Decoding the top 5 cybersecurity risks of generative AI

  The newly released PCI DSS 4.0 has introduced a series of transformational changes to its requirements, testing methods, and validation processes. The newly incorporated customized approach is one of the most futuristic changes in the standards, offering flexibility for organizations that decide to use different methods to achieve security objectives. This flexibility has been integrated into the frequency of certain requirements through the targeted risk analysis. The customized approach provides organizations with an option to design innovative controls that address evolving threats and technologies and support meeting the security objectives of PCI DSS requirements. With two approaches (stated below) included in PCI DSS 4.0, organizations can choose either or both by determining what best suits their security implementation and validation processes. Defined Approach: The defined approach follows the traditional methods to implement the requirements and testing procedures as st...

  At a glance The Payment Card Industry Data Security Standard ( PCI DSS ) is an information security standard for organizations that handle branded credit cards from the major card schemes. SISA helped VIDIVA achieve compliance with PCI DSS standards. VIDIVA Technology JSC, Vietnam A major technology company VIDIVA Technology JSC (henceforth called VIDIVA), a service provider in Vietnam delivering card issuance and e-wallet functions for its customers, was embarking on a large full potential transformation with a pipeline of new products. To get there, VIDIVA developed an in-house Mobile Application (iOS and Android) known as “Ting” to deliver its services. This mobile-only financial platform that complemented VIDIVA’s existing business in mutually beneficial ways was in the scope of PCI DSS assessment. Assuring strong payment security foundations A window of opportunity opened when the team at VIDIVA realized that facilitating the e-wallet functions, card issuance, and maintenanc...

  Companies must pay attention to 5 most common control failures, or it will become challenging for them to be compliant to PCI DSS. Failure to maintain PCI DSS compliance could lead to fines, imposed business restrictions, and rejection of credit card processing facilities. Unfortunately, many companies have not had sufficient time to pressure-test their security controls against all PCI DSS requirements. Based on our experience of implementing PCI DSS across the globe, these are the common controls of PCI DSS that most companies have failed to achieve. Requirement 1.1.3.a: Establish a diagram that shows all cardholder data flows across systems and networks It is of utmost importance for businesses dealing with cardholders’ data to be aware of the locations where the data resides. However, most businesses have failed to do so only because a lot of payments card data remains unmanaged and uncategorized, dispersed across multiple databases of an enterprise. As truly  mentioned ...

  Investing in PCI DSS awareness training equips employees with the knowledge and understanding necessary to protect cardholder data. By educating employees about the importance of data security, organizations can empower them to make informed decisions and take proactive measures to mitigate risks. In today’s digital age, securing payment card data is of utmost importance, especially given the increasing frequency and complexity of cyberattacks. It’s here that the Payment Card Industry Data Security Standard (PCI DSS) comes into play. The PCI DSS is a set of security standards designed to ensure that all businesses that accept, process, store or transmit credit card information maintain a secure environment. However, achieving and maintaining this standard is no small task, requiring consistent awareness and education. This is where the need for organizations to invest in PCI DSS awareness training arises. The role of employees in PCI DSS Compliance While organizations invest heav...

  At a glance The Payment Card Industry Data Security Standard ( PCI DSS ) is an information security standard for organizations that handle branded credit cards from the major card schemes. SISA helped VIDIVA achieve compliance with PCI DSS standards. VIDIVA Technology JSC, Vietnam A major technology company VIDIVA Technology JSC (henceforth called VIDIVA), a service provider in Vietnam delivering card issuance and e-wallet functions for its customers, was embarking on a large full potential transformation with a pipeline of new products. To get there, VIDIVA developed an in-house Mobile Application (iOS and Android) known as “Ting” to deliver its services. This mobile-only financial platform that complemented VIDIVA’s existing business in mutually beneficial ways was in the scope of PCI DSS assessment. Assuring strong payment security foundations A window of opportunity opened when the team at VIDIVA realized that facilitating the e-wallet functions, card issuance, and maintenanc...

  The newly released PCI DSS 4.0, with substantial changes after six years, launched on 31st March 2022. The new standards aimed at enhancing the security of systems involved in processing, storage and transmission of cardholder data were developed after three Request for Comments (RFCs) and 6,000+ feedback from more than 200 companies. While the 12 core  PCI DSS  requirements remain fundamentally the same, several new requirements and alterations address the evolving risks and threats to the payment data and reinforce security as a continuous process. This article is the first in a series of opinion pieces that we will be publishing on the changes to the PCI DSS 4.0. The narrative below focuses on key changes made to the PCI standards driven by the evolving risk landscape and a range of new payment environments, technologies, and methodologies. It also discusses the significant measures that payment organizations can undertake to implement the necessary controls, maintai...