I was featured in the article by SC Magazine below!
Target Breach Aftermath – Is PCI Compliance a “Tick Box” Exercise?
PCI compliance was called a ‘gold standard' and ‘secure baseline' at a conference in London today, but not all believe that it does enough to guard against data breaches.
Mckinlay was largely upbeat on the changes, saying that business awareness had grown substantially over the last eight years, a time when some companies would not be pushing PCI or even IS27001 compliance.
He applauded recent changes to PCI DSS 3.0, including incident response, monitoring and network segmentation, and said that the standard essentially acted as a ‘secure baseline' for protecting debit and credit card details.
But Whitelegg was keen to point to the Target data breach as evidence that compliance alone isn't sufficient.
Target met PCI compliance in September 2012 but the panellists noted a “few alarm bells” such as the lack of network segmentation between the card data and the rest of the corporate network, little incident response and no two-factor authentication for remote access.
With this likely have resulted in a drop-off in compliance over the course of the year, the panellists agreed that PCI must be a “continuous state of operation.” “It has to be hit all the time,” said Whitelegg.
Not that the companies – or associated third-parties as was the case in the Target breach – are entirely to blame, the panel admitted. One member of the audience quizzed Holman on whether qualified security assessors (QSAs) should be more evidence-based in their investigations, and the 2-sec CEO admitted that QSAs largely rely on trusting people to tell them the truth.
“Compliance relies on people telling the truth,” said Holman, a QSA himself. “But evidence-based audits take a hell of a lot longer for bigger vendors, and if you're not in a position to do that [companies] will go for a cheaper QSA.”
What should companies be doing to get ahead with PCI compliance? The panellists said that they must put together incident response plans, ensure data is being encrypted and treat PCI compliance as a “continuous exercise”. Mckinlay added that there would a ‘lot less problems' if security was driven top-down from the board.
Taken from SC Magazine on http://www.scmagazineuk.com/target-breach-aftermath-is-pci-compliance-a-tick-box-exercise/article/349691/