Search

Brian Pennington

A blog about Cyber Security & Compliance

ADVICE FROM AN ASSESSOR: DevOps, Automation, Security and Compliance

By Andrew Barratt, QSA, PCIP.  Managing Director, International/Managing Principal, Payments, Application Validation
Coalfire; Manchester, UK, http://www.coalfire.com

Phew, the title of this post alone sounds like it could be quite a lot to deal with!

So what is DevOps?  DevOps is simply the blending of infrastructure operations processes and software development to enable faster changes to business applications/technology.  These processes share a lot of ideology with the Agile & Lean camps but are more fundamentally trying to bridge the traditional divide between the development world and the IT operations/Service management teams.

In practice, DevOps can mean a lot of different things to different audiences and sometimes it can be difficult to apply compliance requirements without getting a good understanding of what DevOps is for your company.

Terms such as ‘treat your code as infrastructure’ can often scare the life out of traditional auditors along with the fear that with rapid release and change comes rapid loss of control. These shouldn’t be scary but should be embraced and understood. In audit parlance these processes can become embedded, configurable application controls that require less substantive audit testing and sampling when under scrutiny and allow the focus to be on how they are designed to be a security control.

DevOps environments typically make heavy(think obsessive!) use of automation tools to enable rapid change and release processes to be possible at large and frequent scale. This is typically where the confusion starts to begin when evaluating these environments for security and compliance purposes. Typical service management controls such as change management on the surface may appear to have been cast aside in the rush to ‘be DevOps’. This rush to implement tooling can often lead to the underlying processes being weak or ill conceived. However this is common in other disciplines too. Poor planning = poor performance.

DevOps done well can bring a great set of tools and capability for building secure, scalable and compliant environments. Building on modern source control, streamlining change control and building dependency on the tools authentication and access control can quickly be used to demonstrate the control requirements of many compliance frameworks including the PCI DSS. Just doing things faster or without lots of paper forms and signatures on doesn’t necessarily equate to non-compliance.

The implementation of PCI DSS requirements 2 and 6 can be rapidly transformed using a DevOps approach. If we look at requirement 2 as being primarily focused on hardened configuration management traditionally seen as an ‘Ops’ area, whilst Requirement 6 focuses on change management and software development.

There is nothing fundamentally in these requirements (or in other areas of the DSS) that prevents a DevOps environment being used to support and implement PCI compliance if done carefully. Whilst the security and compliance mandate might tweak certain implementation decisions most of the tools marketed for ‘DevOps’ support building workflows that can be used for approval / review decisions and capture/log the necessary approval processes to support compliance. As the level of automation increases so can the ease of which compliance requirements be met.

Recently I worked with a client that had invested heavily in building their dev-ops tooling but had built in PCI requirements as part of this process so also incorporated automation of documentation production too.  Their focus was, and still is, to automate as much as possible into the release process to minimize the failure of an activity. Every time a new release was pushed all configuration documentation was also updated automatically (supporting requirement 2) .

This particular client used a software issue and tracking tool that could be used to demonstrate management approval for changes as well as to show that code review processes had been followed. As they continued to improve they were investigating automation of their code review processes so that static analysis tools were orchestrated immediately after changes were approved as part of the build process.

One of the biggest challenges they faced initially was the size of their team, they were small and specialist and in the past had struggled with creating segregation of duties between their test/production systems.  Moving to DevOps helped with this significantly. No developers were required to have access to production systems in any manner as the build and release process was entirely orchestrated by tools with an approval workflow that the developers couldn’t authorize alone. The tools were the only thing with the ability to push to their production systems and the workflow done under management approval. These tools were treated the same way as other in-scope systems but the overhead from this was so minimal that it enabled them meet security requirements without complicated manual processes and multiple sets of access permissions.

car-cracking

FASTRInfographic2017

Forrester predicts the Top 15 Dynamics that will shape 2017

2017 will be a year of action for many companies, as they address the realities of a fast-moving customer-led and digital-centric market,” said Cliff Condon, chief research and product officer at Forrester.

