The Payment Card Industry Security Standards Council (PCI SSC) has moved to fix the security vulnerabilities in the Secure Sockets Layer (SSL) and early versions of the Transport Layer Security (TLS) protocols, exposed by both Heartbleed and Poodle, with an out-of-band updated release of PCI DSS v3.1.

This latest iteration of the PCI Data Security Standard, however, has split the IT security profession when it comes to just how much protection it is really providing the card holder who shops online.

Mark Kedgley, CTO, on the other hand, explains that "The PCI SSC has mandated the need to remove SSL and early TLS from in-scope systems immediately in PCI DSS V3.1," and nobody would argue that it isn't imperative to remove any dependency on these. However, he tempered that by adding: "The key problem with PCI compliance is that too few have fully embraced the need for continuously operated security best practices," and without closing the loop on vulnerability management, system hardening, change control and breach detection, "there will be always be more ‘Target' breaches."

You can read the full article on SC Magazine here

NNT Products
USA Offices
New Net Technologies LLC
Naples
Suite #10115, 9128 Strada Place
Naples, Florida, 34108
Atlanta
201 17th Street, Suite 300
Atlanta, Georgia, 30363.

Tel: 1-888-898-0674
email [email protected]
UK Office
New Net Technologies LLC
Rivers Lodge
West Common
Harpenden
Hertfordshire
AL5 2JN

Tel: 01582 287310
email [email protected]
Connect
Google+ Linkedin Twitter - Change Tracker Facebook rss feed YouTube
CIS benchmarking SEWP Cybersecurity 500 Sans Institute
Copyright 2017, New Net Technologies LLC. All rights reserved. 
NNT and Change Tracker are registered trademarks of New Net Technologies LLC.
All other product, company names and trademarks are the property of their respective owners.