Month: August 2021

12 requirements of the PCI DSS Compliance

Posted on by admin

Electronic payments are all over the world today, owing to the convenience of time and effort it gives to the users. From small vendors to big corporates, are all offering card payments as an alternative payment method to augment their selling opportunities. Nevertheless, a user’s card information is sensitive and to process this information is attached with risk and accountability. Securing this personal data from thefts and frauds is the duty of merchants as per PCI DSS. (Payments Card Industry Data Security Standards). PCI DSS intends to reduce the risk of card fraud and increase the security controls for cardholder data.

What is PCI DSS?

Information relating to Credit cards is extremely vulnerable, as data thefts have turned predominant now. Credit card theft is the second most common type of theft and the amount of fraud by new credit card accounts saw a 48% increase from 2019.

The  PCI DSS  is a compliance standard set for data security requirements concerning the handling, storing, or transmission of cardholders’ data. Leading card brands Visa, MasterCard, American Express, Discover and JCB collaborated to form PCI SSC which is an independent council that maintains and updates PCI standards.

To whom does it apply?

PCI DSS applies globally to all big and small merchants, also the service providers who store, process, or transmit cardholder information. PCI necessitates card holder data, sensitive authentication data to be made compliant by the companies and maintained as merchants use such data. If a payment card carries the logo of any of the above-said PCI’s founding card brands, it must be protected as per PCI DSS.

Requirements of PCI DSS Compliance

PCI DSS is your roadmap to card data security compliance by fulfilling the 12 requirements listed in the standard. Following are the 12 Requirements under PCI DSS for card data securitization.

  • Step 1) Install and maintain a firewall configuration to protect cardholder data– Firewalls are the first line of defence against hackers, so have the firewall and routers configured properly. This firewall must set the rules to what kind of traffics can be allowed inside your corporate network
  • Step 2) Do not use vendor-supplied defaults for system passwords and other security parameters – Remove Vendor supplied default settings for all software, network devices, and servers. Using default settings, usernames and passwords are simple to guess putting access to the device at risk. Upgrade your settings for all devices and maintain documentation for these high-security configurations
  • Step 3) Protect stored cardholder data- Use ‘encryption key management process’ to encrypt card data and protect the encryption keys also. It requires creating a Card Holder (CHD) Flow to document how the cardholder data flows in the organization. PCI demands the use of discovery tools to locate and secure unencrypted PAN and other vulnerable data.
  • Step 4) Encrypt cardholder data transmitted across open, public networks – This step focuses on securing the data in transmission. As the hacker’s eye on the data on the transit, PCI requires encryption of data before transmission.
  • Step 5) Protect all systems against malware and regularly update anti-virus software or programs – Install anti-virus on all hardware and software devices. Make sure that the anti-virus does continuous monitoring and generates logs on a regular basis.
  • Step 6) Develop secure systems and applications – Conduct a thorough risk assessment to implement processes for deployment of technology. It is important to update and patch internet browsers, applications, databases, firewalls, POS terminals, and OS in the card flow path within a month of its release.
  • Step 7) Restrict cardholder data on a need-to-know basis – This step requires having a role-based access control (RBAC). It allows access to card holder’s data only to individuals who need it for business purposes, through keycards and passcodes.
  • Step 8) Identify and authenticate access to system components – This PCI DSS step requires, every individual user to have a separate and unique password and username. Group and shared passwords must never be used. This step helps to trace back the activity in the event of an internal data breach.
  • Step 9) Restrict physical access to cardholder data – PCI DSS directs to have electronic monitoring of entry-exit of file storage and data center locations. These video recordings must be preserved for 90 days and there needs to be a process to identify between employees and visitors.
  • Step 10) Track and monitor all access to network resources and cardholder data – This step mandates monitoring and protection of all network systems with a clear history of activities. These activity logs must be centrally monitored daily, time-synchronized, and maintained for 1 year at least.
  • Step 11) Regularly test security systems and processes – Due to the constant eyeing of cybercriminals, PCI requires merchants to have a continuous process and system testing. Create plans for vulnerability scanning and penetration testing as specified by PCI DSS.
  • Step 12) Documenting and maintaining risk assessments – This step involves creating, maintaining, and implementing a security policy for the company covering its employees, management, and third parties. The policies must be reviewed annually as well.

Consequences of Non-compliance

Theft or breach of card data badly affects the entire payments ecosystem. Here are a few consequences one may have to face for non-compliance with PCI standards.

Penalties – PCI DSS non-compliance can result in penalties from the card companies. Fines depend upon the volume of payments handled by the merchant in question. Penalties may vary from $ 50 per cardholder and peak up to a total of $100,000 per month. The bigger companies that operate with volume frequently get audited for PCI Compliance and they may decide to levy penalties in case of non-compliance.

