PCI gives 14 months to fix high risk SSL problem

The Payment Card Industry Security Standards Council (PCI SSC) has moved to fix the security vulnerabilities in the Secure Sockets Layer (SSL) and early versions of the Transport Layer Security (TLS) protocols, exposed by both Heartbleed and Poodle, with an out-of-band updated release of PCI DSS v3.1.

This latest iteration of the PCI Data Security Standard, however, has split the IT security profession when it comes to just how much protection it is really providing the card holder who shops online.

Mark Kedgley, CTO, on the other hand, explains that "The PCI SSC has mandated the need to remove SSL and early TLS from in-scope systems immediately in PCI DSS V3.1," and nobody would argue that it isn't imperative to remove any dependency on these. However, he tempered that by adding: "The key problem with PCI compliance is that too few have fully embraced the need for continuously operated security best practices," and without closing the loop on vulnerability management, system hardening, change control and breach detection, "there will be always be more ‘Target' breaches."

You can read the full article on SC Magazine here