Tuesday, September 29, 2009
PCI DSS Update Could Include Virtualization Security
PCI Virtualization Special Interest Group (SIG) is drafting guidelines and a mapping tool for applying PCI to virtualized systems
By Kelly Jackson Higgins, DarkReading
Sept. 25, 2009
URL:http://www.darkreading.com/story/showArticle.jhtml?articleID=220200260
The PCI Data Security Standard (PCI DSS) is due for an update next year, and the upcoming version of the standard could define securing cardholder data in virtualization environments.
The PCI Virtualization Special Interest Group (SIG), made up of auditors, vendors, merchants, banks, and quality security-assessment firms, this week met to hash out a proposal for how to include virtualization technology in PCI. The group is working on proposed changes to the DSS, as well as guidelines for how to map virtualization to the existing PCI spec.
"Because DSS does not even mention virtualization, there have been a lot of questions about how it applies, whether it can be used for PCI, and what areas are not in-scope," says Kurt Roemer, a member of the PCI board of advisers, chief security strategist for Citrix, and a member of the PCI DSS board of advisers. "We're addressing these questions."
The group is putting the final touches on a white paper and mapping "tool" document that explains where virtualization applies within each requirement of the DSS. "We're not out to replace or change PCI," Roemer says. Instead, the group is providing "an information supplement and additional guidance" for making virtualization environments PCI-compliant.
Roemer says the group is gathering additional input for proposed changes to the DSS. It will deliver the information to the PCI Standards Council, which meets in January to begin the process of building version 1.3 of the standard, due in October 2010. At this point, all of the proposals are basically a supplement to PCI, and it's up to the council to decide whether the spec itself is updated to include virtualization.
This is the latest effort in expanding PCI to incorporate emerging technologies. The PCI Security Standards Council (PCI SSC) recently unveiled best practices for retailers to defend themselves against the growing number of credit- and debit-card skimming scams, and in July a council working group created a set of recommendations for wireless deployment for PCI.
Mark Weiner, managing partner of virtualization vendor Reliant Security and a lead author of the PCI virtualization white paper, says companies and auditors have had to make their "own assumptions" in the absence of official PCI guidelines for virtualization. "That illustrates the need for this work," he says.
The hot topics are virtualization of point-of-sale (POS) systems and electronic commerce, Weiner says. "This is becoming hotter as retailers try to use virtualization for the cost benefit," he says. Ecommerce has raised issues, such as segmentation and the role of the hypervisor with cardholder data.
Among some of the technical issues are segmentation of the network, encryption, and how the presence or absence of virtualization will affect PCI compliance, says Richard Rees, security solutions director for SunGard Availability Services and a contributor to the PCI virtualization working group. "Answering questions -- such as, are all virtual machines on the same hypervisor as cardholder data VMs in scope, does virtualization violate the 'one primary function per server' tenet, and do virtual switches and virtual security appliances truly segment virtual environments on the same hypervisor -- are all things we are looking to the PCI Council, technical working group, and virtualization SIG to help answer," Rees says. "At this point, that's open to the interpretation of each QSA. "
And physical security with cloud computing is another tricky area that's under discussion. PCI DSS has specific requirements and audits for physical security. "If you're outsourcing part of your environment with cloud computing and don't understand their physical security, or can't get access to local controls, you're still obligated to protect [the cardholder data]," Rees says.
Tuesday, September 15, 2009
Heartland on Defense at Senate Hearing
The ranking member of the Senate Homeland Security and Governmental Affairs Committee told the chief executive of Heartland Payment Systems that she was "astonished" a breach of the company's information system lasted for nearly 1½ years without being detected.
At a panel hearing Monday on protecting industry against growing cyber threats, Sen. Susan Collins, R.-Maine, asked Heartland CEO Robert Carr to explain how this delay happened. Carr responded that a breach is usually detected when the processing payer is notified of fraudulent use of cards, and that didn't occur until the end of 2008.
"Isn't there software in the systems to detect such a breach?" Collins asked.
"There is, and the cyber criminals are very good at masking themselves," Carr replied. "To be able to scan systems to determine what the malware is, you have to understand something about the attack vector, and you need to know something about the malware to find it. All of us in the industry go through annual assessments, but the bad guys are working together to get around all those assessment."
Carr told the panel Heartland is taking two major steps to prevent this type of breach to reoccur. Working through the Financial Services Information Sharing and Analysis Center, Heartland and other payment processors established Payments Processing Information Sharing, a forum for sharing information about fraud, threats, vulnerabilities and risk mitigation practices.
Continue reading at..
France to vote on new piracy bill
The French National Assembly will vote on Tuesday to decide whether to allow the authorities to cut illegal downloaders off from the web.
The hard-line policy has drawn worldwide attention as nations around the globe grapple with the issue of piracy.
An earlier version of the bill was ruled unconstitutional and a compromise version has been hammered out.
The legislation is backed by President Nicolas Sarkozy.
The proposed legislation operates under a "three strikes" system. A new state agency would first send illegal file-sharers a warning e-mail, then a letter and finally cut off their connection if they were caught a third time.
While it is backed by the film and record industries, consumer groups have warned that innocent people may get punished.
The European Parliament is currently considering whether cutting off internet access is a breach of human rights.
In the UK, Business Secretary Lord Mandelson has been widely credited with seeking a tougher line on UK piracy laws.
The British government is proposing a tougher stance which could include cutting repeat offenders off from the net.
Wednesday, September 2, 2009
DataLossDB Report: 38000 records containing SSN lost
http://datalossdb.org/incidents/2317-missing-laptop-contains-names-social-security-numbers-and-dates-of-birth-of-38-000
Missing laptop contains names, Social Security numbers and dates of birth of 38,000
Subscribe to:
Posts (Atom)