 |
||||
 What's New
|
 Highlights
|
|||
|
PCI SSC Updates "Key Blocks" Information Supplement In this supplement, the PCI SSC provides information to help PIN acquiring entities correctly implement key blocks, in accordance with requirement 18-3 in the PCI PIN Security Requirements v3.1 standard. It contains minor changes, the most relevant being the inclusion of revised effective dates for key block implementations previously announced in July 2020, which were incorporated into the PCI PIN Security Requirements v3.1 requirements. More information can be found at the following link:
PCI SSC Releases Several Updates Related to the Card Production Standard These updates affect the Card Production and Provisioning Logical Security Requirements and Card Production and Provisioning Physical Security Requirements standards, as version 3.0.1 of both is being released. This new version simply corrects grammatical and formatting errors and includes FAQs. There are also updates regarding AoC and RoC documents. Version 3.0 of the following documents is being released:
And two new specific AoCs and RoCs are being released:
Finally, an updated version of the Technical FAQs document for the Card Production security requirements is also being released. More information at the following link: PCI SSC Opened the Request for Comments (RFC) Period for the Future New Mobile Payments on COTS (MPoC) Standard from June 13 to July 15 The PCI SSC is developing a new standard designed specifically to support the evolution of mobile payments. The goal is to facilitate a security standard that accommodates different payment acceptance channels and consumer verification methods on COTS devices. This is the second RFC for this standard, and it is expected to be published, if all goes well, by the end of this year, 2022. More information at the following link: |
This article discusses the expansion of the IIN value and the implications this has for compliance with the PCI DSS standard in versions v3.2.1 and v4.0. Over the past few months, payment brands have been adjusting their original positioning. Furthermore, the PCI SSC has released the new version of PCI DSS, 4.0, and has also updated the content of several FAQs used as a reference. For all these reasons, it has been necessary to create a new article that adapts to the current reality. |
|||
 Incident Analysis
|
||||
|
LastPass Suffers a Cyberattack
LastPass is a password manager used by more than 22 million users. Recently, the company reported that its systems had been attacked by cybercriminals. An unauthorized third party managed to access some parts of the development environment using a single exposed developer account. The attackers managed to exfiltrate fragments of LastPass's source code and technical information, but, for now, they have not observed that this incident involved access to customer data or encrypted password vaults. More information at the following link:
|
||||
|
Cisco Suffers a Cyberattack Against Its IT Network
Cisco reported a security incident that occurred on May 24. The investigation detailed that a Cisco employee's credentials were compromised after an attacker gained control of a personal Google account where credentials saved in the victim's browser were being synchronized, using vishing techniques. Once the victim accepted the multi-factor authentication push notifications sent by the attacker, the attacker accessed the internal VPN. After identifying the attacker, their access to the internal network was denied. No impact has been observed on its products, services, customer/employee data, or the supply chain. On August 10, the attackers published a list of files from this security incident, and it is estimated that a total of 2.8 GB of data could have been exfiltrated. Cisco confirms that the attackers attempted to exfiltrate data, but that they only managed to exfiltrate a Box folder linked to the compromised employee account, and indicates that it does not contain sensitive information. More information at the following link:
|
||||
|
CSIC, Victim of a Cyberattack Similar to Those Suffered by NASA or Max Planck
The Spanish National Research Council suffered a ransomware cyberattack on July 16 and 17. The measures used to control and resolve the attack resulted in a network access outage at several centers. Experts have preliminarily stated that the attack originated from Russia. More information at the following link:
|
||||
|
Signal Acknowledges a Data Breach Affecting About 2,000 Users
Signal has confirmed that about 1,900 users of its messaging application have been affected by the data breach resulting from the phishing attack suffered by the communication service provider Twilio, used by Signal to perform phone number verification. The company says that data such as search history, profile information, contact list, or blocked people have not been affected by this security breach. More information at the following link:
|
||||
 Trends
|
||||
|
The GEAR (Global Executive Assessor Roundtable) was created in 2018 and is an international group of assessors. Its purpose is to obtain recommendations and input from the senior executives of the payment security assessment firms accredited by the PCI SSC. This initiative allows senior executives of PCI standard assessment firms to provide advice, feedback, and guidance to the PCI SSC on issues and concerns related to assessments and assessment programs, representing the perspectives of the regions and customers where and with whom they work.
