×Close

Request to Republish Content

Within the next two months, the PCI Security Standards Council will release version 3.2 of its PCI Data Security Standard to require that all administrators with access to card data networks use multifactor authentication.

The new requirement is needed right now because breaches are prevalent, and merchants need clarification about what is expected of them, says Troy Leach, chief technology officer of the council.

But the council is baking in compliance time, he adds, likely giving merchants 18 months to comply with the new requirements. And has yet to announce what the new requirements actually are, he adds.

"As with all of our new requirements, there will be a long sunrise date, so people can make the right investment and prepare their networks for that additional security requirement," Leach says during this interview with Information Security Media Group.

The compliance date for implementing administrator-level multifactor authentication, he says, will be published within the standard.

"We'll make that announcement very shortly," Leach says. "But we basically want to emphasize that the change is for administrators that are going to have a higher privilege within the card data networks, which would allow them to possibly change systems and other credentials within that network that could compromise security of the environment. So, we are looking at any type of administrator, whether it be a third party or internal, that would have the ability to change privileges to create new access and new ways that people could route cardholder data."

The release of this newest version comes early, says Leach adds - the council typically issues its newest PCI DSS version every three years during the fourth quarter of the third year.

Encryption Updates a 'Must-Have'

Another reason for the new version of the standard, he says, is to ensure the industry is aware that it has more time to comply with new encryption requirements that were announced at the end of last year (see PCI Council Extends Encryption Deadline).

The original compliance date for a transition from SSL [Secure Sockets Layer] encryption was June 2016. Now, under the requirements of 3.2, the compliance date is not until 2018, he says.

SSL is an outdated encryption protocol, which the National Institute of Standards and Technology and other standards bodies have already said organizations should be moving away from, Leach explains.

"But we recognize that there are some business challenges and technical challenges within the financial industry, where we needed to extend that date further," Leach adds. "And so one of the reasons that we have an early release, rather than the expected November 2016 release [for the update to the DSS], is to accommodate that time between now and June."

Still, many organizations may not be aware that the compliance date has shifted, he says.

During this interview (link above), Leach also discusses:

Why the PCI DSS is now considered to be a "mature" standard, which requires fewer new requirements; How the migration to EMV in the U.S., as well as merchants' investments in tokenization and end-to-end encryption, swayed the council to include fewer new card security requirements in version 3.2; and What businesses should be doing to prepare for the new multifactor authentication and encryption requirements to come in the updated version of the DSS.

As part of his role with the council, Leach partners with council representatives, PCI participating organizations and industry leaders to develop comprehensive standards and strategies to secure payment card data and the supporting infrastructure. He is a congressional subject-matter expert on payment security and is the current chairman of the council's Standards Committee. Before joining the PCI Council, Leach held various positions in IT management, software development, systems administration, network engineering, security assessment, forensic analytics and incident response for data compromise.

Breach Notification , Breach Response , Data Breach

Inspector General Identifies 724,000 Taxpayer Accounts Being Exposed Eric Chabrow (GovInfoSecurity) • February 27, 2016    

The Internal Revenue Service, for the second time since August, has revised upward the number of accounts victimized in its Get Transcript breach, with the tax agency saying the personal information from as many as 724,000 taxpayers accounts may have been stolen.

See Also: Unlocking Software Innovation with Secure Data as a Service

Following a nine-month review, the Treasury Department's inspector general for tax administration discovered an additional 390,000 taxpayer accounts possibly exploited by the attack on the Get Transcript system, the IRS said Friday.

When first discovered in May, the IRS identified 114,000 breached accounts (see IRS: 100,000 Taxpayer Accounts Breached ). In August, the IRS upped that number to 334,000 accounts (see IRS: Hack Much Wider Than First Thought ).

In addition the IRS says hackers unsuccessfully targeted an additional 295,000 taxpayer transcripts, bring that number to 570,000.

The IRS says it will begin on Monday notifying new victims, including those whose accounts were attacked but not breached. "The IRS is committed to protecting taxpayers on multiple fronts against tax-related identity theft, and these mailings are part of that effort," IRS Commissioner John Koskinen said in a statement. "We are moving quickly to help these taxpayers."

The IRS says IG investigators identified suspicious email addresses that made multiple attempts to access accounts. The IRS says it's possible that some of those identified may be family members, tax return preparers or financial institutions using a single email address to attempt to access more than one account. In an abundance of caution, the IRS says it will notify all affected taxpayers.

The IRS launched Get Transcript in January 2014 to allow taxpayers to view and download their tax transcripts or have them mailed to their addresses. Since discovering the breach, the IRS suspended Get Transcript's online viewing and downloading features.

Cybersecurity competitions are being adapted so employers can use them to vet the know-how of prospective employees.

"A competition is the way to demonstrate that you actually have the abilities," says Karen Evans, national director of the U.S. Cyber Challenge.

The U.S. Cyber Challenge, working with business partners through its CyberCompEx social network portal, is formulating mini-cybersecurity challenges that can be used to test job applicants; it will pilot them in the coming months.

The U.S. Cyber Challenge was created in 2010 by the Center for Strategic and International Studies, a Washington think tank, with private-sector support, including the SANS Institute. Through competitions and training camps, the U.S. Cyber Challenge aims to encourage mostly young people to consider careers in cybersecurity. Its competitions have involved teams that compete to accomplish a task, such as using hacking skills to gain access to a protected database. (Here's an ISMG-produced video of one such competition: Searching for the Good Hacker).

