They Don't Sleep at Night - Computer Imps

by Jeff Jilg

I recently saw a neat painting at the 2011 PCI Community Meeting.

The subject of the painting was computer hacking, and the rendering showed a mythical imp with pointy ears. He was bound by cuffs labeled "PCI" and was reading a book on hacking. The artist got it right, and a lot of attendees liked the painting.

Yep, the artist is right. Hackers don't sleep at night. Hackers don't have a time slot to break down computer defenses. They couldn’t care less about when or where the assets are stored. For all they know, they could be hacking into a computer in the same town, or a computer in another country.

And that's the real problem. It's tough to fight such resilient criminals. Technology has made it easy for them to have plenty of potential assets for them to prey upon. The PCI standards do a pretty good job of setting up compliance standards to help stave off the bad guys. As a consumer I feel a bit safer with credit card processing getting more scrutiny.

As many industry pundits have said, "the motivation of the hackers is directly proportional to the assets being protected". atsec supports the PCI standards and atsec is a qualified security assessor company. We like to think we are helping too.

So far I haven't seen any real computer imps. I wonder if they really have pointy ears or not…

atsec Newsletter Published

We published our December newsletter and invite you to take a look. The topics include:

• Highlights of the Changes to the New PCI Standards
  by Jeff Jilg
• Common Criteria Forum Established
  by Andreas Fabis
• 2010 MILCOM Conference Experience
  by Steve Weingart

You can download our newsletter from the atsec website.

PCI announce hilights of V2.0 of PCI Co standards

The PCI Security Standards Council have recently announced the highlights of the proposed version 2.0 of the PCI DSS and the PA DSS. Here is a link to their press release.

The press release gives some pointers about what to expect from the new versions. A supplementary document available here gives more details.

Update for "Payment Card Industry Compliance for Large Computing Systems" white paper

An updated version of our white paper titled "Payment Card Industry Compliance for Large Computing Systems" is available on our website.

atsec presents an analysis of the PCI standards in the context of a LCS environment and provides focused guidance to QSAs and their customers on the PCI assessment of such environments and the resources available to support an assessment. Drawing from an extensive knowledge of mainframe and LCS security, coupled with experience as an accredited QSA company, this report provides the necessary insight into LCS security to QSA and other PCI professionals.

For version 1.1.2 of the document a discussion of two-factor authentication has been added.

- Andreas Fabis

PCI compliance and security breaches...

From David Ochel

There is no such thing as one hundred percent security, at least not in today's IT infrastructures. Any merchant or processor thinking that validated compliance with the PCI Data Security Standard (DSS) makes them immune against any hacking attempt whatsoever, or the liability incurred as a consequence of a breach, needs to realize this. Information security is about managing risks, and the PCI DSS provides a set of security requirements that address many of the most often seen vulnerabilities, and related attacks, in infrastructures that process payment card data. Compliance with the requirements means that an organization has properly implemented a baseline security program that contributes to keeping the overall security risks in the payment card processing world at a reasonable level. It may be reasonable for the industry as a whole to calculate that a few breaches a year, as opposed to hundreds and thousands of them, are acceptable. That doesn't mean that for your organization it is acceptable to risk being one of these few.

Measures implemented in an infrastructure that are fulfilling the PCI DSS requirements may be reasonably suited to address all of the potential IT security risks in an individual organization, or they may not be. The only way to know is to implement a risks-driven IT security practice. Identify, qualify and quantify the information security risks that exist in your specific business and operational environment, and then reduce these risks to a management-accepted level by implementing appropriate security mechanisms and monitoring their effectiveness. A large enterprise with thousands of employees and dozens of branches may determine that the risk of data compromise in their internal network is significantly higher than in a small firm with a dozen co-workers, and act accordingly by encrypting sensitive data on these lines.

Regardless of whether this is required by PCI DSS or not.

Information security needs to be managed intelligently. Compliance with industry and legal requirements that address specific areas of concern needs to be maintained, but this needs to happen in the larger context of managing overall risks in specific environments. Implementing an information security management system that addresses an organization's specific threat situation and protection needs, in combination with maintaining whatever compliance is imposed by third parties on the organization, is the way to go. This is why standards like ISO/IEC 27001, and initiatives like FISMA, not only give you a set of controls, but also require you to perform a risk
assessment on your own. PCI DSS compliance should be a side-effect of good information security management, and not the other way around.