By now, you may have seen some of the release announcements for RFC 8446, the latest iteration of the TLS protocol known as TLSv1.3. This major overhaul has been a long time in the making, as the Internet Engineering Task Force (IETF) have been working on it for the past five years, and introduces some […]
The PCI Council released a minor update to the Payment Card Industry Data Security Standard (PCI DSS) in May of this year. Their isn’t really anything earth shattering included in these PCI DSS changes, but it’s always worth knowing exactly what changes are made, especially if being PCI compliant affects your business. The changes from […]
Segmentation is not a requirement to meet PCI compliance. However, it is strongly recommended by the PCI Council as it can greatly reduce the cost, scope, and difficulty of meeting compliance. In this blog, we will explore these reasons a bit further and explain the importance of PCI segmentation. What is Segmentation? Segmentation, from a […]
Having performed numerous Reports on Compliance (ROC) for corporations and assisted a myriad of clients with their Self Assessment Questionnaire (SAQ), one thing is apparent to us: companies large and small are having difficulty determining PCI scope for their environment. This can have a profound impact on your compliance. Having the wrong scope can invalidate […]
Among the security testing that PCI DSS v3.2 requires is external penetration testing. External penetration testing is becoming a regular part of security practitioner’s vocabularies, with seemingly every security standard requiring it and any mature security program identifying its importance. The requirements surrounding a PCI external penetration test have some specific nuances that are worth […]
We’ve discussed many of the different kinds of testing that the Payment Card Industry Data Security Standard (PCI DSS) requires previously. Among those requirements for many organizations is segmentation validation testing. Segmentation refers to the either physical or logical separation of portions of the network to prevent unnecessary communication channels. In the case of PCI, […]
Internal penetration testing is a specific flavor of penetration testing that takes place from within your organization’s network. This testing is specifically designed to emulate a malicious insider or an external attacker that gains a foothold on the network. While the concept is pretty straightforward, there are some interesting nuances when you talk about internal […]
A lot of companies, from small businesses to Fortune 500s, have to deal with the Payment Card Industry Data Security Standard (PCI DSS). Depending on your size and business processes, a lot of your work with PCI could simply be verifying that third-party service providers maintain PCI compliance. But we’ve seen that even something so […]
Compliance with the Payment Card Industry Data Security Standard (PCI DSS) can be a daunting task for many organizations. Understanding what’s expected of you can be hard enough, but then deciding on a strategic path forward to reaching a state of compliance and maintaining that posture can be incredibly complex. If you don’t do it right, […]
The Payment Card Industry Data Security Standard (PCI DSS) isn’t the easiest set of requirements to read and understand. Many of the items specified in it are ambiguous or open to a variety of different interpretations. So naturally, many organizations required to meet this standard just want to know what exactly do they need to […]
