[Autogenerated] in this final module,
I'm going to take a quick look at some of the things you
should consider when planning your transition from pc IDs s
version three to version of four.
Here's a reminder of what I think are the big changes in the standard.
Ones that will need a project to implement them.
If they're applicable in your environment,
organizations need to build cryptographic inventories and conduct
annual risk analysis for their cryptography and if they're currently
using disk or partition encryption to meet the requirement that pan
should be unreadable when stored.
They need to change that for file or other types of encryption.
TLS certificates need to be inventoried and always validated.
There needs to be technical controls to minimize the risk of users clicking on
links in phishing emails and users need to be trained about phishing attacks
and how to report them to the information security team for organizations
taking payment via e commerce channels.
New controls are required to both prevent and to
detect JavaScript skimming attacks.
Thinking now of identity and access management,
there are many new requirements relating to system and application
accounts and multi factor authentication now becomes a requirement for
anyone accessing the cardholder data environment.
Not just administrators, log files now have to be analyzed automatically,
but I guess everyone is doing that.
And finally internal vulnerability scans need to be authenticated.
Each of these new requirements could be a big project in your own
organization depending on the size and the complexity of your organization
and whether you're already doing some of these things Now.
Remember these are all new requirements so they don't come into
force on one April when version four is the only version that
standard you can be assessed against.
They come into force for assessments on or after one April 2025.
Now I don't know when you're taking this course,
so I don't know if one April 2025 is a long way in the future or
maybe tomorrow if it feels like the distant future.
My question is,
do you think your organization can meet all of these new
requirements in the time that you have?
So the first thing I'd recommend is that you do an initial impact
assessment that aims to answer a simple question,
what would we need to do to have this requirement in place?
And there are three parts to the answer,
how much money would it take,
what resources will be needed and how long will it take because in
many cases capital expenditure will be required.
And the capacity for changing an organization is
often planned and limited each year.
So you may only be able to start some projects to implement these new
requirements in the next budgetary or the next change cycle,
which then leads me to a discussion on the scope of pea
seeds in your organization as a consultant.
Whenever I'm asked to work with an organization's pc IDs compliance.
The first thing I do is work out whether I can help the organization to
reduce the number of systems people and processes that the Pc IDs
requirements apply to because there's going to be a cost and some work
to add all these new requirements in version four to your existing Pc
IDs s scope and therefore I would really encourage people to first of
all look at the scope,
there is nothing in pc IDs for that should change the
current scope of systems people and processes that have to
meet the Pc IDs s requirements.
But before making the investment in any technology to
meet all these new requirements,
I would work out if it would be cheaper to use other technical solutions such
as tokenization encryption with good key management or outsourcing to reduce
the number of systems people and processes that have to comply with the Pc IDs
requirements because in my experience reducing scope is always cheaper than
adding more security controls to your existing environment and because you
reduce the attack surface,
it makes you more secure while we are thinking about implementation timescales,
I know often when pc IDs exchanges version many organizations look to
move the date of their next annual assessment so that they complete
their last assessment on the old version as near as possible to the
retirement of the old version,
Meaning that they have almost another 12 months before their
assessed against the new version And in the case of DSS four
that will be two years and until assessment looks for those new
future dated requirements.
While this is an understandable tactic, it's not without some danger.
Firstly, the retirement date for PCISS version 3.2.1 is not negotiable.
So if your assessment runs over and it's not unusual for
assessments not to finish when they're supposed to,
if your assessment runs over,
you will have to be assessed against the new version of the standard,
which you probably won't be ready for.
I mean There are only 30 new requirements,
but there are lots of small clarifications and so it's not going to be
simple to be just assessed against version four.
If you haven't prepared secondly, from a security perspective,
you should probably have all the future dated requirements in place.
Now, if you're processing large amounts of cardholder data,
the longer you wait to put these new requirements in place,
the more vulnerable you are to an attacker because as we know,
Attackers favor attacking organizations that have
worse security than their peers.