“Empowered customers are forcing the hand of virtually every industry. And so the question for most companies and business leaders is not if they will respond to these market dynamics, but when and how. Inaction presents immediate revenue risk or much worse a threat to a company’s existence

The top 15 dynamics that will shape 2017 are:

  1. The extent to which businesses will need to restructure to adapt to a customer-led market.
  2. How and how many CMOs can successfully evolve to meet new and expansive leadership demands.
  3. The likelihood that CIOs will rise to the challenge of leading digital business strategies.
  4. How CEOs will handle business unit and product leadership in a market dominated by empowered customers and disruptors.
  5. How transitional roles like chief data officer, chief digital office, and chief customer officer will fare.
  6. How businesses will react to acute cyber risk to maintain customer trust.
  7. Determining the scarce but critical talent required to lead in the age of the customer and how that will place significant pressure on both talent management and talent acquisition.
  8. Identifying new levels of revenue risk directly attributed to underperforming or even mediocre customer experiences.
  9. The extent to which companies are able to measure and operationalize emotion, which continues to be a primary driver of customer affinity and spend.
  10. How companies are designing signature moments to capture customers’ hearts, minds, and spend.
  11. The beginnings of a new technology revolution that will reshape how businesses operate and interact with customers.
  12. The role augmented reality and virtual reality will play in 2017 and where both are in their evolution.
  13. The implementation and impact of the internet of things in 2017.
  14. The impact and evolution of artificial intelligence to deliver contextually rich, personalized experiences.
  15. The next steps in cloud computing to change the architecture and economics of technology.

To gain more insights on the dynamics that will shape 2017, download Forrester’s predictions guide.

 

BYOD security market to reach over $337 million

Technavio’s market research analysts expect the global BYOD security market to reach over $337 million between 2016 and 2020 

The increased use of mobile devices, triggered by the growing need for employee mobility, is the fundamental driving force behind growth in this market.  

The increase in employee mobility and the rising adoption of the Bring-Your-Own-Device (BYOD) policy is leading to the increased use of mobile devices. Enterprises are increasingly adopting BYOD security solutions to secure their networks from growing security threats and to provide secure access to confidential information. 

North America accounts for more than 36% of the market share to dominate the global BYOD security market. The growing awareness among enterprises about the benefits of using BYOD security solutions on mobile devices coupled with the rise in the number of cyber-attacks and malware are some of the key factors contributing to the growth in the BYOD security market in the Americas during the forecast period.

The growing popularity of cloud-based BYOD security is the latest trend in the global BYOD security market. Cloud-based BYOD security does not require any hardware or software and can be controlled remotely, making it cost-effective for the end-users. Also, it has a faster response rate to the new security threats and unauthorized activities as well as allows companies to use software products on a pay-per-use basis and are cost effective. Limited hardware infrastructure, less dependency on internal IT personnel, faster implementation of IT solutions, no licensing costs, and low maintenance costs are some of the advantages of a cloud-based BYOD security system,” says Amrita Choudhury, Lead Analyst, ICT, Technavio Research.

Currently, the Mobile Content Management (MCM) segment occupies almost 52% of the market share to dominate the global BYOD security market. MCM is gaining prominence among large enterprises, government organizations, and small and medium-sized business (SMBs) because of the increased acceptance of the BYOD policy.  

Some vendors in the MCM market are even providing additional security features in the products that they are offering to gain consumer interest and market shares. For instance, AirWatch provides the Secure Content Locker that comprises of secure storage containers to safeguard data stored on mobile devices. 

The key vendors in the global BYOD security market include Citrix Systems, Good Technology, IBM, MobileIron, and VMware. The global BYOD security market highly fragmented owing to the presence of many international, regional, and local vendors. Established BYOD security solution vendors are likely to acquire small vendors to expand their product portfolio and increase their market share.  

During the forecast period, the level of vendor competition is likely to intensify with product and service extensions, technological innovations, and M&As.

