Experten aus dem binsec-Universum
The current version 3.2.1 and the newer version 4.0 of the security standard PCI DSS require penetration tests to be performed. The PCI standard establishes detailed requirements a penetration test needs to comply with. In PCI DSS 3.2.1, the requirement is regulated in…
On July I wrote a blog post about the modified Requirement 6.6 in PCI DSS 3.0 . I am not going into the details again, it’s sufficient to say that the new standard allows to operate a WAF in monitoring only mode without blocking requests: That was a very strange change in PCI…
Today I was working on a presentation about PCI DSS 3.0. Since a major client of me is an international payment service provider doing credit card transaction, I am quite familiar with PCI DSS 2.0. I have already read the new Standard a few months ago, but today I stumbled about…
As a rule, every company that forwards, stores, or processes credit card data or cardholder data in any other way must comply with PCI DSS. This refers in particular to the full PAN (Personal Account Number), i.e. the…
Recently I again accompanied the audit for a client and brought it to a successful close. I would like to take this opportunity to stress how important the right approach to the QSA is. In some (maybe many?) companies the QSA is seen as the enemy, he is the…
To get through audits successfully and as quickly as possible, you need a good auditor with a lot of experience in the security field who does not shy away from technical discussions. an internal person responsible who knows PCI DSS, understands it and has sufficient…