This page (revision-4) was last changed on 29-Nov-2024 16:16 by -jim

This page was created on 29-Nov-2024 16:16 by unknown

Only authorized users are allowed to rename pages.

Only authorized users are allowed to delete pages.

Page revision history

Version Date Modified Size Author Changes ... Change note
4 29-Nov-2024 16:16 7 KB -jim to previous
3 29-Nov-2024 16:16 6 KB -jim to previous | to last
2 29-Nov-2024 16:16 6 KB -jim to previous | to last
1 29-Nov-2024 16:16 4 KB unknown to last

Page References

Incoming links Outgoing links
Payment Card Industry Data Security Standard
Payment Card Industry Data Security Standard

Version management

Difference between version and

At line 2 changed one line
[{$pagename}] ([PCI DSS]) is a proprietary information security standard for organizations that handle branded [Payment Cards] from the [Payment Card Industry] members.
[{$pagename}] ([PCI DSS]) is a proprietary information security standard for organizations that handle branded [Payment Cards] from the [Payment Card Industry] members.
At line 4 added one line
At line 8 changed one line
Validation of compliance is performed periodically, either by an external [Qualified Security Assessor] ([QSA]) that creates a [Report on Compliance] ([ROC]) for organizations handling large volumes of transactions, or by [Self-Assessment Questionnaire] ([SAQ]) for companies handling smaller volumes.
Validation of compliance is performed periodically, either by an external [Qualified Security Assessor|https://www.pcisecuritystandards.org/assessors_and_solutions/qualified_security_assessors|target='_blank'] ([QSA]) that creates a [Report on Compliance] ([ROC]) for organizations handling large volumes of transactions, or by [Self-Assessment Questionnaire] ([SAQ]) for companies handling smaller volumes.
At line 11 added 18 lines
!! PCI DSS 4.0
The 12 core ([PCI DSS]) requirements did not fundamentally changed and they remain the critical foundation for securing payment card data. However, the requirements have been redesigned to focus on security objectives to guide how security controls should be implemented.
PCI DSS 4.0 aligns with the [NIST.SP.800-63B] for [authentication] and life cycle management. As the payments industry has gradually moved to the cloud, stronger authentication standards to payment and control access logins are necessary. '=
PCI DSS 4.0 considers:
* [Multi-Factor Authentication] ([MFA]) usage for all accounts that have access to the [Cardholder Data], not just administrators accessing the cardholder data environment.
* Passwords for accounts used by applications and systems must be changed at least every 12 months and upon suspicion of compromise.
* Use of strong passwords for accounts used by applications and systems, which must contain at least 15 characters, including numeric and alphabetic characters. PCI DSS requires that the prospective passwords be compared against the list of known bad passwords.
* Access privileges must be reviewed at least once every six months.
* Vendor or [Third-party] accounts may be enabled only as needed and monitored when in use.
The PCI DSS 4.0 standard is built with a [Zero Trust] mindset, permitting organizations to build their own unique, pluggable authentication solutions to meet the data security regulatory requirements. At the same time, authentication methods can scale to fit the company’s transaction objectives and risk environment.
Finally, PCI SSC has partnered with [Europay|Wikipedia:Europay_International], [MasterCard], and [VISA] to implement the use of the [3DS Core Security Standard|https://blog.pcisecuritystandards.org/what-to-know-about-the-new-pci-3ds-core-security-standard] during transaction authorization.
At line 59 added one line
* [PCI Data Security Standard v4.0|https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf|target='_blank'] - Mar [2022|Year 2022]
At line 89 added one line
* [#4] - [!!! What You Need to Know About PCI DSS 4.0's New Requirements|https://www.darkreading.com/edge-articles/what-s-new-in-pci-dss-4-0-for-authentication-requirements-|target='_blank'] - based on information obtained 2022-04-03
This page (revision-4) was last changed on 29-Nov-2024 16:16 by -jimTop