 

Your Biggest Weakness Is Already on Your Payroll

Imperva IG

An Imperva Infographic

100 Percent of Retailers Disclose Cyber Risks

According to BDO’s analysis of risk factors listed in the most recent 10-K filings of the 100 largest U.S. retailers, risk associated with a possible security breach was cited unanimously by retailers, claiming the top spot, up from the 18th spot in 2007.

Since major retail security breaches began making national headlines in 2013, retailers have become acutely aware of the growing cyber threat and cyber-related risks. Between new point-of-sale systems and evolving digital channels, the industry faces unique vulnerabilities: Retailers are responsible for safeguarding consumer data as well as their own, in addition to protecting against potential gaps in security related to third-party suppliers and vendors.

2016 marks the 10th anniversary of our retail risk factor analysis, and throughout the decade, we’ve seen the retail landscape undergo a dramatic evolution in response to the recession, new and maturing e-commerce channels and evolving consumer preferences,” said Doug Hart, partner in BDO’s Consumer Business practice. “Retailers over the years have proven to be in tune with the industry-wide issues and trends that could pose risks to their businesses, and they are clearly not tone deaf when it comes to reacting to the urgency of cybersecurity

The following chart ranks the top 25 risk factors cited by the 100 largest U.S. retailers:

Top 20 Risks for Retailers 2016 2015 2014
General Economic Conditions #1 100% #1 100% #1 100%
Privacy Concerns Related to Security Breach #1t 100% #4t 99% #8 91%
Competition and Consolidation in Retail Sector #3 98% #1t 100% #3 98%
Federal, State and/or Local Regulations #4 96% #1t 100% #2 99%
Natural Disasters, Terrorism and Geo-Political Events #5 94% #7 96% #13 87%
Implementation and Maintenance of IT Systems #6 93% #4 99% #7 92%
U.S. and Foreign Supplier/Vendor Concerns #6t 93% #6 98% #4 96%
Legal Proceedings #6t 93% #9t 95% #8t 91%
Labor (health coverage, union concerns, staffing) #9 91% #7t 96% #5 94%
Impediments to Further U.S. Expansion and Growth #10 90% #12t 92% #17 78%
Dependency on Consumer Trends #11 88% #9 95% #6 93%
Consumer Confidence and Spending #12 87% #15 89% #8t 91%
Credit Markets/Availability of Financing and Company Indebtedness #13 85% #11 94% #11 89%
Failure to Properly Execute Business Strategy #14 82% #12 92% #11t 89%
Changes to Accounting Standards and Regulations #15 76% #14 90% #13t 87%
International Operations #16 73% #17 86% #15 80%
Loss of Key Management/New Management #16t 73% #19 80% #16 79%
Marketing, Advertising, Promotions and Public Relations #18 66% #25 68% #24 64%
Consumer Credit and/or Debt Levels #19 62% #27 65% #23 65%
Joint Ventures #20 61% #21 76% #18 74%

Additional findings from the 2016 BDO Retail Risk Factor Report:

Cyber Risks Include Compliance Measures

As the cyber threat looms larger, retailers are bracing for new and emerging cybersecurity and data privacy legislation. Risks associated with cyber and privacy regulations were cited by 76 percent of retailers this year. This is in line with the findings from the 2016 BDO Retail Compass Survey of CFOs, in which nearly 7 in 10 retail CFOs said they expected cyber regulation to grow in 2016. These concerns have been highlighted by President Obama’s recently unveiled Commission on Enhancing National Cybersecurity and continued debate in Congress over information sharing between the government and private industry.

Retailers have not escaped regulatory scrutiny. The industry is also subject to Europay, Mastercard and Visa (EMV) standards that bolster credit card authentication and authorization. Industry analysts estimate that just 40 percent of retailers are compliant with EMV standards despite the Oct. 1, 2015 deadline.

“Mandating EMV chip-compliant payment systems is an important first step in shoring up the industry’s cyber defenses, but it’s just the tip of the iceberg,” said Shahryar Shaghaghi, National Leader of the Technology Advisory Services practice group and Head of International BDO Cybersecurity. “Online and mobile transactions remain vulnerable to credit card fraud and identity theft, and POS systems can still be hacked and provide an access point to retailers’ networks. New forms of malware can also compromise retailers’ IT infrastructure and disrupt business operations. Every retailer will experience a data breach at some juncture; the real question is what mechanisms have been put in place to mitigate the impact.”

