Access your Pro+ Content below.
PCI update could mean clarity or confusion
This article is part of the September 2010 issue of Information Security magazine
PCI DSS has become one of the most controversial standards on the books. Many argue that PCI DSS has made great inroads in improving credit card security. Others contend the standard is a distraction from true security, and that the effort is too prescriptive, confusing, and artificially sets the bar for security and compliance too low. This fall, the PCI Security Standards Council is expected release a series of updates to the standard. PCI VIRTUALIZATION AND IN-SCOPE GUIDANCE COMING What can retailers, merchants and others who handle credit card data expect? Most are hoping for a number of updates that will remove perceived overly subjective interpretations, questions of scope and answer long-awaited virtualization security questions. In August, the PCI SSC released a high-level summary of changes to appear in PCI DSS 2.0. A detailed summary and pre-release version of the standard is scheduled for release in September with a final version published Oct. 28. According to Bob Russo general manager, PCI Security Standards Council...
Features in this issue
For the fifth consecutive year, Information Security readers voted to determine the best security products. Nearly 1,500 voters participated this year, rating products in 14 different categories.
The collaborative nature of Web 2.0 introduces myriad threats to data that must be proactively countered.
What you can expect from this fall's update to the Payment Card Industry Data Security Standard.
Tools help protect privacy but safeguarding personal data in the age of Google and Facebook is getting harder.
Columns in this issue
Embedding security in hardware isn't new, but is it worth an $8 billion investment? Time will tell on the Intel-McAfee acquisition.
Targeted attacks on corporations and their crown jewels have become routine. Companies need to be prepared.
Bruce Schneier and Marcus Ranum debate the risks associated with employees using personal computing devices.