September 2018 Newsletter

PCI DSS v3.2 Significant Change Management

Anyone who has been involved or had to work with the PCI DSS standard and, especially, those who have had to “endure” its implementation and maintenance in any of its scopes, will know that the standard leaves quite a few ambiguities and concepts that are not fully defined with exactness.

To mitigate this, the SSC has been publishing a glossary-like document with each version of the standard, in which it compiles various concepts, terms, abbreviations, and acronyms. One of these terms, and the subject of this article, is Significant Change, with the particularity that this concept is not included or detailed in the aforementioned glossary.

PCI DSS VS. GDPR

On May 25, 2018, the European General Data Protection Regulation (or General Data Protection Regulation, hereinafter GDPR) came into effect, replacing the Data Protection Directive 95/46/EC, and was designed with the goal of aligning all data protection laws in European countries, protecting and giving European citizens control over their private data, and establishing a homogeneous privacy framework so that organizations and individuals can exercise their rights and know their responsibilities. […]

Precisely, it is on this last point where GDPR converges with the PCI DSS standard: The protection of payment card data linked to European citizens. However, they are different documents but can be used interchangeably as a complement to achieve compliance with one or the other and are not mutually exclusive.

Processing sensitive authentication data, outside of PCI DSS?

Recently, we have encountered the case of some clients who have asked us if an environment where sensitive authentication data related to payment cards is stored, processed, or transmitted, but not PAN data, is susceptible to the application of the PCI DSS security standard.

Card data truncation techniques in PCI DSS environments

With the goal of minimizing the PCI DSS implementation effort in an environment where card data is processed, one of the most important premises we consider is the reduction of said environment. To this end, one of the techniques we can use is the truncation of card data in its storage.

This technique is based on storing only part of the PAN, for historical or traceability purposes, but without allowing the attacker to deduce the full PAN of the transaction through the use of simple computational techniques.

Role of the International Trade Administration in the Privacy Shield framework

The Privacy Shield security framework is managed by the International Trade Administration (ITA), which is part of the United States Department of Commerce.

To understand the steps to follow and the requirements requested in the case of wanting to adhere to compliance with it, it is important to know the role of said actor in the management and maintenance of said security framework. To this end, below, we will see the main actions carried out by ITA in the management of the Privacy Shield framework.

Version 3.0 of the “PCI PIN Security Requirements and Testing Procedures” standard published

In August 2018, the PCI SSC published version 3.0 of the "PIN Security Requirements and Testing Procedures" standard. This document is part of the PCI PIN Transaction Security (PTS) family of standards, which also includes PCI HSM (Hardware Security Module) and PCI POI (Point of Interaction), aimed at protecting the PIN (Personal Identification Number) in in-person (“card present”) transactions at ATMs and attended and unattended point-of-sale (POS) terminals. The first version of PCI PIN (1.0) was published in 2011 and version 2.0 was published in 2014, so this standard already has 7 years of implementations worldwide.

Brief introduction to the PCI 3D-Secure (PCI 3DS) standard

In October 2017, the PCI SSC announced PCI 3D-Secure (PCI 3DS), a new security standard applicable in non-present payment environments, where 3D-Secure is used, a protocol that improves security in customer authentication for online purchases. This protocol allows consumers to authenticate through a one-time password (OTP), such as a number contained in a coordinate card, a cryptographic token, a password, a code sent via SMS/email, etc.

PCI DSS Compliance, basic tips from the PCI SSC for small businesses

Recently, the PCI SSC has published some educational “pills,” called “Payment data security essentials,” to help small online businesses comply with the requirements of the PCI DSS security standard. These pills indicate security recommendations or good practices to comply with, with the requirements dictated by said standard. In addition, they are accompanied by additional material that complements said training, such as additional explanatory guides and videos.

Questions and Answers about the new CISSP CAT (Computerized Adaptive Testing) exam type

In recent months, many concerns have been raised about the change in the exam model adopted by (ISC)2, which is becoming a trend among many organizations, for conducting CISSP exams. This new exam model, in which the examinee must keep answering questions and, based on their answers, the questions adapt and define, aims to reduce the time and number of questions and, it is intended, to evaluate more effectively the examinee's knowledge in the subjects they are examined on.

But this model has also raised doubts. Based on the experience of one of our colleagues from the Internet Security Auditors consulting team, and without claiming to be an “official” P/R or survey, we have posed some questions and answers that have not been answered by (ISC)2.

23-24/10 2018: XII ENISE (León, Spain).

29/11-2/12 2018: CyberCamp 2018 (Málaga, Spain)

17-18/10: Cyber Ethical Days (Barcelona, Spain)