Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Common Compliance Hurdles Part 1: Increased PCI Scope

netspi.com | blog | #compliance | #network-segmentation | #firewall | #pci | #pci-scope | #cardholder-data

Summary

Looking over the findings of the last few dozen PCI gap assessments that NetSPI has performed, I am struck by the fact that today, well into version 1.2 of the Payment Card Industry Data Security Standard (PCI DSS, or just DSS), one of our most common findings remains increased scope due to lack of network segmentation.
Published
Collected

original ↗

Related coverage

blog · netspi.com
Firewall Configuration Review
Firewall configuration review is a best practice and a PCI requirement (1.1.6). Misconfiguration is common, and weak segmentation and rule sets often explain why penetration tests succeed.
blog · netspi.com
Where the CISO Reports
Since the role of the Chief Information Security Officer (CISO) and how he or she reports has a major impact on security and risk, I think it’s interesting to look at how different organizations have structured the position. With that said, there is very little consistency other than a correlation with the industry vertical’s understanding of IT risk.
blog · netspi.com
Beyond the PCI Audit: Helping Merchants and Service Providers as a Partner
At the PCI Community Meeting last month in Las Vegas, one thing was abundantly clear – merchants and service providers need help.
blog · netspi.com
Security, Compliance, and the New Retail Economy
As the PCI Community Meeting is set to start tomorrow, I have been thinking about the current state of the retail marketplace and what that means for NetSPI's focus--security and compliance.
research · projectblack.io
Network Segmentation Testing Guide
A PCI DSS network segmentation testing guide: define zones and a traffic matrix, test inbound and outbound flows, and combine host-to-host checks with subnet scans to avoid false negatives.
blog · netspi.com
PCI and the "other wireless"
From the "never been asked that question before" files, I recently had a client who wanted to know about wireless keyboards and whether they are in-scope for PCI.
back