BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

PCI DSS 2.0

Posted September 16, 2010    Brad Hibbert

Yes its PCI time again.

PCI DSS 2.0 has just completed final review and is expected to come out next month. As indicated in the summary of changes document , there are no major changes expected. Refinements to better align standards, provide clarifications, increase merchant flexibility, and additional guidance on specific technologies including virtualization and web applications are expected (For example Requirement 2.2.1 will be clarified to further define the “one primary function per server” as it relates to virtualization).

Some of our customers were anticipating that the PCI severity levels were going to change. In fact, Requirement 6.2 is being adjusted to allow for a risk-based vulnerability assessment process so that those vulnerabilities with the highest ranking are addressed first, versus just patching everything within a 30 day period. This lends itself well to both Retina’s existing risk scoring capabilities and integrated patch module being released next month.

The updated standards are to be issued in final form on October 28th and are to be in effect on Tuesday, January 11, 2011. We continue to wait to see what PCI delivers in the way of details, and will rework our standard PCI reports to align with any changes to the 12 Requirements, shortly after it is released.

As a shameless plug, I should also mention that if you are in need of a PCI Approved Scanning Vendor (ASV), eEye is launching this service to our customers over the next several weeks. If you have the need, just contact our sales team.

Tags:
, , , ,

Leave a Reply

Additional articles

PBPS-screenshot-blog aug2014

Failing the Security Basics: Backoff Point-of-Sale Malware

Posted August 22, 2014    Marc Maiffret

At the beginning of this month, US-CERT issued a security alert relating to a string of breaches that had been targeting Point of Sale (POS) systems. The alert details that attackers were leveraging brute forcing tools to target common remote desktop applications such as Microsoft’s Remote Desktop, Apple Remote Desktop, Splashtop and LogMeIn among others….

Tags:
, , , , , ,

Troubleshooting Windows Privilege Management Rules with Policy Monitor

Posted August 21, 2014    Jason Silva

When defining and testing PowerBroker for Windows rules for production or pilots, customers sometimes tell us, “I don’t think this policy / program is working.” This is usually a case of the policy not properly triggering because of the way the rule was created. A unique feature of PowerBroker for Windows compared to other solutions is a client-side…

Tags:
, , ,
darren-mar-elia

BeyondTrust Webcast: Darren Mar-Elia’s 4 Active Directory Change Scenarios to Track

Posted August 20, 2014    Chris Burd

In our latest webcast, we joined Darren Mar-Elia, CTO at SDM Software, to discuss best practices for Active Directory (AD) change management. Here are some key takeaways from the presentation, followed by a link to a full-length video of the presentation. Mar-Elia kicks things off with a critical insight: that the best AD change management…

Tags:
, , , , , , ,