In an interview with Information Security Media Group (click on player beneath image to listen), Evans discusses:

How employers can tap databases of cybersecurity competitions to identify prospective employees; and Plans to pilot mini-competitions that employers can use to evaluate the skills job candidates offer

A report published by the Council on Cybersecurity - now part of the Center for Internet Security, which operates the U.S. Cyber Challenge and the Multistate Information Sharing and Analysis Center - says many recruiters find competitions to be a good indicator of cybersecurity talent.

Evans has led the U.S. Cyber Challenge since its formation more than six years ago. She is the former administrator for e-government and information technology in the White House Office of Management and Budget, a position that today is known as the federal CIO. In her 28 years of federal government service, she served as the CIO of the Department of Energy. Before joining the Energy Department, Evans served as director of the Information Management Division with the Justice Department's Office of Justice Programs.

Cybersecurity

Apple vs. FBI: Readers Debate Questions: Privacy, Surveillance, Plus Legal and Moral Culpability Mathew J. Schwartz (euroinfosec) • February 24, 2016    

Who's right: Apple or the FBI?

See Also: 2015 Breach Preparedness and Response Study: The Results

Debate continues to rage over a magistrate judge last week ordering technology giant Apple to unlock the iPhone of Syed Rizwan Farook, who participated in the December 2015 shootings in San Bernardino, Calif., that left 14 people dead and 22 seriously injured (see The Crypto Debate: Apple vs. the FBI).

A recent Pew Research Center survey of 1,002 U.S. adults found that 51 percent believe Apple should assist the FBI and 38 percent do not, citing the need to secure individual's data (see Apple, FBI Escalate Crypto Fight).

The debate is complicated, in part, because the case involves not just technology and legal questions, but also more emotionally loaded discussions of public safety and what the FBI has categorized as a terrorist attack.

In their comments on many of our recent pieces - including Apple, FBI Draw Lines in Crypto Battle, The Crypto Debate: Apple vs. the FBI and DOJ: Apple Puts Marketing Before Law - our readers continue to debate what's at stake and how Apple should respond.

Thou Must Obey Court Orders

"Nothing should be beyond the realm of a judicial approved court order," says Hollis Segur. "That is what our justice system is built on. ... You give up your privacy when you break the law. ... I would boycott all Apple products if Tim Cook does not allow this to happen and it must happen quickly."

Another reader voices a similar perspective, citing Apple's moral culpability: "Does the [manufacturer] have the right to protect criminals, who cause serious harm to our society?" the anonymous reader asks. "Maybe Apple should answer to the relatives of the ones who were gunned down in cold blood that they believe in protecting criminals and don't give a damn about the rest of us."

Hackers Heart FBI Victory

But Steve Sommers cautions that if the case results in mandated crypto backdoors, innocent people would suffer. "Not only will governments have free access to your private data, it'll be big beautiful and juicy low hanging fruit for hackers to attack and exploit," he says in a story comment. "I'm absolutely sure hackers are hoping for a quick FBI legal victory in this case so they can get cracking."

Or as another ISMG reader, Bon Baughn, puts it: "Apple isn't protecting criminals. They are protecting you."

Keep Surveillance in Context

Meanwhile, information assurance consultant William Murray, who's an associate professor at the U.S. Naval Postgraduate School, accuses the government of attempting to compel technology giants to give them carte blanche access to devices by "making them appear to side with terrorists and criminals if they refuse." Lost in that discussion, he warns, are the surveillance capability advances governments have gained in recent years. "Even without backdoors, the investigative capability of law enforcement, not to mention the surveillance capability of the nation state, is orders of magnitude greater than anything they might have hoped for as recently as a decade ago," he says. "They are never satisfied" (see Why 'Cryptophobia' Is Unjustified).

Backdoors Hurt Investigations

Turning the tables on the FBI, meanwhile, another reader suggests that the current order would in fact make life more difficult for friendly law enforcement agencies. "The reality is that law enforcement shoots itself in the foot if this government order stands" says Greg - no last name listed - who cautions that if the bad guys know that the good guys can bypass iPhone crypto, they'll seek other, harder-to-crack tools, be they smartphone-based or otherwise. "Next time, the bad guys won't use commercial stuff for encryption. There are plenty of other ways to do it and bad guys are not constrained by the same rules as the good guys."

White House Weighs In

There are no easy answers in this debate, with the FBI saying Apple must comply with a lawful order, while Apple argues that this creates a dangerous legal precedent.

The clash was perfectly encapsulated - perhaps unintentionally - by White House Press Secretary Josh Earnest during a Feb. 22 briefing, when he was asked to comment on this matter. "The administration believes - and the President has said this personally - ... the American people benefit from robust encryption that protects their privacy and civil liberties [and] that ... is a protection that's worth supporting," he says. "At the same time, our law enforcement and national security professionals have an obligation to keep us safe and to do what they can to keep us safe."

Easy Answers? No Way

Even the technology sector appears divided. Microsoft founder Bill Gates has supposedly backed the FBI in this case, Financial Times reports, although Gates on Feb. 23 told Bloomberg that he was "disappointed" with that report, saying that the right balance needs to be struck. But other technology CEOs - including Facebook CEO Mark Zuckerberg, Google CEO Sundar Pichai and Twitter founder Jack Dorsey - have publicly backed Apple CEO Tim Cook's move.

Whatever happens, don't expect any quick answers. With Congress out to lunch on the cybersecurity front, the courts may resolve these questions, although legal experts say this case might well require two years to reach its conclusion.

×Close

Request to Republish Content