Internet Security Auditors is one of the 14 companies that have been part of the GEAR since its creation, and has continuously renewed its participation to the present day. This renewed participation demonstrates the company's positioning and relevance in the PCI standards environment. Visa Tokens Outnumber Physical Cards in Circulation Visa has announced that it has issued the 4 billionth token through the Visa Token Service (VTS). This service replaces Visa's 16-digit card numbers with a digital token that only Visa itself can unlock. A study by the payment brand calculates that, thanks to this, it has helped reduce the fraud rate by 28%. The milestone of 4 billion tokens exceeds the number of physical Visa cards in circulation worldwide. New banking cyber scams combine SMS and fake calls Some entities present in Spain have detected scams that combine messages and calls to deceive users. The method begins with a mobile message impersonating the bank, alerting the user to a transaction involving hundreds of euros and instructing them to verify the activity using the link provided in the message itself. The link leads to a website very similar to the bank's (but, obviously, it is a fake website), where the user is asked for their login credentials, electronic signature, and ID card. A few hours later, the user receives a call from the cybercriminals, who ask for a code sent to their mobile phone to compromise the account. Emotet variant steals payment card data from Google Chrome users Emotet is malware distributed through email campaigns. On June 6, Proofpoint discovered that cybercriminals had deployed a new module designed to steal payment card data stored in the Google Chrome browser. This module is capable of exfiltrating the collected data to various command-and-control servers (commonly known as C&C or C2). Card payments prevail over cash: up 68% compared to 2019, while ATM withdrawals only increase by 1%, according to BBVA BBVA Research data analyzing consumption trends show that card spending rose by 68% in May compared to the same month in 2019, before the pandemic. Furthermore, it is worth noting that non-face-to-face transactions with Spanish cards increased 3.4 times between May 2019 and last month. In contrast, cash withdrawals from ATMs showed a different trend during the same period, remaining stagnant and increasing by only 1%. The Fed will launch the 'FedNow' instant payment system between May and July 2023 The United States Federal Reserve will launch the FedNow service between May and July 2023, an instant payment solution that will be available to financial institutions across the Americas. The goal is to promote a secure, efficient, and widely accessible payment infrastructure. This solution will allow households and businesses to send instant payments at any time or day, with funds becoming available immediately. |
||||
| Internet Security Auditors C. Santander, 101. Edificio A, 2º. E-08030 Barcelona (Spain) | Tel.: +34 93 305 13 18 C. Arequipa, 1. E-28043 Madrid (Spain) | Tel.: +34 91 763 40 47 Transversal 22 # 98-82 Ed. Porta 100 Of. 1003. 110221 Bogotá (Colombia) | Tel.: +57 601 638 68 88 |
||||
    
|
||||
|
This message has been sent pursuant to your authorization to receive commercial communications from Internet Security Auditors. You can view our Data Privacy Policy here. You may exercise your rights of access, rectification, erasure, restriction, objection, and portability as provided for in the “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC” by writing to Internet Security Auditors, Calle Santander, 101. Edificio A-2 08030 Barcelona (Spain), or by email at the following address: legal@isecauditors.com, attaching a copy of your ID card or equivalent document proving your identity. If you only wish to unsubscribe from these communications, click the following link and send that email from the email address where you received our communication: marketing@isecauditors.com This email is sent according to your previous authorization to receive commercial communications from Internet Security Auditors. You can read our Data Privacy Policy here. You may at all times exercise the rights of access, rectification, erasure, restriction of processing, objection, and portability according to the “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC” by sending a letter addressed to Internet Security Auditors, Calle Santander, 101. Edificio A-2. 08030 Barcelona (Spain), or through the following email: legal@isecauditors.com, attaching your request with a copy of your ID card or equivalent document proving your identity. If you only wish to request cancellation of these communications, click on the following link and send that email from the email address where you received our communication: marketing@isecauditors.com |
||||
Newsletter