cardpool.com website, a website that was dedicated to the sale of gift cards and had closed a few months earlier, allegedly due to the pandemic. |
 Trends
|
|||||
|
VISA launches USD Coin for transaction settlement In the line of VISA, they continue to innovate and incorporate new technologies into their business. This time they have launched a stablecoin, backed by the US dollar, which they will use to settle the aggregate of daily VISA transactions. This will allow the incorporation into the process of the new financial solutions and neobanks that operate with digital currencies. The ransomware fever and cyber insurance For a few years, insurance companies have started to launch insurance for companies, covering the costs of certain cyber threats. However, the increase in ransomware is making some strategies rethink, such as, for example, the inclusion of controls in companies to be able to opt for these insurances. The PCI SSC and mobile standards The PCI SSC has been developing standards for a long time to protect card data in environments where mobile phones are used. Currently, it is working on a new standard (using SPoC and CPoC as a base) to continue evolving security in these environments. At the end of 2021, a first RFC will be released and the goal is to publish the standard in the first half of 2022. |
|||||
| Internet Security Auditors C. Santander, 101. Edificio A, 2º. 08030 Barcelona (Spain) | Tel.: +34 93 305 13 18 C. Arequipa, 1. 28043 Madrid (Spain) | Tel.: +34 91 763 40 47 Carrera 13 # 90-17. 110221 Bogotá D.C. (Colombia) | Tel.: +57 (1) 638 68 88 |
|||||
|
This message has been sent by virtue of your authorization for the communication of commercial information from Internet Security Auditors. You can consult our Data Privacy Policy here. You have the possibility to exercise the rights of access, rectification, deletion, limitation, opposition and portability provided in the "Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and the free movement of such data and repealing Directive 95/46/EC" by letter addressed to Internet Security Auditors, Calle Santander, 101. Edificio A-2 08030. Barcelona (Spain), or via email at the following email address: legal@isecauditors.com. If you only wish to request your cancellation from these shipments, click the following link and send that email from the email address where you received our communication: marketing@isecauditors.com |