Revenue loss and damaged reputation -Due to data breach, there can be loss of trust among customers which can lead to loss of credibility and personal fallouts. The business that is lost is the largest consequence of data breach. It is extremely hard to recover from data breaches because the losses get greater than the data itself in such scenarios and impacts organizations for years.

Legal action – Even though PCI DSS is not a legal requirement, in an event of data breach, the affecting parties can take legal action. In 2007, $40.9 M was compensated by TJX for exposing 100 million card holders’ information.

How to Make PCI Compliance Easy and Cost-Effective?

Here we are trying to burst the mythos that  PCI Compliance  can be stressful, expensive, and time-consuming. These are a few things that make sure that your budgets are not hit hard for ensuring compliance.

  1. Install patches and updates regularly to avoid technology and additional staffing costs on the security team.
  2. Train the development team on secure coding best practices. This will reduce much vulnerability from the start and reduce remediation costs.
  3. Keep up with the changing PCI standards. In case you fall short of complying with the latest standards, reassessments are required. Reassessments involve audits which are further time-consuming and expensive.
  4. Send your key personnel on Compliance training courses so that they can understand the most relevant risks that apply to your organization. This further reduces reassessment and audit costs.

QRC as a leading PCI Qualified Security Assessor Company

Being a PCI QSA, QRC helps businesses to highlight gaps in their compliance posture whether it is a SAQs Assessment or the complete  PCI DSS certification, supporting end-to-end in compliance journey with complete confidence.

As a certified PCI Qualified Security Assessor Company, QRC can certify your organization and process for PCI DSS compliance. We also offer other PCI security standards like  PCI 3DS,  PCI SSF  etc. QRC provides these services to give organizations across the globe an edge of being a completely security compliant business organization. Our security assessment services cover all aspects of the technology infrastructure (Web, API, Network, Cloud Assets, Servers)that has helped our clients to streamline data security processes and practices over the years.

Everything you need to know about ISO/IEC 27001

Posted on by admin

This article is part of our ISO 27001 risk assessment  hub page, where we bring together detailed resources on certification, implementation, controls, and compliance. If you are new to ISO/IEC 27001, this guide will help you understand what the standard is, why it matters, and how it helps organizations build a reliable Information Security Management System.

Everything you need to know about ISO/IEC 27001 Certification

ISO/IEC 27001 is an international standard for the management of information security, where ISO stands for International Organization for Standardization. ISO/IEC 27001 is the go-to rule book if you are looking to set up a strong Information Security management system for your organization.

It provides a systemized set of policies and process flows to be used by organizations. The ISMS prescribed by ISO/IEC 27001 helps organizations to protect their information system, irrespective of how big they are and which industry they belong to.

ISO/IEC 27001 Certification : Planning, Process, and Main sections

To be eligible for an ISO/IEC 27001 certificate, a company must succeed in the audit conducted by an accredited certification body. Once this certificate is obtained, it implies that the organization has satisfied all the requirements as per the ISO/IEC 27001:2013 standard.

The pre-requisite to succeeding in the external audit is to optimize or revamp the existing Information Security Management System. The standard lists six steps to create and self-evaluate:

1. Understanding the security controls required for the specific industry or organization and developing a security policy.

2. To get the developed security policy up and going by manifesting clearly defined scope across the various teams, the tasks carried out by these teams, and the technology used to complete the tasks.

3. Organizing a risk assessment.

4. Evaluating the outcome of the risk assessment and identifying the threats.

5. Selecting appropriate controls to mitigate the threats identified and implementing it with proper steps.

6. Modifying the security policy according to selected and implemented controls.

The 3 principles of Information Security Management System: –

The standard lays out 14 controls to achieve the three aspects, which it states as the basic principles to achieve for information security.

•  Confidentiality: Confidentiality is to maintain the organization’s information in private. This aspect ensures providing access to crucial information only to authorized persons.

•  Integrity: Integrity refers to giving rights to edit crucial information only to specified persons.

•  Availability: Authorized persons must have timely access to the crucial information.

ISO/IEC 27001 aims at ensuring the confidentiality, integrity, and availability of information in the organization. Risk assessment of the information, clear definition of needs of the organization, and risk mitigation are carried out step-by-step to achieve this.

The Plan-Do-Check-Act Methodology: –

The standard lays out 14 controls, which can be implemented through a 4-step methodology: Plan, Do, Check, Act. The 14 controls involve guidelines to prepare a information security plan, taking timely actions and doing to prevent data threat and checking the critical aspects at various levels.

Plan:  It provides guidelines on how to plan the information security policies, plan for implementation of well-designed ISMS, and plan of risk management within the human resource team.

Do:  It emphasizes data security within the organization.

Check:  It instructs to check the crucial aspects within the organization.

Act:  This explains the actions to be taken within the organization to prevent data incidents and threats.

