Brian Pennington
A blog about Cyber Security & Compliance
About Brian Pennington
Cyber Security Statistics
FedRAMP
Merchants are complacent about PCI DSS, report reveals.
Verizon have launched their 2011 Payment Industry Compliance Report which draws on their experiences as a QSA company and previous annual reports.
Extracts from the report are below.
Unchanged from last year, only 21 % of organizations were fully compliant at the time of their Initial Report on Compliance (IROC). Verizon commented with "This is interesting, since most were validated to be in compliance during their prior assessment".
Organizations met an average of 78% of all test procedures at the IROC stage
20% of organizations passed less than half of the DSS requirements
60 % scored above the 80 % mark
Organizations struggled most with the following PCI requirements:
3 (protect stored cardholder data)
10 (track and monitor access)
11 (regularly test systems and processes)
12 (maintain security policies).
The PCI Requirements showed the highest implementation levels were:
4 (encrypt transmissions over public networks)
5 (use and update anti-virus)
7 (restrict access to need-toknow)
9 (restrict physical access)
Organizations do not appear to be prioritizing their compliance efforts based on the PCI DSS Prioritized Approach published by the PCI Security Standards Council even less so than in the previous year.
A mini-study comparing governance practices to the initial compliance score suggests that the way organizations approach compliance significantly factors into their success.
Once again, organizations that suffered data breaches were much less likely to be compliant than a normal population of PCI clients. Analysis of the top threat actions leading to the compromise of payment card data continues to exhibit strong coverage within scope of the PCI DSS. For most of them, multiple layers of relevant controls exist across the standard.
In the pool of assessments performed by Verizon QSAs included in this report
21% were found fully compliant at the completion of their IROC
This is just 1% less than in their last report, and effectively the same number
The lack of change is a disappointing, as many in the industry were hoping to see an increase in overall compliance as the PCI DSS became more familiar to an increasing number of organizations.
79% of organizations were not sufficiently prepared for their initial assessment
Having established that only 21% "passed the test" the next question becomes "what was their score?"
On average, organizations met 78% of all test procedures defined in the DSS at the time of their IROC.
Down 3% from Verizon's last report; but again, the difference is nominal.
Therefore, the baseline set by the PCI DSS must not reflect the baseline set by the companies themselves. For most organizations, to achieve compliance they must do things they were not previously doing (or maintaining).
Another common Achilles heel of merchants and service providers in the PCI assessment process is over confidence
"It was painful, but we made it through last year, so this year should be a breeze"
is a typical sentiment with which many organizations approach the yearly assessment. That can be a costly mistake. When the QSA arrives on-site, a mere 1/5th of businesses are found to be compliant, even when given the extra time between the on-site visit and completion of the IROC.
Complacency and fatigue are two additional drags that make maintaining compliance year over year difficult. Too many businesses approach PCI from the point of view that "what was good enough last year will be good enough this year." But unless someone's been babysitting a process, such as documenting and justifying all services allowed through the firewalls, things can easily be forgotten in the haste to get business done.
When examining the percentage of organizations passing each requirement at the IROC phase.
Some requirements show percentages dipping below 40%, while others exceed the 70% range.
Six of the twelve show an increase over last year, and the average is up two points.
However, the average number of test procedures met within each requirement is down 4%.
None of these numbers is indicative of a clear change given the size and makeup of the dataset, but it certainly reinforces the notion that
organizations continue to struggle (at varying degrees) in all areas of the DSS.
How do organisations perform against the 12 Requirement? The four highest rated Requirements are:
4 (encrypt transmissions)
5 (AV software)
7 (logical access)
9 (physical access)
Requirement 10 (tracking and monitoring) boasted the highest gain+13 %
Requirement 5 (AV software) may lose its place in the top three, which is an odd development, since AV software has for so long been among the most basic and widespread of security controls.
Requirement 4 (encrypt transmissions) showed a marked improvement which may indicate that administrators are deciding it's easier to direct all Internet traffic containing credit card data over SSL.
Requirement 7 (logical access) showed a slight improvement, which could mean more strict attention is being paid to who is given access to cardholder data.
Requirements 3 (stored data) and 11 (regular testing) are once again in the bottom tier, while Requirement 12 (security policies) ousted 10 (tracking and monitoring) from the bottom. This suggests that the encryption of data at rest continues to be a major headache for organizations, especially the more detailed portions, such as annual key rotations.
Requirement 11's low showing reminds us why 'set and forget is a very bad bet' should be a core mantra of the security profession. The fact that security policies rank among the lowest of the low is not a good sign since policy drives practice.
Requirement 1 remains virtually unchanged since last year, at 44% compliance, compared to the 46% in the last report. Only 63% of companies met Requirement 1.1.5 regularly
Compliance is the continuous state of adhering to the regulatory standard. In the case of the PCI DSS there are daily (log review), weekly (file integrity monitoring), quarterly (vulnerability scanning), and annual (penetration testing) activities that an organization must perform in order to maintain this continuous state of compliance
The entire report can be found on the Verizon web site here.
