Revisions to credit card security standard on the way

Network World - It will be called the Payment Card Industry Data Security Standard 2.0, and the full-blown text of this upcoming standard that governs how businesses must guard sensitive cardholder information on their networks will be out at the beginning of September, according to the organization in charge of it.

Would PCI compliance help or hurt cloud computing security?

There won't be major changes from the current DSS 1.2, according to Bob Russo, general manager of the PCI Security Standards Council. But DSS v. 2.0 will seek to clarify what the PCI requirements mean in terms of enterprise security.

Most prominent will be new recommendations related to the process in PCI assessment known as "scoping" to determine where sensitive cardholder data exists so that specific portions of the network are subjected to the PCI data-security standards. The problem today is that too often businesses handling cardholder data don't really know where it's going, Russo says.

"They'll say, 'we found data on the most obscure parts of our network, we had no idea it was there,'" Russo says. "We need some methodology to find cardholder data." Recommendations for that will include data-loss prevention technologies or discovery tools to find cardholder data, Russo says.

Virtualization has also been a somewhat contentious question over the years with debate about whether DSS Section 2.2.1, for example, which calls for only one primary function per server, might discourage use of virtualization for PCI data.

"There's certainly no ban on using virtualized environments," Russo says. While PCI DSS 2.0 will seek to add more clarity on the virtualization question, more in-depth discussion is expected in a separate guidance document to come out next year.

Another hot topic has been end-to-end encryption for PCI cardholder data, with some calling for industry-wide adoption to ward off further cyberattacks aimed at stealing massive amounts of payment-card data.

But the council doesn't plan to draw a line in the sand on that one at this point.

"We're not going to recommend anyone doing anything," Russo says. "If you add more security layers to that, it's a good thing." However, the upcoming 2.0 standard could include guidance on how use of end-to-end encryption could satisfy already-existing PCI requirements.

One thing the council is mindful of is trying not to load up new requirements that compel businesses to spend more money. "We can't tell people to spend money on the technologies," Russo notes.

The council remains in the awkward situation of being considered an immediate source of contact for opinion on what constitutes suitable security to meet with PCI compliance, even though vendors called qualified security assessors (QSA) have been certified to do the actual audit for compliance. (One estimate puts the cost of a full-blown annual PCI compliance audit at $225,000.)