PCI DSS Certification - Common Controls Failures

June 09 , 2020

Data breach incidents are becoming incredibly common, and a significant reason behind it is organizations careless in taking necessary precautions in securing their vital network and systems. The revenue loss stats from last year mount up to $24.26 billion let alone due to payment card fraud.

PCI Data Security Standard or PCI DSS as it is abbreviated is a set of technical and operational requirements for any organization that accepts, stores or transmits any cardholder data in a payment processing ecosystem. The standard serves as a guideline for organizations to up their defences and significantly reduce the chances of suffering from any data breach incidents that cost in reputation and revenue.

Read about the PCI DSS standard here.

In a survey taken last week on the most common pain point in the implementation of PCI DSS, 57% of the audience voted for accurately defining the scope for the assessment. These inconsistencies eventually end up in security loopholes that hackers exploit and get their hands on the sensitive card data.

Common Failures in PCI DSS Implementation :

Inaccurate Scoping :

Accurate scoping of the cardholder data environment is necessary. In a survey taken last week on the most common pain point in the implementation of PCI DSS, 57% of the audience voted for accurately defining the scope for the assessment. These inconsistencies eventually end up in security loopholes that hackers exploit and get their hands on the sensitive card data.

Scoping of the cardholder data environment (CDE) will include all the aspects of people, process and technologies that are involved in handling the cardholder data. Organizations reduce the PCI DSS scope by means of network segmentation however, threat actors would be able to enter from a less secure area if the segmentation is done improperly.

Storage of sensitive authentication data (SAD) :
Many organizations unawarely store sensitive authentication data even after authorization. PCI only allows SAD for payment processing, and no data is to be stored post-authorization.

Default System Credentials and Settings :
Post workstation and device setup, default system settings and passwords are mandated to be changed, failing this leaves open doors for the system access for hackers

Outdated Security Patches :
Technology is ever-evolving, and hence any software application has a short life cycle, the one that is sustained by ongoing updates and upgrades. Hence having outdated security patches still running on the system opens considerable risks and vulnerabilities.As per the PCI requirement, it is necessary to keep the system security patches updated.

Poor Encryption Key Management Policy :
Modern cryptographic algorithms, when implemented correctly, are highly resistant to attack – their only weak point is their keys, and the biggest challenge is the efficient utilization of encryption and tokenization.

The value of any cryptographic key is equivalent to the value of all the data and/or assets it is used to protect. It's necessary to adhere to the essential controls regarding Key storage, policy management, authentication and authorization.

Inefficient Log Management :
Insufficient logging has been the bedrock of nearly every major incident. The lack of monitoring and timely response helps attackers to achieve their goals without being detected. Hence it is necessary to ensure that audit trails for all the essential processes like Individual usage with cardholder data, administrative activities, invalid access attempts, tracks of audit log clearings and access restrictions for jobs related.

Insufficient Monitoring Policy :
Attackers rely on the lack of monitoring and timely response, in order to achieve their goals without being detected. Consistent monitoring, regular log review, usage of IDS / IPS, conducting Quarterly vulnerability scan and change detection mechanism are few steps to implement efficient monitoring mechanisms.

Poor Access control policies :
Improper access control policies expose an organization to unauthorized access of data and programs, fraud, or the shutdown of computer services. As an organization's network extends board, external threats become more critical to be considered while implementing security measures.

Failing to address PCI DSS compliance in Quarterly or Semiannual security assessment:
Once PCI DSS certified, organizations tend to fail to continually address the compliance requirements in their quarterly or semiannual security assessments. As a part of business, as usual, it's necessary to flag and investigate any exceptions that occur in the course of daily operations.