E-Commerce Ubiquity Drives Brick & Mortar Concerns

Impediments to e-commerce initiatives also increased in ranking, noted by 57 percent of retailers in 2016, a significant contrast from 12 percent in 2007. In 2015, e-commerce accounted for 7.3 percent of total retail sales and is continuing to gain market share.

As e-commerce grows and businesses strive to meet consumers’ demand for seamless online and mobile experiences, retailers are feeling the effects in their physical locations. The recent wave of Chapter 11 bankruptcies and mass store closings among high-visibility retailers has raised concerns across the industry. Ninety percent of retailers are worried about impediments to growth and U.S. expansion this year. Meanwhile, risks associated with owning and leasing real estate jumped 14 percentage points to 54 percent this year.

Heightened worries over the impact of e-commerce on physical locations are far reaching, driving concerns over market competition for prime real estate and mall traffic to rise 19 percentage points to 46 percent. Meanwhile, consumer demand for fast shipping fueled an uptick in risks around the increased cost of mail, paper and printing, rising 10 percentage points from seven percent in 2015 to 17 percent this year.

General Economic Conditions Hold Weight

General economic risks have been consistently top of mind for retailers throughout all ten years of this survey. Even at its lowest percentage in 2008, this risk was still the second most cited, noted by 83 percent of companies.

Despite the fact that since 2013, general economic conditions have remained tied for the top risk, concerns about specific market indicators have receded.

For more information on the 2016 BDO Retail RiskFactor Report, view the full report here.

About the Consumer Business Practice at BDO USA, LLP

BDO has been a valued business advisor to consumer business companies for over 100 years. The firm works with a wide variety of retail and consumer business clients, ranging from multinational Fortune 500 corporations to more entrepreneurial businesses, on myriad accounting, tax and other financial issues.

Demystifying 9 Common Types of Cyber Risk

Economic, Technology, & Marketing Thought Leadership

1)       Crimeware
This is designed to fraudulently obtain financial gain from either the affected user or third parties by emptying bank accounts, or trading confidential data, etc. Crimeware most often starts with advanced social engineering which results in disclosed info that leads to the crimeware being installed via programs that run on botnets which are zombie computers in distant places used to hide the fraudsters I.P (internet protocal) trail. Usually the victim does not know they have crimeware on their computer until they start to see weird bank charges or the like, or an I.T. professional points it out to them. Often times it masquerades as fake but real looking antivirus software demanding your credit card info in an effort to then commit fraud with that info.

2)       Cyber-Espionage
The term generally refers to the deployment of viruses that clandestinely observe or destroy data in the computer systems of government agencies and…

View original post 1,143 more words

healthcare-apps

Breaches caused by either hacking or malware nearly doubled in relative frequency

Beazley, a leading provider of data breach response insurance, today released its Beazley Breach Insights 2016 findings based on its response to over 2,000 breaches in the past two years. The specialized Beazley Breach Response (BBR) Services unit responded to 60% more data breaches in 2015 compared to 2014, with a concentration of incidents in the healthcare, financial services and higher education sectors.

Key data:

  • Breaches caused by either hacking or malware nearly doubled in relative frequency over the past year. In 2015, 32% of all incidents were caused by hacking or malware vs. 18% in 2014.
  • Unintended disclosure of records – such as a misdirected email – accounted for 24% of all breaches in 2015, which is down from 32% in 2014.
  • The loss of non-electronic physical records accounted for 16% of all breaches in 2015, which is unchanged from 2014.
  • The proportion of breaches involving third party vendors more than tripled over the same period, rising from 6% of breaches in 2014 to 18% of breaches in 2015.

Beazley’s data breach statistics are based on 777 incidents in 2014 and 1,249 in 2015.