14 Key Requirements of Information Security Management System: –

Let us take a look at them.

A.5: Information security policies (2 controls): This control is all about Information security policies. From defining the framework to create an ISMS to documentation of policies and also the method to review it.

A.6: Organization of information security (7 controls):  This control is about implementing the well-designed ISMS. It comprises clear assignment of duties designation-wise for smooth operation of the ISMS.

A.7: Human resource security – 6 controls:  This control defines the steps to be taken for information security during the on-boarding and off-boarding of employees in the organisation. It also involves the aspects of conducting training for awareness on information security, the nature of decisions or actions taken by the management on non-adherence and agreements regarding termination of employees.

A.8: Asset management (10 controls):  This control consists of protection of data assets. The framework to be followed for maintenance of hardware, software and databases. The extent of data integrity and safe handling of data assets are checked by auditors.

A.9: Access control (14 controls):  This control ensures the aspect of confidentiality. It is about limitation of access to specified persons and how the access privileges are managed.

A.10: Cryptography (2 controls):  This control checks the various types of encryptions used (like DES, RSA, or AES) for protection of sensitive information.

A.11: Physical and environmental security (15 controls):  This control checks the measures taken for protection of information from physical factors. All physical aspects such as security systems in the buildings, access to internal equipment, vulnerabilities involving human and natural factors are checked.

A.12: Operations security (14 controls):  This control consists of securing the data with backup and preventing the organization from data loss. It provides guidelines on how to save and store data involving data flows.

A.13: Communications security (7 controls):  This control defines the standard of network and communication services used for ensuring a good standard in data infrastructure.

A.14: System acquisition, development, and maintenance (13 controls):  This control defines the standards of security to be met while the organization acquires new information systems.

A.15: Supplier relationships (5 controls):  This control checks the aspects of the organization’s communication and interaction with any third-party. All the interactions, communication, and extent of access present with any third-party service providers, outsourced personnel and vendors are checked.

A.16: Information security incident management (7 controls):  This control lays out the best practices to be followed to prevent security incidents, handling of a threat and preventing recurrence of such situations.

A.17: Information security aspects of business continuity management (4 controls):  This control is about the aspects of how the organization should handle disruptions, steps for smooth operation of ISMS during a time of crisis.

A.18: Compliance with internal requirements, such as policies, and with external requirements, such as laws (8 controls):  This control provides a check for statutory compliance to the laws laid for the industry in which the organization is operating. It audits and reviews the effectiveness of requirements of the ISO/IEC 27001 standard.

Validity of ISO/IEC 27001:

The validity for the ISO/IEC 27001 certification is 3 years. Regular reviews and evaluation of the ISMS by the senior management of the organization must be conducted internally during this period.

Benefits of being ISO/IEC 27001 certified. Why should you choose this?

The 14 Key Requirements of the ISO/IEC 27001 provides a system of risk mitigation that is rigorous and strong. The follow-up audits, final and most crucial of the three aspects, ensures that your ISMS is constantly evolving along with the threats and the world of digital crime. Having a robust risk mitigation system like the ISO/IEC 27001 means that your organization follows all the best practices and gives an edge over every other organization.

Being ISO/IEC 27001 certified is a sign of reliability, it means you can be trusted with data security. This would be a major reason behind your customers opting you over your competitors as the world today is constantly seeking an assurance for protection of data. It will reduce the cost of sales and boost your sales. Strong risk management increases the maturity of the management as it gives a clear perception of the strengths and weaknesses of the organization. ISO/IEC 27001 suits all organizations, irrespective of the size, industry, and geographical location. Cyber security is one of the biggest challenges faced by business organizations globally.

QRC as a Certification Body for ISO/IEC 27001:

QRC provides a hassle-free solution to getting your organization ISO/IEC 27001 certified by walking you through the comprehensive process. Right from enquiry submission, effort estimation, forming a contract, various stages of audits and assessments leading to the certification and annual reviews following it. As an ISO/IEC 27001 independent certification body, QRC provides these services to give organizations across the globe an edge of being a completely security compliant business organization with streamlined information security management process.

Toyota Breach-Aftermath of Data Breach Catastrophe

Posted on by admin

A couple of months ago, Toyota, the leading manufacturer in the automobile industry, was dealing with an augmenting catastrophe. It was distressing to hear that a company with such an amplitude of resources in diverse fields was heisted of its crucial information. Over a mere period of six months, it fell victim to a series of data breaches in Australia, Thailand, Vietnam and Japan. Toyota itself affirmed the data breach on its official website on 29th March 2019. In this breach, unethical hackers exploited over 3.1 million people’s sensitive data. After a deep-dive into the scenario, the officials concluded that the violation was an outcome of unauthorized access to a server connected to the company’s network.

