Newsletter

Newsletter 2018-3

News Bulletin
May 2018

 

What's New

First Ibero-American company to obtain QSA(P2PE) and 3DS Assessor certifications

Internet Security Auditors has become the first Ibero-American company to obtain PCI SSC accreditation as a P2PE (Point-to-Point Encryption) and 3DS Assessor in Europe, Latin America, and the Caribbean.

Highlights

Analysis of the new version of the PCI SSC Cloud Computing Guidelines document

The PCI SSC Information Supplement - Cloud Computing Guidelines is a guide designed for organizations that wish to include cloud computing services within their PCI DSS compliance environment and describes the general recommendations to consider when hiring and monitoring compliance of Cloud Service Providers (CSPs) that may be directly or indirectly involved in the processing, transmission, and storage of payment card data.

Do you have a travel agency? Attention! PCI DSS compliance is not what you have been told

PCI DSS is a standard that we have been reporting on since its origins -in 2004 by VISA and in 2006 by the PCI SSC- due to the significance of non-compliance for the affected entities.

 

It is important to mention that from these origins it is clear that neither the people who were supposed to meet at VISA and Mastercard around the "discussion table" ever thought of small businesses, small businesses that decide to start their journey in electronic payment or, for example, travel agencies with the characteristics of this sector. It can be said that the ecosystem of the travel agency sector has the shape, due to the overall size of this, of a pyramid where its walls are curves that narrow significantly at the top of the pyramid. That is, the vast majority of agencies have fewer than 25 people. Although from the PCI DSS point of view the size of a company is not that important, it is relevant to keep in mind that these agencies will have a relatively simple technological complexity: they do not have on-premises data centers, they do not have a DMZ where they publish services, they do not develop software and, in many cases, they do not sell on the Internet.

TLS 1.3 has now been formally approved as a standard by the IETF TLS 1.3 has now been formally approved as a standard by the IETF

After many years of revisions and 28 drafts, the TLS version 1.3 (Transport Layer Security) protocol has been officially approved as a standard by the Internet Engineering Task Force (IETF). The IETF is a non-profit entity that is responsible for standardizing protocol and procedure specifications that define the internet architecture through engineering monographs known as "Request for Comments" (RFC). The document is now available for review pending the assignment of an official RFC number.

Most Read

Deadline for migration to TLS

June 30, 2018 is the deadline for those who still use SSL or TLS 1.0 as a mechanism for communication protection. From this date, all systems in the cardholder environment must have migrated to recent versions of TLS.

The AEPD will focus its inspection plans on the health, financial, and telecommunications sectors

The AEPD, through its director Mar España, has reiterated that there will be no moratoriums for the application of the GDPR, which must begin its application starting May 25.

NIST published version 1.1 of the cybersecurity framework.

After several revisions, the NIST cybersecurity framework has reached version 1.1. This new version includes some updates in authentication and identity management, risk self-assessment, cybersecurity management in the supply chain, and vulnerability disclosures.

The European Central Bank has published a framework to test the resilience of this sector to cyber-attacks

In addition to being the first framework of its kind for the sector, it facilitates testing in transnational entities that are supervised by multiple authorities.

Events

23-24/05/2018: PCI Asia Pacific Community Meeting (Tokyo)

13-14/06/2018: Fraud Prevention Regional Forum (Orlando)

14/06/2018: PCI Acquirer Forum (London)

Training


10 SEP
 
   PCI DSS and PA-DSS
Virtual
 

25
SEP
 
   PCI DSS and PA-DSS
Madrid
 
Internet Security Auditors
C. Santander, 101. Edificio A, 2º. 08030 Barcelona (Spain) | Tel.: +34 93 305 13 18 / Fax: +34 93 278 22 48
C. Arequipa, 1. 28043 Madrid (Spain) | Tel.: +34 91 763 40 47 / Fax: +34 91 382 03 96
Calle 90 # 12-28. 110221 Bogotá D.C. (Colombia) | Tel.: +57 (1) 638 68 88 / Fax: +57 (1) 638 68 88

In compliance with Organic Law 15/1999 (LOPD), we inform you that your personal data has been included in files owned by Internet Security Auditors for the exclusive purpose of customer management and commercial communication. You have the possibility of exercising the rights of access, rectification, cancellation and opposition provided for by law by sending a letter addressed to Internet Security Auditors, c. Santander, 101. Edif. A. 2º, E-08030 Barcelona (Spain), or by email to the following address: legal@isecauditors.com. If you want to unsubscribe from the Internet Security Auditors Newsletter, send an email to marketing@isecauditors.com.

According to the Spanish Organic Law 15/1999 on personal data protection (LOPD), we inform you that your personal data will be added to files owned by Internet Security Auditors S.L. with the only purposes of customer management and advertising communication. In accordance with the law and regulations you have the possibility at all times of exercising the rights of access, rectification, cancellation and taking exception by sending a letter addressed to Internet Security Auditors, c. Santander, 101. Edif. A. 2º, E-08030 Barcelona (Spain), or through the following email: legal@isecauditors.com. If you want to unsubscribe from the Newsletter of Internet Security Auditors, send an email to marketing@isecauditors.com.

← Back to Newsletters