Changes to PCI Data Security Standard leave questions unanswered
PCI DSS 2.0 mostly about minor tweaks, analysts say
Computerworld - A new version of the PCI Data Security Standard scheduled for release later this year is likely to attract more attention for what it leaves unaddressed rather than what it changes, analysts say.
That assessment is based on a preview of proposed changes to the standard that was released today by the PCI Security Standards Council, the body that administers the Payment Card Industry Data Security Standard (PCI DSS).
The preview suggests that most of the changes in PCI DSS 2.0, which is scheduled for release in October, are going to be incremental in nature and unlikely to cause major headaches for companies covered by PCI.
Much of the emphasis in the new version appears to be on fleshing out and clarifying existing guidelines rather than on introducing new ones.
But the new standard appears to leave largely untouched several issues where companies are looking for more guidance from the PCI council, analysts said.
"The standard's revisions seem like a positive step and don't seem to impose a lot of extra work and unreasonable requirements on complying organizations," said Avivah Litan, an analyst at Gartner.
"But what is glaringly lacking is progress on the hard and most important issues, including the implications of adopting alternative technologies" on PCI compliance requirements, she said.
According to Litan, many Gartner clients are trying to understand whether their adoption of new technologies such as chip cards, tokenization and end-to-end encryption will limit the scope of their compliance requirements, Litan said.
But most of the clarifications around such issues have been left for special interest groups to figure out, she said. "These SIGs are not being held to any particular deadlines, and it's still unclear how their reports will fold into PCI requirements," she said.
The PCI Security Standards Council's guidance around virtualization technologies is another area that is going to be closely watched, said James Paul, senior vice president of delivery at Trustwave, which provides PCI assessment services for many of the largest retailers in the country.
"Overall, there are no big surprises here. There is certainly nothing in the proposed list that our clients will have a lot of heartburn addressing," Paul said.
Today's preview indicates that the new standard will offer new guidance on how the use of virtualization technologies will impact PCI compliance requirements, he said. But a lot will depend on the amount of detail that is provided in the new version of the standard, he added.
"I'm encouraged that they are giving some additional guidance around virtualization," Paul said. "But we just can't get enough concrete details fast enough."
Many Trustwave customers want to know today if their use of virtualization technologies will increase the scope of their PCI requirements, he noted. "It's an emerging technology. There are a lot of questions around it," Paul said. "There are a lot of people somewhat hesitant to dive into it until they see some guidance."
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts