Comments on: New PCI DSS is out

By: Nudecybot

Nudecybot — Wed, 13 Sep 2006 21:53:44 +0000

This is good:
“OTOH, once we assume that the numbers are probably open, then we could take the next step of designing it such that the open numbers don’t result in a threat. This we know how to do. This *they know how to do*. What is interesting is why they don’t do it.”
Can anyone answer why this isn’t being done with some level of urgency? Political issues? Intellectual property? Too costly?

By: Duncan

Duncan — Wed, 13 Sep 2006 18:39:04 +0000

Two imporant points
1. For large processors and merchants, the compensating control needs to be approved by the auditor / PCI authority in your region (for us this is VISA), and the track record of these being being approved to date is low. So encryption or masking are effectively still required in the big league. IMHO these large merchants and smaller processors are a major vulnerability in the payment network and it would be a major backward step if this sensible addition of flexibility in the standard is seen as an opportunity to gut the initiative
2. The major threat to compromise remains INTERNAL (either by commision or ommision), not hacking. Masking and encryption is an excellent way of making this data hard to mishandle. The people who say that the use of a data encryption mechanism (and by that I mean the complete cryptographic subsystem including the procedures around key management) does not provide an effective solution to this issue, display their ignorance on the topic. I would agree that I often see cryto misapplied in various ways – but this is not a weakness of the tool, but of the fool using it.

By: Mr. X

Mr. X — Sat, 09 Sep 2006 12:50:40 +0000

I think we are in violent agreement.
My company has had (on quite regular occasion) requests from customers for the disks in our application servers – that simply serve content – to be encrypted. It’s that sort of thinking that I find absurd, that throwing encryption at the problem somehow solves it in a universal way.
Now in the laptop domain, it’s different.
But the idea of compensating controls is very worthwhile, although the phrase “compensating controls” is itself becoming a bit worn, IMNSHO…

By: Iang

Iang — Fri, 08 Sep 2006 20:24:28 +0000

The reason they don’t (require) encrypt the card numbers is because it isn’t practical. There are hundreds of places where it would need to be done, and hundreds of potential exposures.
OTOH, once we assume that the numbers are probably open, then we could take the next step of designing it such that the open numbers don’t result in a threat. This we know how to do. This *they know how to do*. What is interesting is why they don’t do it.

By: adam

adam — Fri, 08 Sep 2006 15:45:00 +0000

Mr X.,
Encryption’s not a panacea, but it’s a very effective way to mitigate a broad class of important risks, which the new criteria miss, including equipment theft, equipment resale with improper sanitization, and backup loss.
Thanks to 1386 and family, we now know that all three of these are reasonably common. We certainly get more reports of them than we get of SQL injection attacks.

By: Adam

Adam — Fri, 08 Sep 2006 15:41:56 +0000

Disk encryption software: $25,000
Backup encryption hardware: $100,000
Putting your customer's privacy at risk because merchants complain: Priceless

By: Mr. X

Mr. X — Fri, 08 Sep 2006 15:19:59 +0000

Makes sense to me. Encryption as a panacea is absurd.