Thales, a communications security firm, has released results of a research study about the upcoming version of the Payment Card Industry Data Security Standards (PCI DSS). This new set of standards is expected to be released in October 2010 by the PCI Security Standards Council. Based on surveys with 155 qualified security assessors (QSAs), the following trends and key findings were identified:
- Encryption is one of the most effective means for achieving compliance but questions arise on how to treat encrypted data in audits. It is believed that clarifications will be issued on the use of encryption and key management.
- Forty-one percent of those surveyed believed tokenisation will be included in the update as the technology to use to increase cardholder data security and reduce cost of compliance.
- Tier 1 merchants are paying US$122,000 more on average than Tier 2 merchants to do the same QSA assessments.
The Ponemon Institute, an information-management think tank, designed the survey to focus on identifying trends, recommendations and preferences of QSAs involved in PCI DSS compliance. Specifically, the survey questions focused on the background, experience, client observations, expected changes in PCI DSS, preferences on how to achieve compliance, and typical client recommendations.
“Our research continues to validate that 60% of QSAs believe encryption to be the most effective means to protect card data end-to-end, and 41% of QSAs said that controlling access to encryption keys is the most difficult key management task faced by clients using encryption. It remains clear that QSAs consider encryption to be one the best techniques merchants can use to keep information safe and comply with PCI requirements. The current version of the standard, however, is ambiguous about how exactly encrypted data should be treated in audits, so QSAs seem to be confident that the October 2010 update to PCI DSS will provide clarity,” said Dr Larry Ponemon, chairman and founder of The Ponemon Institute.
The annual BNP Paribas Cash Management University kicked off on Thursday morning with treasury professionals congregating in Paris from across Europe.
APIs may be a solution to MT940 challenges, says Karen Fagan, treasury operation manager, for British television company, ITV.
Kicking off the first day of the Singapore Fintech Festival, issues with cryptocurrencies were addressed by MIT media labs director, Joi Ito, and panels of technology leaders discussed how they’re using data analytics.
Sibos 2017 day two highlights: Brexit and banking, and why ‘data is the new oil’ in financial services
How nation first politics can impact global financial organisations It’s clear that data and regulation are the two key topics that are ... read more