Branden R. Williams, Business Security Specialist

Five things to do for PCI during the freeze standard

IT and security professional that work in the retail and banking space tend to go into lock down during the last half of November, all of December, and the first part of January. We’re all saying our little prayers, and doing whatever rituals we do to keep those systems running worry and breach free until the cash flows come back to normal. So what kinds of things can you do to be productive and prepare for 2011? Get on those quarterly scan results! Hopefully you got a clean scan right before the freeze happened, so you could spend this time planning for your next one to ensure you have clean execution and quick remediation for any items found. Examine data ...

New PCI Services from EMC/RSA standard

EMC Corporation, in conjunction with EMC Consulting and RSA, announced expanded consulting services to assist companies with PCI Compliance, as a subset of our larger GRC and Information Security initiatives. The three new services are: PCI Program Strategy and Implementation – Organizations leveraging this service not only remedy their PCI compliance issues, but develop a security and compliance program that is aligned with business objectives. New services offered include program development and management, design of strategic frameworks for PCI program, assessment and development of processes and best practices, and PCI training to security teams, data owners, key stakeholders, and internal audit team. PCI Readiness Assessments – This service evaluates an organization’s current PCI DSS posture and helps develop a remediation ...

Herding Cats December, Brave Old World standard

Have you checked out ISSA Connect yet? The next issue is up there with my column, Brave Old World. This one is all about bucking the trend, going against the grain, swimming up stream, and any other number of clichés that you might want to use. Much of what we are doing today is done without thinking strategically first—especially with respect to compliance initiatives like PCI DSS. If you are a member, log into ISSA Connect and join the discussion! Interact with great professionals globally as well as the authors that you enjoy reading every month. If you are not a member, sign up today!

Physical Security begets Infosec Problems standard

Have you ever noticed how the things we do in the electronic security world mirror the things we do in the physical world? We deploy firewalls at our network perimeter like we put fences near our property lines. We make rules in firewalls to allow certain traffic through just like we have guards that allow authorized parties access to physical assets. In the physical world, visible security controls could take the form of an employee with a badge or a visitor that is escorted. It’s remarkably similar. But what about the bad side of security? You know, those dumb things that smart people do to cause incidents? Most corporate networks are incredibly flat and operate more like a university and ...

November 2010 Roundup standard

What was popular in November? It was all about PCI 2.0 in November, I cooked for #BSidesDFW (check out my apron), and we discussed mixed-mode virtualization with respect to PCI DSS! Look for some fun PCI stuff this month as well! Here are the five most popular posts from last month: PCI DSS 2.0 Release and Review. For the second month in a row, this post took the number 1 spot. This one is two years in the making, and the next one won’t happen for three more years. I threw together a few notes along with links to the document. Scoping Fun with PCI DSS 2.0. How do you know what you need to do for PCI DSS unless ...

What about Mobile Payments? standard

Thanks to a reader who gave me an idea for a blog post! You can suggest your own topics here. Mobile payments means a lot of things to a lot of people. Is it paying for things with that fancy iPhone app? Is it a Wi-Fi or cellular linked payment terminal? Is it paying for things with your cell phone using either an SMS-based payment or a Near-Field Communication (NFC) transaction? For the purposes of this post, I want to focus solely on SMS-Based or NFC transactions that would originate from the buyer’s cell phone. AT&T, T-Mobile, and Verizon announced last week the formation of ISIS, a mobile payment network that looks to capitalize on the per-transaction revenue that can ...

Happy Thanksgiving, and Travel Tips! standard

First off, Happy Thanksgiving to everyone! If you are traveling today, here are a few tips that have served me well over the years. Read your airline’s policy on carry-on bags (size and weight) BEFORE you pack Carry everything on if you can Convert large liquid toiletries into small travel sizes for your trip Ship anything bulky or any large quantities of liquids instead of bringing them on the plane Research the airport layout and probable location for your departure gate so you know exactly where to go, how to get there, and nearby food and drink options If you are not checking a bag, check in online the day before (within 24-hours of departure) and ensure your seat selection ...

PCI SSC Releases 2.0 Versions of SAQs standard

Man, I’m falling into the EMC culture nicely. It’s an acronym laden Friday (INSANE IN THE MEMBRANE)! Last night I received an email from the PCI SSC PR team about the new Self-Assessment Questionnaires. You can get them here. While they were not released on the same day as the 2.0 version of PCI DSS, they were quickly ushered out the door. Kudos to the Council for getting these done in a timely manner! I know I’ve had NUMEROUS questions from the 7+million merchant community that deals with SAQs over the last three weeks on the pending release of these. One of the biggest adjustments to the SAQ process is the recognition (or segmentation maybe) of the virtual terminal. If ...

Silverado Wrap standard

It takes a massive tortilla to make a Silverado Wrap, but here’s a recipe on how you do it. First, start with a blogger. Next, give the blogger a 2011 Chevrolet Silverado. Finally, wrap it up in a giant tortilla with some videos, blog posts, Twitter and Facebook comments, and enjoy! Here’s what we got when I was the key ingredient above (blogger): The Silverado Extended Cab… uh… CAB! How big is this thing? CHeck out the kids in the back! Being a Good Samaritan. Calling OnStar is not only for when you get in a crash! See how I used it to call in a road hazard. Off to the Fair! We loaded up the kids and headed down ...