It was a sign of relief for everyone when the organization announced that no customer credit card information was disclosed. However, Toyota notified that personal information exposed through unauthorized access included name, birth date and employment information. In a manner, the breach did stir up with the parts supplies process, thus resulting in delays at the service brand centre. The Toyota Motor North America (TMNA) ministered the situation, and thus reassured that data breach in no manner affected the customers in the United States.

Commencing in Japan, the cyberattack was strategically organized at eight different Toyota sales subsidiaries or their affiliates, including independent Toyota and Lexus car dealerships in Tokyo. Affected units by third party hackers included Toyota Tokyo Sales Holdings, Toyota Tokyo Motor, Tokyo Toyopet, Toyota Tokyo Corolla, Nets Toyota Tokyo, Lexus Koishikawa Sales, Jamil Shoji (Lexus Nerima), and Toyota West Tokyo Corolla. Amidst all these events, Toyota took a considerable approach. Not only did they publicly apologized to the masses, but also assured their diligence about implementing end to end information security measures at dealers and entire Toyota group.

Be it Toyota data breach or other thousands of data breaches that happen every year around the globe, all of them are directly or indirectly linked to the vulnerabilities within their IT Infrastructure. So this brings us to next question  What are Vulnerabilities ?

The simplest definition states that “The quality or state of being exposed to the possibility of being attacked or harmed“. Vulnerabilities are weakness of IT infrastructure which can be oppressed by attackers granting them access to your database or take control over your system. Let’s get familiar with some of the most common vulnerabilities :

– Security Misconfiguration  – Security misconfiguration vulnerabilities could occur if a particular element within an IT environment is liable to an attack due to insecure security misconfigurations. Security misconfiguration can take place at any level of the application stack, including multiple components like app platform, web server & application server, framework, and custom code.

Example: Unintentional installation of app server admin console and failure of its deportation.

– SQL injection  – This is a code injection technique which spotlights the databases of organization. This type of attack is initiated by releasing a sophisticated and malicious SQL statement as an input to the system. Attackers use SQL injection vulnerabilities to bypass the in place installed security measures, thus achieving their cybercrime goal.

Example: UNION operator is most vividly used SQL injection technique. This facilitates the attacker to initiate the output of more than 2 SQL statement in one single code.

– Buffer overflow attack  -Every database has a transitory area of data storage within its scope which is termed as a buffer area. When an attacker gives input to program in such a manner that data limit is outreached in the buffer area, which results in exploitation of system, it is termed as buffer overflow attack

EX: Heap-based buffer overflow attack is a sophisticated attack which aims at exploiting the buffer area reserved for a program itself, thus resulting in the crashing of program.

– Remote Code Execution  – In remote code execution, the attacker shoots out commands or codes remotely into a system which is physically or geographically inaccessible. This gives liberty to the attacker to intrude remote IT infrastructure and make undesirable modifications.

EX: CVE-2018-8248 vulnerability, also known as Microsoft Excel Remote Code Execution Vulnerability, allows an attacker to run malware on the vulnerable computer.

– SMB –  Server Message Block  protocol is a connection between the client and the remote server. It facilitates a platform where the client can get access to files, printers, serial ports and other resources on a network. Over here, the attackers use the unpatched system to get access to the infrastructure in a multitude of possibilities.

Example: Eternal Blue is a common SMB vulnerability where the attacker execute arbitrary code on the victim machine, as the SMB version 1 is incapable of handling specially crafted packets from remote attackers.

– Local file inclusion  – It gives the attacker the freedom to encompass files on the server via a web browser. This kind of vulnerability comes into the picture when a web application includes a file without verifying the input which allows the attacker to manipulate the input data and rephrase it according to their own convenience.

Example: The attacker can see the content of a sensitive file by replacing contact.php with the path of confidential data. This type of LFI arises when the developer fails to implement appropriate filtering at parsing component of a language interpreter.

– Remote file exclusion  – In this vulnerability, the webserver is intruded through a script, including a remote host file. The remote host file then intrudes the system producing changes as per the attacker’s will. These types of attack generally happen at PHP running websites. In this technique, the attacker can execute code hosted on his machine and get unauthorized access within the victim machine

Example: Custom code infamous C99 is a malicious script used by the attacker for PHP based RFI vulnerability.

As every disaster has an underlying truth and a lesson within itself, this breach also taught us that every organization should be diligent about their cybersecurity controls and measures. We learnt that basic security controls are not sufficient to protect your organization from modernistic cyberattacks. Hence, additional layers of security controls are fundamentals of robust hardwired secure IT infrastructure. The organizations should execute physical, logical and administrative controls to linearize organization safety on a tenacious path. How organizations can pursue such up to date security is by obliging to global standards as such PCI DSS, PA DSS, PCI 3DS, ISMS, GDPR, SOC (1, 2 & 3) and HIPAA etc.