Slashdot Mirror

Being certified compliant with the PCI standards does not ensure that your networks and systems will never be compromised. Data security is not about ticking off items from a checklist. Security is a process of managing your risks and minimizing your losses. Stricter compliance with the PCI requirements may reduce your risk, but certainly won't eliminate it.

The recent massive data breach at Heartland Payment Systems is a case in point. HPA was certified PCI compliant before the breach was discovered. In this case, the attack involved custom malware designed to capture data.

That being said, there has been a wide variation in the quality of QSAs. The PCI Security Standards Council is trying to improve accuracy and reliability among QSAs. They are going to be held responsible for much more detailed analysis of network infrastructure. Even for small networks, a manual assessment of the network device configurations will never be sufficient to ensure that the PCI in-scope network is secure and controlled. We can expect to see QSAs increasingly relying on network configuration analysis tools such as Athena Security's FirePAC and Verify to ensure completeness and accuracy in their assessments.

Being certified compliant with the PCI standards does not ensure that your networks and systems will never be compromised. Data security is not about ticking off items from a checklist. Security is a process of managing your risks and minimizing your losses. Stricter compliance with the PCI requirements may reduce your risk, but certainly won't eliminate it.

The recent massive data breach at Heartland Payment Systems is a case in point. HPA was certified PCI compliant before the breach was discovered. In this case, the attack involved custom malware designed to capture data.

That being said, there has been a wide variation in the quality of QSAs. The PCI Security Standards Council is trying to improve accuracy and reliability among QSAs. They are going to be held responsible for much more detailed analysis of network infrastructure. Even for small networks, a manual assessment of the network device configurations will never be sufficient to ensure that the PCI in-scope network is secure and controlled. We can expect to see QSAs increasingly relying on network configuration analysis tools such as Athena Security's FirePAC and Verify to ensure completeness and accuracy in their assessments.

Although PCI addresses security requirements for payment card processors, passing a PCI audit does not guarantee security. There has typically been a wide variance in the consistency of audits performed by PCI QSAs. There is a lot of room for interpretation of the PCI data security requirements between different QSAs and some may be more strict in their interpretation than others. The accuracy and reliability of the information obtained by QSAs is highly dependent upon their specific audit procedures. I've heard stories of QSAs using very small samples such as two retail locations our of 1,500-store chain.

This is resulting in the PCI Security Standards Council requiring very detailed and complete assessment of network infrastructure and systems to ensure that the PCI in-scope network is truly secure and controlled. The only way to ensure this level of rigor and consistency is to use network configuration analysis tools like Athena Security's FirePAC and Verify products.