We saw a significant rise in incidents caused by hacking or malware in the past year,” said Katherine Keefe, global head of BBR Services. This was especially noticeable in healthcare where the percentage of data breaches caused by hacking or malware more than doubled

Ransomware on the rise in healthcare

Hackers are increasingly employing ransomware to lock up an organization’s data, holding it until a ransom is paid in nearly untraceable Bitcoin. Hollywood Presbyterian Hospital in Los Angeles reported suffering a ransomware attack in February 2016 and ultimately paid the hackers $17,000 in Bitcoin. A year earlier, the FBI had issued an alert warning that ransomware attacks were on the rise.

This trend is borne out by Beazley’s data. Breaches involving ransomware among Beazley clients more than doubled to 43 in 2015 and the trend appears to be accelerating in 2016. Based on figures for the first two months of the year, ransomware attacks are projected to increase by 250% in 2016.

Clearly, new malware programs, including ransomware, are having a big impact, said Paul Nikhinson, privacy breach response services manager for BBR Services. Hacking or malware was the leading cause of data breaches in the healthcare industry in 2015, representing 27% of all breaches, more than physical loss at 20%

Healthcare is a big target for hackers because of the richness of medical records for identity theft and other crimes. In fact, a medical record is worth over 16 times more than a credit card record.”

Higher Education

Higher education also experienced an increase in breaches due to hacking or malware with these accounting for 35% of incidents in 2015, up from 26% in 2015.

Colleges and universities are reporting increased “spear phishing” incidents in which hackers send personalized, legitimate-looking emails with harmful links or attachments. The relatively open nature of campus IT systems, widespread use of social media by students and a lack of the restrictive controls common in many corporate settings make higher education institutions particularly vulnerable to data breaches.

Financial Services

In the financial services sector, hacking or malware was up modestly to 27% of industry data breaches in 2015 versus 23% in 2014. Trojan programs continued to be a popular hacking device.

The State of Cybersecurity in Healthcare Organizations in 2016

ESET and the Ponemon Institute have announced results of The State of Cybersecurity in Healthcare Organizations in 2016.

According to the study, healthcare organizations average about one cyber attack per month with 48% of respondents said their organizations have experienced an incident involving the loss or exposure of patient information during the last 12 months. Yet despite these incidents, only half indicated their organization has an incident response plan in place.

The concurrence of technology advances and delays in technology updates creates a perfect storm for healthcare IT security,” said Stephen Cobb, senior security researcher at ESET. “The healthcare sector needs to organize incident response processes at the same level as cyber criminals to properly protect health data relative to current and future threat levels. A good start would be for all organizations to put incident response processes in place, including comprehensive backup and disaster recovery mechanisms. Beyond that, there is clearly a need for effective DDoS and malware protection, strong authentication, encryption and patch management

Key findings of the survey:

78% of respondents, the most common security incident is the exploitation of existing software vulnerabilities greater than three months old.

63% said the primary consequences of APTs and zero-day attacks were IT downtime

46% of respondents experienced an inability to provide services which create serious risks for patient treatment.

Hackers are most interested in stealing patient information

  • The most attractive and lucrative target for unauthorized access and abuse can be found in patients’ medical records, according to 81% of respondents.

Healthcare organizations worry most about system failures

  • 79% of respondents said that system failures are one of the top three threats facing their organizations
  • 77% cyber attackers
  • 77% unsecure medical devices

Technology poses a greater risk to patient information than employee negligence

  • 52% of respondents said legacy systems and new technologies to support cloud and mobile implementations, big data and the Internet of Things increase security vulnerabilities for patient information
  • 46% of respondents also expressed concern about the impact of employee negligence
  • 45% cited the ineffectiveness of HIPAA mandated business associate agreements designed to ensure patient information security

DDoS attacks have cost organizations on average $1.32 million in the past 12 months

  • 37% of respondents say their organization experienced a DDoS attack that caused a disruption to operations and/or system downtime about every four months. These attacks cost an average of $1.32 million each, including lost productivity, reputation loss and brand damage.

