BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

PCI-DSS And Least Privilege

Posted August 8, 2011    Peter McCalister

The Payment Card Industry (PCI) Data Security Standard (DSS) is a set of comprehensive requirements for enhancing payment account data security in an effort to thwart the theft of sensitive cardholder information. The core group of requirements is as follows:

-Build and Maintain a Secure Network
-Protect Cardholder Data
-Maintain a Vulnerability Management Program
-Implement Strong Access Control Measures
-Regularly Monitor and Test Networks Maintain an Information Security Policy

On October 28, 2010, the PCI Security Standards Council unveiled version 2.0 of the Payment Card Industry Data Security Standard (PCI DSS). PCI DSS has not had an update since version 1.2 in October 2008. The recent “Summary of Changes” document released by the PCI Security Standards Council (SSC) covers the proposed changes in version 2.0, and as experts expected, few alterations were made between the summary and the final release.

However, one important area to note in the new version is in the PCI DSS Intro and Various Requirements section. In this section, the focus is on virtualization, and though minor, it expands the definition of system components to include virtual components. This addition should alert enterprises to begin assessing their security policies to virtual servers and desktops in their IT environment.

Organizations moving their physical server infrastructure onto virtual platforms for cost savings are finding their virtual hosts and guests are now open to new security and non-compliance risks. Attaining Least Privilege User posture in virtualized desktop and server environments is challenging and customers are consistently forced to make compromises on security in favor of cost-savings.

Remember, the PCI DSS has never been a compliance program. It is a standard baseline for assessing compliance that the five major card brands (Visa, MasterCard, American Express, Discover and JCB) agreed to use as the foundation for their actual, individual compliance programs. At the end of the day, each of the five major card brands still retains final say on compliance and can implement their own compliance requirements over and above the PCI DSS (and PA DSS) when or if they see fit.

Leave a Reply

Additional articles

Dark Reading

2014: The Year of Privilege Vulnerabilities

Posted December 18, 2014    Chris Burd

Of the 30 critical-rated Microsoft Security Bulletins this year, 24 involved vulnerabilities where the age-old best practice of “least privilege” could limit the impact of malware and raise the bar of difficulty for attackers.

Tags:
, , , , ,
dave-shackleford-headshot

Looking back on information security in 2014

Posted December 16, 2014    Dave Shackleford

Dave Shackleford is a SANS Instructor and founder of Voodoo Security. Join Dave for a closer look at the year in security, and learn what you can do to prepare for 2015, with this upcoming webinar. 2014 has been one heck of an insane year for information security professionals. To start with, we’ve been forced…

Tags:
, ,
patch-tuesday

December 2014 Patch Tuesday

Posted December 9, 2014    BeyondTrust Research Team

This month marks the final Patch Tuesday of 2014. Most of what is being patched this month includes Internet Explorer, Exchange, Office, etc… and continues a trend of the greatest hits collection of commonly attacked Microsoft software. Probably the one thing that broke the mold this month is that for once there is not some…

Tags:
,