Payment Methods Newsletter March 2019

The PCI SSC will publish a new framework for software development

The PCI SSC is developing a specific security framework for software, the PCI Software Security Framework. This framework is a set of standards and programs focused on software security throughout all phases of the software development life cycle (security by design). During 2019, the following are expected to be published under this new framework:

• Standards
  • Secure Software Standard: Standard to define procedures and requirements that ensure the confidentiality and integrity of transactions and data within the software.
  • Secure SLC (Software Lifecycle) Standard: focused on ensuring security throughout the software development life cycle.
• Validation framework: new SSC validation program, both for vendors and their software products, as well as a new qualification program for assessors.

For its part, PA-DSS will gradually join this new framework. By mid-2020, new product submissions under PA-DSS will no longer be accepted, although already validated products will remain valid until 2022.

The following links provide information from the SSC itself:
https://www.pcisecuritystandards.org/about_us/press_releases/pr_01162019
https://blog.pcisecuritystandards.org/update-on-pci-software-security-framework

Series: PSD2 Directive

We have published 2 new posts on our corporate blog regarding EU Directive 2015/2366, better known as PSD2. These posts delve into the scope of the directive, as well as the description of the new roles defined. They also describe the security measures published by the European Banking Authority (EBA).

Banks, Fintech... How Far Does PSD2 Go?
Security Requirements in PSD2

Legitimate Interest, the Catch-All of the GDPR

This article explains the concept of "legitimate interest" and how many organizations are making use of it. It also explains the lack of sense in developing a list, although it gives some examples of what could be considered based on what is described in the regulation. Finally, it refers to the Article 29 Working Party (WP29), which has published an opinion indicating the considerations that a data controller must take into account to include a processing activity as legitimate interest.

PCI DSS: Reminders and Resources

Last December, the PCI SSC published a series of reminders regarding the PCI DSS standard, including:

• As of January 1, 2019, version 3.2.1 of the PCI DSS standard comes into effect, thus making version 3.2 obsolete.
• The use of SSL or early versions of TLS should not be allowed, except for POS POI (point of sale point of interaction) that do not have known vulnerabilities. If these protocols are used, compensating controls must be established.

It also published some resources that may be useful for compliance with versions 3.2 and 3.2.1 of the standard:

• Guide for the use of SSL/early TLS: Including a description of the impact on ASV scans and an additional guide for its use on POS POI.
• Guide for MFA (Multi-factor Authentication), which includes a series of best practices for the implementation of MFA.
• Card data protection over the phone, which includes the main risks associated with this operation.

You can find the details of the publication at:
https://blog.pcisecuritystandards.org/pci-dss-reminders-and-resources

Data Minimization Principle

This article explains this principle, included in the GDPR and how it clashes with current Big Data trends. This principle also appeared in the OECD privacy guidelines and explains the considerations included in said principle. It also refers to the sanctions that the GDPR may impose for non-compliance with said principle.

GDPR Updates Regarding the LOPD

This article aims to list the main differences introduced by the GDPR in data protection compared to the old LOPD we already had in Spain. Remember that Spain was one of the pioneering and leading countries in data protection, so the GDPR does not introduce as many changes as in other countries, although we will see at least 8 features that have changed quite a bit.

PCI 3DS SDK Standard Review

In December 2018, version 1.1 of the PCI 3-D Secure Software Development Kit (3DS SDK) Security Standard was published, which includes a series of minor changes and guidance for the security assessments of the laboratories responsible for assessments of said standard

Although this update does not include new requirements, it does include the feedback received from the organizations participating in the PCI SSC and from the laboratories themselves responsible for these reviews.

For more information, you can visit the following link:
https://www.pcisecuritystandards.org/about_us/press_releases/pr_12132018

Online Privacy Policies After the GDPR

The Spanish Data Protection Agency (AEPD) published a study it had conducted after reviewing the privacy policies of several organizations providing services online. The study reflects the main conclusions of said analysis, such as the lack of clear and concise language and the lack of granularity to accept purposes.

A summary of said study can be seen at: https://blog.isecauditors.com/2018/11/politicas-de-privacidad-online-tras-el-gdpr.html

New Standards: What to Expect in 2019

The PCI SSC remains in constant evolution thanks to new technologies, already in 2018 a standard was published for COTS (Commercial Off-The-Shelf) components. For 2019, the publication of an annex is expected to adapt to less mature markets in the card industry, which still accept magnetic stripe transactions.

Although this update does not include new requirements, it does include the feedback received from the organizations participating in the PCI SSC and from the laboratories themselves responsible for these reviews.

For more information, you can visit the following link:
https://www.pcisecuritystandards.org/about_us/press_releases/pr_12132018

At the end of November, the Marriott hotel chain made public that it had suffered an attack on its infrastructure (and specifically, the reservation platform) that would have affected around 400 million people (initially estimated at more than 500 million affected customers). The attackers would have had access to customers' personal data, as well as credit card data. This attack began in 2014, but it was not until late 2018 when the flaw was identified and remediated.

For its part, Marriott created a page with information about the incident, as well as answers to frequently asked questions and enabled a call center service to inform customers.

More information on the web of https://answers.kroll.com/

The OXO manufacturer, based in New York, made public at the beginning of 2019 that it had suffered an attack. Neither the details of the attack nor the scope in number of records have been made public, but it is known that the attack began in June 2017 and ended in October 2018, as well as that the data leak included card information.

OXO contacted the affected customers and has offered them a financial data monitoring service.

The American restaurant chain Huddle House has admitted to being a victim of an attack that could have exposed hundreds of thousands of card data. The incident occurred from August 2017 to just a few weeks ago.

The attack would have been perpetrated when the attackers had access to the POS service provider's systems, thus gaining remote access to the company's systems.

The hospitality company has contacted potential customers and has offered several services and contact points for fraud prevention.

More information at this link.

This American hospital published a post at the end of 2018 reporting that it had suffered a breach affecting approximately 48,000 customers and guarantors of its systems.

The breach reportedly occurred through its provider's sales system and affected the financial data of these individuals, not personal or medical data.

More information about the incident at:
https://baylorfrisco.com/important-notice-regarding-a-data-security-incident/

New Fintech Investment Record

2018 has been another record-breaking year for Fintech. According to the FinTech M&A report, Fintech investment during 2018 totaled more than $31 billion (North America, EMEA, and Asia-Pacific).

The article also indicates that Fintech is expected to continue growing and highlights some of the trends in these Fintech companies, such as the use of biometric systems.

This message has been sent pursuant to your authorization to receive commercial communications from Internet Security Auditors. You can view our Data Privacy Policy here. You have the option to exercise the rights of access, rectification, erasure, restriction, objection, and portability provided for in the "Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC" by sending a letter addressed to Internet Security Auditors, Calle Santander, 101. Building A-2 08030 Barcelona (Spain), or by email to the following address: legal@isecauditors.com. If you only wish to unsubscribe from these communications, click the following link and send that email from the email address where you received our communication: marketing@isecauditors.com

This email is sent pursuant to your previous authorization to receive commercial communications from Internet Security Auditors. You can read our Data Privacy Policy here. You have the option at all times to exercise the rights of access, rectification, erasure, restriction of processing, objection, and portability pursuant to the "Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC" by sending a letter addressed to Internet Security Auditors, Calle Santander, 101. Building A-2. 08030 Barcelona (Spain), or by email to the following address: legal@isecauditors.com. If you only wish to request cancellation of these communications, click the following link and send that email from the email address where you received our communication: marketing@isecauditors.com