Healthcare organizations need a healthy dose of investment in technologies

  • On average, healthcare organizations represented in this research spend $23 million annually on IT
  • 12% on average is allocated to information security
  • Since an average of $1.3 million is spent annually for DDoS attacks alone, a business case can be made to increase technology investments to reduce the frequency of successful attacks

Based on our field research, healthcare organizations are struggling to deal with a variety of threats, but they are pessimistic about their ability to mitigate risks, vulnerabilities and attacks,” said Larry Ponemon, chairman and founder of The Ponemon Institute. “As evidenced by the headline-grabbing data breaches over the past few years at large insurers and healthcare systems, hackers are finding the most lucrative information in patient medical records. As a result, there is more pressure than ever for healthcare organizations to refine their cybersecurity strategies

Over 35% of organisations in the energy sector are not able to track threats

Tripwire 2016 Energy Survey: Physical Damage

Tripwire’s 2016 energy study was conducted by Dimensional Research on the cyber security challenges faced by organizations in the energy sector. The study was carried out in November 2015, and respondents included over 150 IT professionals in the energy, utilities, and oil and gas industries.

“After hundreds of years protecting our nation’s geographic borders, it is sobering to note that possibly the most vulnerable frontier happens to be the infrastructure that runs the largest companies in the country.”

Rheka Shenoy, VP and general manager of industrial IT cyber security for Belden

Does your organization have the ability to accurately track all the threats targeting your OT networks?

tripwire-2016-energy-survey-physical-damage-

Does your organization have the ability to accurately track all the threats targeting your OT networks?

tripwire-2016-energy-survey-physical-damage- 2
In your opinion, is your organization a target for a cyberattack that will cause physical damage?
tripwire-2016-energy-survey-physical-damage- 3
Is your organization a potential target for a nation-state cyberattack?
tripwire-2016-energy-survey-physical-damage- 4
The incredibly high percentages of these responses underscores the need for these industries to take material steps to improve cyber security. These threats are not going away. They are getting worse. We’ve already seen the reality of these responses in the Ukraine mere months after this survey was completed. There can be no doubt that there is a physical safety risk from cyber attacks targeting the energy industry today. While the situation may seem dire, in many cases there are well understood best practices that can be deployed to materially reduce the risk of successful cyber attacks.

Tim Erlin, director of IT security and risk strategy for Tripwire

More fines next year for nuisance call companies

Companies making nuisance calls have been warned to expect more fines in 2016.

The ICO imposed more than a million pounds worth of penalties for nuisance calls and text messages in 2015, with the same amount in the pipeline for early 2016.

The fines included:

  • £295,000 of fines for companies offering call blocking or nuisance call prevention services
  • A £80,000 fine to a PPI claims firm that sent 1.3million text messages
  • A £200,000 fine to a solar panels company that made six million nuisance calls
  • A £130,000 fine to a pharmacy company that was selling customer details to postal marketing companies

Total fines related to nuisance marketing in 2015:

  • £400,000 fines for nuisance texts (Help Direct UK Ltd; Oxygen Ltd; UKMS Money Solutions Ltd)
  • £575,000 fines for nuisance calls (Direct Assist Ltd; Point One Marketing Ltd; Cold Call Elimination Ltd; Home Energy & Lifestyle Management Ltd (HELM); Home Energy & Lifestyle Management Ltd;  Nuisance Call Blocker Ltd; Telecom Protection Service Ltd)
  • £130,000 fine for selling customer records for marketing (Pharmacy 2U Ltd)
  • £30,000 fine for sending marketing email (Telegraph Media Group Ltd)

Total: £1,135,000. 

Andy Curry, ICO Enforcement Group Manager, said:

Nuisance marketing calls frustrate people. The law is clear around what is allowed, and we’ve been clear that we will fine companies who don’t follow the law. That will continue in 2016. We’ve got 90 ongoing investigations, and a million pounds worth of fines in the pipeline

The ICO received around 170,000 concerns in 2015 from people who’ve received nuisance calls and texts, a similar number to the previous year (2014: 175,330). PPI claims prompted the most complaints, followed by accident claims. Areas identified as emerging sectors for nuisance calls and texts included call blocking services, oven cleaning services and industrial hearing injury claims.

