I was at Visa Europe’s QSA Briefing yesterday, and one question that cropped up was whether or not a Concierge style service would bring that Concierge into scope as a Service Provider. By Concierge, I mean an entity that keeps Consumer’s card numbers on file so it can book things like flights or hotels on
Does PCI DSS apply to Corporate Credit Cards? Read More »
Fresh back from the conference, an interesting few days, but still came back with the feeling that I was trying to be sold something.Not a problem if I’m brave enough to head to Infosec 2011 as that’s what you’d expect, but where some people would have paid £975 for a conference ticket I’m not convinced
RSA Conference Europe 2010 Read More »
We’re all hearing a lot about end to end encryption as a security solution for the payments industry at the moment. The message that’s been pushed out is that merchants all need to change their PEDs and introduce more recent, encryption-capable models, so that as soon as card details hit the PED, the PED encrypts
End to end encryption – the panacea for payment security or just another commodity? Read More »
According to Visa, there have now been a significant number of successful attacks against merchants whom use hosted payment pages. A hosted payment page is one that you can embed in your website, but directs all Customer transaction details to a third party – think Datacash, Cybersource et al. Hosted payment pages offer two distinct
Hosted Payment Pages and Merchant Spear Phishing Read More »
I’m sure most of you would have already seen this, namely a document that summarises the upcoming changes to PCI DSS and what’s going to be in Version 2.0: https://www.pcisecuritystandards.org/pdfs/summary_of_changes_highlights.pdf Official pre-release with Participating Organizations will happen early September, with release to Merchants, Service Providers and QSAs at the end of October. Yes, that’s right.
PCI DSS 2.0 has landed Read More »
Visa CodeSure has hit the market. These are cards with built in alpha-numeric displays that allow one-time passcodes to be used in conjunction with a PIN to secure online transactions: The first challenge must be replacing the 1.4bn Visa cards already out there, the second being – will it really work and how long will
Visa CodeSure has landed Read More »
I was setting up an online banking account with Sainsbury’s earlier, and was asked to complete a number of ‘secret questions’ to which ‘only I know the answer to’. One of the questions was ‘what’s the name of your favourite singer?’. Am I missing something, but isn’t this a pretty silly question to ask, bearing
Online Banking Security – a step too far?? Read More »
Even if you bought every product on sale at Infosec this year, your data still wouldn’t be secure, but it still amazes me to find vendors that say that their product alone will solve all your problems. Sigh.
At long last, the standard finally looks like it will mandate that merchants / service providers conduct regular scans for accidental (leaked) and legacy stores of card data on networks. I have long advised this, but always got the kick back from merchants that ‘well, it’s not in the standard so we’re not going to
Data Discovery likely to become mandated in PCI DSS v1.3 / 2.0 Read More »
