November | 2008 | Branden R. Williams, Business Security Specialist

An upcoming treat! standard

As a preview for next month’s Herding Cats, I decided to take a suggestion from a colleague and turn it into a column. We’re going to explore Hizver’s Insecurity in Large Numbers Theorum! Think you are safe in a crowd? Think again! Think that your company is too small to be noticed or targeted? Danger is afoot! Without ruining the punchline, consider this. Let’s say you work for a large company with a few thousand employees. Each one has at least one Microsoft Windows device assigned to them. Remember the emergency patch from last month? Are you 100% confident that every single last one of those devices was patched? Also, another preview… All previous versions of Herding Cats will be ...

Where to get good PCI Training standard

Yep, it’s been a PCI heavy week. Want me to discuss other topics? T and suggest one! Last week I sat through the Certified Payment-card Industry Security Manager training here in Dallas. The folks at Aegenis planned it at a hotel that happened to be about 10 minutes from my house, so getting there was easy. There were several bigwigs from the information security and PCI industry there with me in the sold out training, and the industry perspectives were valuable. If you are not an employee of a QSAC and are looking for a GOOD source of training around PCI, data breach laws, and a detailed look into the payment industry, this training is for you. If you opt ...

International PCI Compliance Dates Set standard

The day has come! I can’t tell you how many merchants have hounded me for compliance dates outside the US and Canada, and then looked at me like I just told them the sky was red when I could not provide them. Visa, Inc. has formally announced global compliance deadlines (thanks JKA!). If you are a global retailer, or a retailer not based in the US or Canada, the pressure is now on to become compliant with the PCI Standard! Feel free to reach out to a VeriSign QSA if you need assistance! Possibly Related Posts: PCI DSS 4.0 Released plus BOOK DETAILS! PCI Council Loses $600K in Revenue, PO Population on the Decline Why PCI DSS 4.0 Needs to ...

PCI-SSC Releases Data Storage Do’s and Don’ts standard

The PCI Security Standards Council posted a document on Data Storage Do’s and Don’ts this week. This document does an excellent job breaking down the storage piece of PCI for merchants big and small, but especially for the smaller folks out there. Now, for all of you out there, don’t forget that PCI is NOT just a data storage initiative. Just because you don’t store cardholder data does not exempt you from being compliant. That said, locating your data is step one in understanding how you measure up to the PCI Standard. Consequently, it is also step one in VeriSign’s PCI Program Management methodology. How healthy is your compliance program? If it needs work, drop us a line and we’ll ...

Fun with Phishing standard

Here at VeriSign, our email filtering is pretty effective. We have a corporate solution run by Postini (Google) that I am sure processes an amazing amount of SPAM for us. In most cases, one email that I would consider truly SPAM might slip through every couple of months. Not a bad track record. Today one of those messages got through, and I was amazed at what the bad guys doing to try and commit fraud nowadays. I remember several years ago that one effective method to get money out of large corporations was to just send an invoice for a small amount to the Accounts Payable department. Somewhere in the next two months, a check for that amount would show ...

Monthly ArchivesNovember 2008