The following are examples of complaints showed the level of distress that calls can cause:

Telecom Protection Service:

“I was recovering from major surgery at the time and the call caused me distress. The caller was very smooth talking and did not make it clear that he was selling a commercial service that was nothing to do with the TPS. The call was frankly misleading.”

HELM:

“I am receiving daily updates regarding a friend in hospital, and am expecting the worst. When these calls come in I expect it to be from the hospital.”

Cold Call Elimination:

“This company has ‘conned’ my mother out of £84.99 for an unnecessary service … my parents are 87 and 86 respectively; my father is suffering from dementia.”

“I am looking after my elderly mother who has terminal cancer. She initially answered and I could see I needed to intervene as I could hear the sales guy not giving up. I took the phone and asked him who he was and what he wanted. He got quite annoyed that I had intervened and I told him we were not interested.”

Point One Marketing:

“Very upset and angry that my mum, who has dementia, was talked into giving credit card details when it would have been obvious to the caller that she had dementia. This caused my mum distress because I had to explain why her debit card had to be cancelled and what she had done. This has caused both of us great distress. Had I not checked her call log and … the number that had called her I would not have known it had happened at all.”

Utilities Oil Gas Risk Infograph

PCI SSC revises date for migrating off vulnerable SSL and early TLS encryption

Following significant feedback from the global PCI community and security experts, the Payment Card Industry Security Standards Council (PCI SSC) has announced a change to the date that organizations who process payments must migrate to TLS 1.1 encryption or higher.

The original deadline date for migration, June 2016, was included in the most recent version of the PCI Data Security Standard, version 3.1 (PCI DSS 3.1), which was published in April of 2015. The new deadline date, June 2018, will be included in the next version of the PCI Data Security Standard, which is expected in 2016.

Early market feedback told us migration to more secure encryption would be technically simple, and it was, but in the field a lot of business issues surfaced as we continued dialog with merchants, payment processors and banks,” said Stephen Orfei, General Manager, PCI SSC. “We want merchants protected against data theft but not at the expense of turning away business, so we changed the date. The global payments ecosystem is complex, especially when you think about how much more business is done today on mobile devices around the world. If you put mobile requirements together with encryption, the SHA-1 browser upgrade and EMV in the US, that’s a lot to handle. And it means it will take some time to get everyone up to speed. We’re working very hard with representatives from every part of the ecosystem to make sure it happens as before the bad guys break in.

Some payment security organizations service thousands of international customers all of whom use different SSL and TLS configurations,” said Troy Leach, Chief Technology Officer, PCI SSC. “The migration date will be changed in the updated Standard next year to accommodate those companies and their clients. Other related provisions will also change to ensure all new customers are outfitted with the most secure encryption into the future. Still, we encourage all organizations to migrate as soon as possible and remain vigilant. Staying current with software patches remains an important piece of the security puzzle

In addition to the migration deadline date-change, the PCI Security Standards Council has updated:

  • A new requirement date for payment service providers to begin offering more secure TLS 1.1 or higher encryption
  • A requirement for new implementations to be based on TLS 1.1 or higher
  • An exception to the deadline date for Payment Terminals, known as “POI” or Points of Interaction.

Merchants are encouraged to contact their payment processors and / or acquiring banks for detailed guidance on upgrading their ecommerce sites to the more secure encryption offered by TLS 1.1 or higher.

PCI Security Standards council announces 2016 special interest group election results

The Payment Card Industry Security Standards Council (PCI SSC), has announced the election results for its 2016 Special Interest Group (SIG) project. 

Special Interest Groups are community-led initiatives that address important security challenges related to PCI Security Standards. One new Special Interest Group is selected every year, but groups may run for more than 12 months in order to complete the agreed-upon goals. 

PCI member organizations, including merchants, financial institutions, service providers and associations, voted on five proposed Special Interest Group topics submitted by their peers. The winning topic selected for 2016 was, “Best Practices for Safe E-Commerce 

The new Special Interest Group is slated to kick off in January 2016

The Council invites PCI member organizations and assessors interested in getting involved in this SIG project to register on the PCI SSC website by 4 January 2016.  