Cyber Criminals Shifting to Smaller, More Opportunistic Attacks; External Attacks, Especially Hacking, on Rise
Verizon have released their Data Breach Investigations Report 2011 and as usual with the Verizon report there is a lot to take in.
The investigations by Verizon and the U.S. Secret Service discovered that data breaches had dropped from 144 million in 2009 to only 4 million in 2010, representing the lowest volume of data loss since the report's launch in 2008.
The percentage of internal breaches fell massively from 49% to 16% which the report claim is due to the large increase in external attacks rather than a fall in internal breaches.
Key results from the 2011 report shown in the Verizon press release are below:
Focus on essential controls. Many enterprises make the mistake of pursuing exceptionally high security in certain areas while almost completely neglecting others. Businesses are much better protected if they implement essential controls across the entire organization without exception.
Eliminate unnecessary data. If you do not need it, do not keep it. For data that must be kept, identify, monitor and securely store it.
Secure remote access services. Restrict these services to specific IP addresses and networks, minimizing public access to them. Also, ensure that your enterprise is limiting access to sensitive information within the network.
Audit user accounts and monitor users with privileged identity. The best approach is to trust users but monitor them through pre-employment screening, limiting user privileges and using separation of duties. Managers should provide direction, as well as supervise employees to ensure they are following security policies and procedures.
Monitor and mine event logs. Focus on the obvious issues that logs pick up, not the minutiae. Reducing the compromise-to-discovery timeframe from weeks and months to days can pay huge dividends.
Be aware of physical security assets. Pay close attention to payment card input devices, such as ATMs and gas pumps, for tampering and manipulation.
Verizon Recommendations for Enterprises
Large-scale breaches dropped dramatically while small attacks increased. The report notes there are several possible reasons for this trend, including the fact that small to medium-sized businesses represent prime attack targets for many hackers, who favor highly automated, repeatable attacks against these more vulnerable targets, possibly because criminals are opting to play it safe in light of recent arrests and prosecutions of high-profile hackers.
Outsiders are responsible for most data breaches. Ninety-two percent of data breaches were caused by external sources. Contrary to the malicious-employee stereotype, insiders were responsible for only 16 percent of attacks. Partner-related attacks continued to decline, and business partners accounted for less than 1 percent of breaches.
Physical attacks are on the rise. After doubling as a percentage of all breaches in 2009, attacks involving physical actions doubled again in 2010, and included manipulating common credit-card devices such as ATMs, gas pumps and point-of-sale terminals. The data indicates that organized crime groups are responsible for most of these card-skimming schemes.
Hacking and malware is the most popular attack method. Malware was a factor in about half of the 2010 caseload and was responsible for almost 80 percent of lost data. The most common kinds of malware found in the caseload were those involving sending data to an external entity, opening backdoors, and keylogger functionalities.
Stolen passwords and credentials are out of control. Ineffective, weak or stolen credentials continue to wreak havoc on enterprise security. Failure to change default credentials remains an issue, particularly in the financial services, retail and hospitality industries.
Download the report here
Brian Pennington Tweets
The latest Brian Pennington's InfoSec Review! paper.li/bfpennington/1… #security #ceh 14 hours ago
The latest Brian Pennington's InfoSec Review! paper.li/bfpennington/1… 1 day ago
The latest Brian Pennington's InfoSec Review! paper.li/bfpennington/1… Thanks to @CyberKrisann #cybersecurity #infosec 2 days ago
The latest Brian Pennington's InfoSec Review! paper.li/bfpennington/1… Thanks to @SleimanSkaf #cyberattack #un 3 days ago
#CES2021 Microsoft's Brad Smith slams #SolarWinds 'indiscriminate assault' bbc.co.uk/news/technolog… 4 days ago
#Furlough #fraud: I'm still registered as furloughed for a job I quit' bbc.co.uk/news/business-… #HMRC 4 days ago
The #password guess worth $240m in #Bitcoin bbc.co.uk/news/technolog… 4 days ago
What happens when #AI has an overactive imagination? bbc.co.uk/news/av/techno… 4 days ago
The latest Brian Pennington's InfoSec Review! paper.li/bfpennington/1… Thanks to @dustinbessette #cybersecurity #databreach 4 days ago
Coalfire #Federal among First C3PAOs Authorized to Perform CMMC Audits washingtonexec.com/2021/01/coalfi… #C3PAO #CMMC… twitter.com/i/web/status/1… 4 days ago
NHS doctor 'receives 20 to 30 abusive messages a day' bbc.co.uk/news/av/uk-eng… #NHS @BBCNews 4 days ago
Why A Risk Register Is Important for Cybersecurity Leaders securityboulevard.com/2021/01/why-a-… 5 days ago
Why Red Team Testing Rules the Cloud securityintelligence.com/posts/red-team… #redteam #PenTest 5 days ago
The latest Brian Pennington's InfoSec Review! paper.li/bfpennington/1… #cybersecurity #security 5 days ago
Follow @bfpennington
THE HISTORY AND FUTURE OF PASSWORDS – Infographic
The OWASP IoT Project Top 10
21 Significant 21st Century Data Breaches – Infographic
Infographic: How to solve the cybersecurity talent gap in your organization
11 Cyber Security Questions Every Small Business Should Ask