Payment Methods Newsletter March 2020

PCI SSC Launches Website Dedicated to All COVID-19-Related Updates

The PCI SSC has enabled a section on its website to report all changes or impacts on PCI environments that may be affected by this COVID-19 contingency situation.

On this website we can see guides, changes in PCI SSC courses and events, or updates related to the Organization's standards.

https://www.pcisecuritystandards.org/covid19

PCI SSC Publishes New Guidance for Large Organizations

As a result of the work of the 2019 working groups, the PCI SSC has published new guidance for PCI DSS compliance. This publication, focused on the organizational complexity of large companies, provides suggestions and guidance on how PCI DSS compliance can be integrated into organizational processes throughout the entire organization, including roles and responsibilities, awareness, but also more business-focused aspects, such as legal compliance or the management of multiple acquirers or payment channels.

You can find the details of the publication at:
https://blog.pcisecuritystandards.org/new-guidance-pci-dss-for-large-organizations

Request for Comments Issued for Version 1.1 of the Software-Based PIN Entry on COTS Standard

The PCI SSC is issuing the Request for Comments for the new version to affiliated organizations. This time, the changes are minor and focus on the alignment of the PCI PTS POI v6.0 standard, which will be published in the coming days.

For more information, you can visit the following link:
https://blog.pcisecuritystandards.org/request-for-comments-software-based-pin-entry-on-cots-standard-v1-1

Crimes in the Post-COVID-19 Pandemic Era

In this article, Vicente Aguilera analyzes the current state and use of technologies that users make, as well as the use of tools for data analysis and how they can be used through OSINT tools and disciplines.

The article concludes with an interesting conclusion on how cybercriminals could be taking advantage to prepare their attacks when we return to a state of normalcy.

PA-DSS vs. PCI SSS and PCI SSLCS Analysis

Alberto Villar presents the new PCI SSS and PCI SSLCS standards, which seek to evolve the current PA-DSS standard.

Alberto talks to us in the article about the published material, dates, as well as the comparison of both standards with the current PA-DSS and what advantages the new formats offer.

Expiration Deadline Extended for PTS POI v3 Devices

Due to COVID-19 and the impact it is having on merchants, acquirers, and service providers, the PCI SSC has decided to extend the life of PTS POI v3 devices from April 30, 2020, to April 30, 2021.

For more information, you can visit the following links:
https://blog.pcisecuritystandards.org/expiration-date-extended-for-pts-poi-v-3-devices
https://www.pcisecuritystandards.org/pdfs/PCISSC_Bulletin_on_Extension_of_Expiry_for_PCI_PTS_POI_v3_Devices.pdf

Protecting Payments While Working Remotely

The PCI SSC has published a brief guide with some guidelines that must be followed to continue keeping card transactions secure in the contingency situation that many of us find ourselves in now due to COVID-19.

The article is not very extensive and indicates the key points that must be followed to increase security at work, focusing on security from the point of view of people (awareness), the process (access to removable devices, MFA, etc.) and technology (firewalls, accepted devices, etc.).

https://blog.pcisecuritystandards.org/protecting-payments-while-working-remotely

PCI DSS and CIS Controls: How to Comply with Both Standards

In this article, Daniel Fuertes talks to us about the synergies between both security standards. On one hand, a standard that is highly oriented and with very specific controls, and on the other, a more generic and versatile standard.

He also analyzes some of the key aspects of each standard and considerations we must make before tackling the compliance of a standard, such as the scope they refer to, the possibility of certification, or the level of technical testing required.

Automating Injections with SQLMAP

SQLMAP is a free (open source) tool, written in Python, which will help us test/automate the process of detecting and exploiting SQL injections.

Through this tool, Héctor Berrocal guides us step by step, command by command, on how to access databases that we do not have access to by automating tasks with SQLmap.

This supermarket chain, with a presence mainly in the US, has detected the presence of malware in its points of sale that has been operating since March. According to some sources, the scope is close to 30 million card data.

More information on the website of https://www.wawa.com

Landry’s is a restaurant chain based in Houston and reported at the end of 2019 the existence of malware that would affect some of its restaurants and that could have exposed the information of several of its customers and their card data. Although the number of potentially affected cards has not been published, it has been reported that the attack affected 67 establishments.

More information on the website of https://www.landrysinc.com

Visa Launches Its “Click to Pay” Program

Visa, committed to finding a balance between usability and transaction security, has launched a “Click to Pay” program. Through third-party platforms, it offers this service to merchants since the end of last year.

During the month of April, the new Visa policy will come into effect affecting merchants that offer free trials as launch promotions, with the purpose of providing greater protection to cardholders. The main aspects of this policy focus on easy cancellation and the need to be more transparent with notifications and transactions with users.

Several countries have increased contactless transaction limits. The use of contactless is increasingly spreading as a measure to mitigate the spread of Covid-19. The limits of these transactions vary in different countries and in some of them, they have been increased to prevent having to enter the PIN in more transactions and mitigate even more the spread of the virus.

This message has been sent pursuant to your authorization for the communication of commercial information from Internet Security Auditors. You can consult our Data Privacy Policy here. You have the possibility to exercise the rights of access, rectification, erasure, restriction, objection and portability provided for in the "Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC" by letter addressed to Internet Security Auditors, Calle Santander, 101. Edificio A-2 08030. Barcelona (Spain), or by email to the following address: legal@isecauditors.com. If you only wish to unsubscribe from these communications, click the following link and send that email from the email address at which you received our communication: marketing@isecauditors.com

This email is sent pursuant to your previous authorization for the transmission of commercial information from Internet Security Auditors. You can read our Data Privacy Policy here. You have the possibility at all times to exercise the rights of access, rectification, erasure, restriction of processing, objection and portability according to the "Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC" by sending a letter addressed to Internet Security Auditors, Calle Santander, 101. Edificio A-2. 08030 Barcelona (Spain), or through the following email: legal@isecauditors.com. If you only wish to request your cancellation of these communications, click on the following link and send that email from the email address at which you received our communication: marketing@isecauditors.com