The community choose from among five strong proposals, so it was certainly not an easy decision,” said Jeremy King, International Director, PCI SSC. “We are encouraged by how many Participating Organizations were involved in the submission and election process this year. SIGs continue to be an excellent vehicle for putting their expertise to work to improve payment card security globally

 

How to Hack a Car – an infograph

How a Car Hack Attack Is Happening [Infographic]

how-car-hack-attacks-are-happening-infographic-large

Originally posted on Coinspeaker, here.

Are British Businesses over confident about the threat of data breaches?

Ilex International have launched their Breach Confidence Index. The Index is a benchmark survey created to monitor the level of confidence that British businesses have when it comes to security breaches. The Index shows high confidence levels

  • 24% of IT decision makers surveyed very confident
  • 59% fairly confident that their business is protected against a data security breach

The Breach Confidence Index raises major concerns for British businesses. Businesses are not currently required to report security breaches and in many cases, may not even know that they have experienced one. The survey found that 49% said their business has not experienced a security breach. In comparison to actual statistics shared at the 2015 Cyber Symposium, there is a major gap between the perception and reality of security breaches among businesses.

According to the survey the most common weaknesses resulting in a Data Breach were
22% MALWARE VULNERABILITIES
21% EMAIL SECURITY
15% EMPLOYEE EDUCATION
12% CLOUD APPLICATIONS
12% INSIDER THREATS
8% ACCESS CONTROL
8% BYOD OR MOBILE ACCESS
6% NON-COMPLIANCE TO CURRENT REGULATIONS

Weaknesses relating to identity and access management considerably increase as organisations expand their workforce. Some of the most common issues highlighted by large businesses include:

  • 44% insider threats
  • 42% employee education
  • 26% access control
  • 24% BYOD or mobile access

All figures in the Ilex International Breach Confidence Index, unless otherwise stated, are from YouGov Plc. Total sample size was 530 IT Decision Makers. Fieldwork was undertaken between 6th – 12th August 2015. The survey was carried out online.

DataMotion_IG4_BriefHistoryofHCDataBreaches_092915

500 European Business Leaders attend the PCI Security Standards Council Community Meeting

This week business leaders and security professionals gathered in Nice, France to discuss payment based security and especially PCI DSS and P2Pe. 

Jeremy King PCI Security Standards Council International Director said, The new European Commission Payment Services Directive 2 along with the European Banking Authority Guidelines for Securing Internet Payments have clear and detailed requirements for organisations in protecting cardholder data. Add to that the soon to be released General Data Protection Regulation which covers all data security, and you have a massive increase in data security, which when implemented will impact all organisations in Europe and beyond, 

These regulations will force organisations to take security seriously, and PCI provides the most complete set of data security standards available globally. Establishing good data security takes time and effort. Organisations need to know these regulations are coming and put a plan in place now for ongoing security

With 70% of all card fraud coming from Card-Not-Present (CNP), a figure that surpasses the previous 2008 record which was set during the EMV chip migration, it is a critical time for the industry. 

A significant amount of the conference was spent on new and developing technologies including::

  • Cloud – Daniel Fritsche of Coalfire presented on Virtualisation and the Cloud
  • Mobile – several presentations including the Smart Payments Association
  • Point to Point Encryption (P2PE) – Andrew Barratt of Coalfire delivered a panel discussion
  • Tokenisation – A presentation by Lufthansa Systems 

Jeremy King added. PCI is committed to helping organisations globally improve their data security. Our range of standards, and especially our supporting documents, are designed to help all companies improve and protect their data security. The annual Community Meeting is a big part of our efforts to engage with companies from all sectors, sharing and exchanging information to ensure they have the very best level of security 

We must work together to tackle card-not-present fraud with technologies such as point-to-point encryption and tokenisation that devalue data and make it useless if stolen by criminals.

Attendees included experts from Accor Hotels, , British Telecommunications, Capita, Coalfire Systems Limited, Accor Hotels, Lufthansa, Virgin Trains, Vodat International and hundreds of others.

Blog at WordPress.com.

Up ↑

%d bloggers like this: