The PCI Security Standards Council's proposed revisions for PCI DSS include additional guidance and clarifications to existing requirements in areas such as data discovery and virtualization.
The PCI Security Standards Council released a document Aug.
12 outlining proposed clarifications to be added to the future version of industry
regulations.
The PCI SSC document
highlights several revisions slated to appear in the 2.0 versions of PCI DSS
(Payment Card Industry Data Security Standard) and PA DSS
(Payment Application Data Security Standard). More detailed documentation will
be issued in September, and the new versions of the regulations will be
published Oct. 28. Once approved, the regulations will go into effect in
January.
"This is basically a direct result of feedback ... what
we're seeing in the feedback is the need for, once again, greater clarity on
the requirements," said PCI Security Standards Council General Manager Bob
Russo.
Among the proposals is additional guidance to ensure that all
cardholder data in a business is identified and documented to enable accurate
scoping of the cardholder data environment. This may mean organizations will
have to use technologies such as data discovery tools, Russo said.
"We're specifically concerned with finding all the
credit card holder data wherever it is on the network," he said.
The council is also including additional guidance on
virtualization to update Requirement 2.2.1 to clarify the intent of "one
primary function per server" and the use of virtualization.
"This has been an issue for a while where the standards
were not keeping pace with advances in technology, especially use of
virtualization in a card holder data environment," opined Sumedh Thakar,
PCI solutions manager at Qualys. "The existing standards talk about the
notion of having 'one primary function per server.' In a virtualized
environment this becomes a problem since the environment can be pretty dynamic
and you could have virtual servers with different primary functions, like Web
servers [or] database servers, on the same physical server. This has caused
merchants to hold back on introducing virtualization in their PCI environments
for fear of being deemed noncompliant.
"With the new clarification that will be introduced, we
hope that merchants will be able to simplify their PCI environments and cut
their costs while gaining the benefits of virtualized computing," Thakar
added.
Another proposed revision is to "clarify processes and
increase flexibility for cryptographic key changes, retired or replaced keys
and use of split control and dual knowledge," the council said.
"I think where you'll find the most anxiousness is
around these emerging ... technologies that people are using, chip and
tokenization and point-to-point encryption," Russo said, adding that the
compliance regulations are meant to serve as a baseline for security.
"This is not the ceiling," he said. "This is
the floor. So this is the bare minimum that you should be doing, and any kind
of layers that you can add on top of that in terms of any kind of technologies
like tokenization or point-to-point encryption ... certainly make it stronger and
certainly improve your security posture."
Email
Print
