Device Hardening and Continuous Compliance Monitoring CONTINUOUS COMPLIANCE

The Payment Card Industry Security Standards Council (PCI SSC) has moved to fix the security vulnerabilities in the Secure Sockets Layer (SSL) and early versions of the Transport Layer Security (TLS) protocols, exposed by both Heartbleed and Poodle, with an out-of-band updated release of PCI DSS v3.1.

This latest iteration of the PCI Data Security Standard, however, has split the IT security profession when it comes to just how much protection it is really providing the card holder who shops online.

Mark Kedgley, CTO, on the other hand, explains that "The PCI SSC has mandated the need to remove SSL and early TLS from in-scope systems immediately in PCI DSS V3.1," and nobody would argue that it isn't imperative to remove any dependency on these. However, he tempered that by adding: "The key problem with PCI compliance is that too few have fully embraced the need for continuously operated security best practices," and without closing the loop on vulnerability management, system hardening, change control and breach detection, "there will be always be more ‘Target' breaches."

You can read the full article on SC Magazine here

Share this blog post

Products
USA Offices
New Net Technologies Ltd
Naples
9128 Strada Place
Naples, Florida, 34108
Atlanta
201 17th Street, Suite 300
Atlanta, Georgia, 30363.

Tel: 1-888-898-0674
email USinfo@nntws.com
NNT Logo
UK Office
New Net Technologies Ltd
Spectrum House, Dunstable Road
Redbourn,
St Albans

Herts
AL3 7PR

Tel: 08456 585 005
Fax: 08456 122 031
email info@newnettechnologies.com
Connect with NNT
Google+ Linkedin Twitter - Change Tracker Facebook rss feed YouTube
Sign up to NNT's IT security and compliance monthly newsletter. Get breaking security news, how-to tips, trends and commentary direct to your inbox.

Sign up to the NNT newsletter