August | 2007 | Branden R. Williams, Business Security Specialist

PCI Requirement 8, what about Administrator accounts? standard

I had a customer ask me if they had to make the Administrator account/password comply with Requirement 8 of the PCI Standards. Requirement 8 deals with assigning a unique ID to each person with computer access to those systems dealing with cardholder data. Specifically, no generic or shared accounts should be used–especially those that are administrators! The answer is YES, they must comply with the requirements. What does that mean from an operational standpoint? We see customers attack this from various angles. For those corporate systems, they are typically just disabling the Administrator account, and putting special alerting in place to see if it is ever used (as in something bad is happening, go deploy the calvary). In the case ...

WDOCD: Secure Tape Destruction standard

For our VERY FIRST installment of “What Do Other Companies Do” (WDOCD), Randy Smith has asked the following: “What specifications do other companies require for Secure Tape Destruction (especially for older tapes that could have pre-encryption account number data). To my understanding PCI does not provide a specification. What standard seems to be “secure enough” for older tapes potentially with unencrypted data? Do you feel that standard is OK to relax when all the account number data is encrypted?” Excellent question Randy! Virtually every company we work with has some sort of destruction policy for media, and it varies from using a bulk eraser, to pulling out the DeWalt and drilling a hole right through it (yes, one company we ...

What Do Other Companies Do? standard

Well folks, it’s time. Yes, I’ve been running this blog for a whopping month or so, and I just want to see if anyone is reading. So far, the only comments that have been submitted are those for “Biagra” and some “Hot New Penny Stock” that promises to make me rich beyond my wildest dreams. While those are certainly enticing links, I think we could make this much more productive. What I’m looking for is to play a game called “What Do Other Companies Do” (similar to “Spin the Topic Wheel” for any P1s out there). Essentially, I’d like you to email questions to TheSecurityBlog@gmail.com asking how other companies address various security practices. For example, “What do other companies do ...

RSS Feed for this Blog standard

Please use the following link for the RSS feed for this blog. Waiting on the developers to update the one on the bottom left…. http://feeds.feedburner.com/BrandenWilliamsSecurityConvergenceBlog Possibly Related Posts: Top Posts from 2015 October 2015 Roundup September 2015 Roundup August 2015 Roundup June-July 2015 Roundup

More Strategies for Eliminating Cardholder Data standard

Greetings folks. My new article entitles “More Strategies for Eliminating Cardholder Data” has now been published on the VeriSign website. This is an expansion of my previous article which primarily relied on Hashing. Based on clarifications from the card associations, hashing is not a silver bullet (do you know of any that are?) and hashed data is still considered cardholder data. The real risk is that rainbow tables can be created if someone knows how the hash is created. Since the keyspace is so small, the rainbow table creation is rapid. This article expands that and takes a more holistic approach to data elimination and talks about many other strategies. It does not address the culture shift question that someone ...

Knowing Your Data Flows standard

Going to privacyrights.org will clue you into a large cause of data breaches–the stolen laptop. This type of incident is a repeated example of why knowing where data lives in your enterprise is so vital. When we are called into a customer for PCI consulting services, rarely do we see a holistic approach to understanding data flows. There are certainly experts who know their part, and 80% of the time they are right on. But they often lack an over-arching perspective of the data flows, and are unaware of data flows that lie outside of their bailiwick. The level of documentation required for overarching visibility is considerable, but it is also extremely valuable. Imagine being able to see the entire ...

Visa Slows Compliance Acceleration Program’s Penalties standard

eWeek is reporting that Visa has announced it is relaxing the fine and fee deadline of September 30th. Essentially, what this means for non-compliant merchants is that the proposed interchange rate hikes are lessened to simply say that non-compliant merchants will not be eligible for the “best available” tiered interchange rates. However, non-compliant retailers are still facing costs potentially in the millions by not being able to qualify for lower rates during the ever important holiday shopping season. Possibly Related Posts: PCI DSS 4.0 Released plus BOOK DETAILS! PCI Council Loses $600K in Revenue, PO Population on the Decline Why PCI DSS 4.0 Needs to be a Complete Rewrite Orfei Steps Down Should you be a PCI Participating Organization?

Monthly ArchivesAugust 2007