A whitepaper containing important clarifications made in the PCI Council’s penetration test informational supplement.
By: Gary GloverTo ensure minimal confusion with new PCI DSS penetration test requirements (Requirement 11.3), the PCI Council released a much-needed penetration test informational supplement in March 2015.Download the whitepaper for a detailed analysis, or read on for a quick overview of the newest changes and additional guidance to PCI DSS penetration test requirements.
Use industry-accepted approachesNow, an industry-recognized methodology must be used when conducting a penetration test (e.g., NIST 800-115, OWASP Testing Guide, etc.).Include critical systems in the penetration testIn PCI 3.0, penetration testers are not supposed to neglect the critical systems in a merchant’s environment. Their scope for the pen test should exceed outside of the card data environment, and include any critical systems present in the merchant environment.Continue external and internal penetration testsThe definition of internal and external testing didn’t change in 3.0, but the merchants required to have an external or internal test did.
Provide authentication in application-layer and network-layer penetration testingOne of the clarifications detailed in this section is that penetration testers need to conduct an authenticated pen test. This means the customer must provide the penetration tester with credentials to access the system, instead of requesting that he try to penetrate their system blindly.Start testing network segmentationSegmentation checks are new penetration tests that make sure merchants have segmented their network correctly.
Review of past vulnerabilities and threatsThis brand new requirement explains that both merchants and penetration testers are responsible for reviewing a merchant’s past vulnerabilities.ConclusionFor more information and details on the newest requirements, I encourage you to familiarize yourself with the informational supplement recently released by the PCI Council and download our whitepaper.Gary Glover (CISSP, CISA, QSA, PA-QSA) is Director of Security Assessment at SecurityMetrics with over 10 years of PCI audit experience and 25 years of Star Wars quoting skills. May the Force be with you as you visit his other blog posts.
Influencers from Around the World – Some Acts of Giving Can Span Decades and Lifetimes
This month we have another new guest writer. Like myself and several other guest bloggers for Influence PEOPLE, Debbie Hixson is a Cialdini Method Certified Trainer®. Debbie is a manager in the Leader Strategy and Programs division at Kaiser Permanente where she’s been for nearly 20 years. She earned her B.A., Psychology, has an M.Ed. in Counseling and Educational Psychology, a Masters of Arts in Human Resources Development and is currently working on her Ph.D. in Organizational Leadership! I know you’ll enjoy Debbie’s insightful perspective on influence and persuasion.
Brian Ahearn, CMCT® Chief Influence Officer influencePEOPLE Helping You Learn to Hear “Yes”.Some Acts of Giving Can Span Decades and LifetimesI read in my Sunday paper about a cemetery in Holland where American soldiers who fought the Nazis in World War II are buried. It seems that each of the 8,300 graves in Margraten, a small village in the Netherlands, are tended by Dutch, Belgian or German families, along with schools, companies, and military organizations. On Memorial Day this year they came as they do several times a year to place flowers in front of headstones of people they didn’t know and to honor their service. At the cemetery’s annual commemoration 6,000 people flooded the 65-acre burial grounds including many descendants of the American soldiers who traveled from all over the U.S. They came to pay tribute to their parents and grandparents who fought to defeat the Nazis. And they came to thank the people who had been tending the graves of their loved ones for over 70 years. Some of the caretakers have passed the responsibility on from generation to generation. The responsibility is felt so deeply that there is a list of over 100 people waiting to become caretakers of the graves.What would cause a nation recovering from the trauma of being invaded during World War II and their own personal losses to adopt the fallen of another nation? And what would keep this commitment alive all these years later, when the pain and significance of the war had faded. It is unique in this world, wouldn’t you say?In September 1944, the village of Margraten and its 1,500 inhabitants had been freed from Nazi occupation. The war was not over and many American soldiers died in nearby battles with the goal of breaking through the German lines and trying to capture bridges that connected the Netherlands to Germany. The losses sustained were heavy and the American nation needed a place to bury its dead. They choose a fruit orchard just outside Margraten. The villagers of Margraten embraced the Americans and grieved for their fallen. They provided food and shelter for the U.S. commanders and their troops. After four years of being occupied by the Nazis, they were free. Life could return to normal and once again they could enjoy the freedoms they had before the invasion. They realized that they had the Americans to thank for that freedom. For the gift of their freedom, the people of Margraten reciprocated by tending year after year to the graves of the solders who gave their lives to restore it. The rule of reciprocity, according to Dr. Robert Cialdini, says that when we receive something, a favor, a kindness, etc., we feel obligated to repay it. He says that “so typical is it for indebtedness to accompany the receipt of such things that a phrase like ‘much obliged’ has become a synonym for ‘thank you,” not only in the English language but in others as well.” Although obligations extend into the future they can be short lived unless they are notable and memorable such as the American sacrifice to free the people of Margraten. In some cases such as this, the obligation is felt so keenly that the thank you never ends. We can see this illustrated in a recent ceremony in Margraten to honor the fallen Americans. One American conveyed the essence of the bond between the Dutch and the U.S. His name is Arthur Chotin and the Naaijken family tends his father’s grave. He said to the audience of Americans and current caretakers, “By making these dead part of your family, you have become part of our family. You have created a bond between us that will never be broken. So, from this day forward, from now until the end of time, a heartfelt thank you.”In our own lives we have experienced reciprocity. We all learned as children that when someone does something nice for us, we do something nice for that someone in return. It works well for us and in our society to reciprocate. We have not-so-nice words for people who do not reciprocate. Reciprocating with others establishes relationships whether they are professional or personal in nature. In my work, I use reciprocity to develop long-lasting relationships with my clients that are mutually beneficial. Before I make a request of them, I consider giving them something first. It might be giving time to listen to their concerns, or sharing ideas to address their problems. In return I ask for their trust to be completely honest in our coaching relationship. Then I ask them to listen to my feedback as well as try out my suggestions for addressing their leadership challenges. Because we keep reciprocating the relationship continues indefinitely for as long as we work together. Reciprocity is a powerful tool to influence others. It is based on the idea that we help those who help us. It begins by giving someone a gift – your time, your advice, etc. In turn they will usually support your request because the rule says we’re to give back to those who first give to us. It is a powerful motivator for us to comply with other’s requests when they have given to us and it’s powerful because others will do what you ask when you give to them first. So start with this thought, “Whom can I help?” rather than, “Who can help me?” Do so and you will initiate and develop long-lasting, mutually beneficial relationships. Try it.
Debbie Hixson, CMCT®
SMB, Impossible: Transferable Principles of Successful Small Business
One of my guilty pleasures is the show Restaurant: Impossible with Robert Irvine. Whenever I take a trip out to my parents’ place in Woodstock, they always have a backlog of the show on their DVR. I’ve always loved stories about fixers, from Winston Wolf to Michael Clayton to Ray Donovan, to real life practitioners […]![]()
- « Previous Page
- 1
- …
- 221
- 222
- 223
- 224
- 225
- …
- 561
- Next Page »
A whitepaper containing important clarifications made in the PCI Council’s penetration test informational supplement.