The Playbook provides suggested actions for achieving the outcomes laid out inthe AI Risk Management Framework (AI RMF) Core (Tables 1 – 4 in AI RMF1.0). Suggestions are aligned to each sub-category within the four AI RMFfunctions (Govern, Map, Measure, Manage).The Playbook is neither a checklist nor set of steps to be followed in its […]
La entrada NIST AI_Risk Management Framework Playbook se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.
The Cybersecurity Misconception: Compliance ≠ Security In the complex digital landscape of modern business, robust cybersecurity is paramount. However, a pervasive misconception persists: the belief that achieving compliance equates to comprehensive cybersecurity. This dangerous fallacy can leave organizations exposed to significant risks. While compliance is undoubtedly essential, it is merely a foundational element within a […]
La entrada Remember: Compliance is a checkbox, Real Cybersecurity is a journey. se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.
Microsoft president says the company accepts full responsibility for every cybersecurity issue raised in a recent Cyber Safety Review Board report created by multiple officials from several U.S. government agencies
The post Microsoft Accepts Responsibility for U.S. Government Security Breaches appeared first on Security Boulevard.
Republican Gov. Phil Scott said the legislation would have made Vermont “a national outlier and more hostile than any other state to many businesses and non-profits.”
The post Vermont Governor Vetoes Data Privacy Bill, Saying State Would be Most Hostile to Businesses appeared first on SecurityWeek.
SIEM challenges never stopped me from loving this technology, but I am very cognizant of YMMV. Anyhow, CardinalOps released their annual “state of SIEM” report, and here are some fun highlights.
“Complexity: The average enterprise has more than 130 distinct security tools (endpoint, network, cloud, email, IAM, etc.).
Constant change in infrastructures, security tools, attack surfaces, adversary techniques, and business priorities (e.g., cloud). In fact, over the next 5 years, Gartner Research projects that over 60% of security incidents will be traced to misconfigured security controls.1
No “one-size-fits-all” — every enterprise is unique, making it impractical to copy/paste generic content from SIEM vendors, MSSPs, open source communities, and marketplaces.
Manual and error-prone processes that are highly dependent on individual “ninjas” with specialized expertise, making it difficult to effectively scale and maintain high-quality detections.
Challenges in hiring and retaining skilled personnel who can develop detections across diverse scenarios and log source types.”
P.S. Free Gemini / LLM tip: don’t ask to summarize, or for insights, ask for surprises!
Related blogs:
We Love What’s Broken … Yes, This Of Course Means SIEM! was originally published in Anton on Security on Medium, where people are continuing the conversation by highlighting and responding to this story.
The post We Love What’s Broken … Yes, This Of Course Means SIEM! appeared first on Security Boulevard.
Copilot Plus? More like Copilot Minus: Redmond realizes Recall requires radical rethink.
The post Recall ‘Delayed Indefinitely’ — Microsoft Privacy Disaster is Cut from Copilot+ PCs appeared first on Security Boulevard.
Whether it be purely text-based social engineering, or advanced, image-based attacks, one thing's for certain — generative AI is fueling a whole new age of advanced phishing.
The post The “Spammification” of Business Email Compromise Spells Trouble for Businesses Around the Globe appeared first on Security Boulevard.
The Insurance Regulatory and Development Authority of India (IRDAI) plays a crucial role in overseeing and advancing the insurance sector in India. Founded in 1999 as an autonomous and statutory body, IRDAI compliance acts as the principal regulator for the insurance industry both domestically and internationally. Its primary mission is to protect policyholders’ interests while […]
The post What is IRDAI Compliance and Its Role appeared first on Kratikal Blogs.
The post What is IRDAI Compliance and Its Role appeared first on Security Boulevard.
Location tracking service leaks PII, because—incompetence? Seems almost TOO easy.
The post Tile/Life360 Breach: ‘Millions’ of Users’ Data at Risk appeared first on Security Boulevard.
It’s no secret that hospitals and other health care organizations are among the top targets for cybercriminals. The ransomware attacks this year on UnitedHealth Group’s Change Healthcare subsidiary, nonprofit organization Ascension, and most recently the National Health Service in England illustrate not only the damage to these organizations’ infrastructure and the personal health data that’s..
The post Connecticut Has Highest Rate of Health Care Data Breaches: Study appeared first on Security Boulevard.
The U.S. Department of the Treasury’s report focuses on the use of Artificial Intelligence (AI) in the financial services sector, particularly in cybersecurity and fraud protection. It highlights the challenges and opportunities associated with AI adoption, emphasizing the need for a common AI lexicon, addressing capability gaps, and regulating AI in financial services. The report […]
La entrada Managing Artificial Intelligence-Specific Cybersecurity Risks in the Financial Services Sector se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.
The post The Ultimate Guide to Compliance Management System appeared first on Sovy.
The post The Ultimate Guide to Compliance Management System appeared first on Security Boulevard.
This blog takes a look at the role, benefits, and considerations of technological innovations in security compliance.
The post The Future of Security Compliance: How Emerging Technologies are Setting New Rules appeared first on Scytale.
The post The Future of Security Compliance: How Emerging Technologies are Setting New Rules appeared first on Security Boulevard.
What is the Colorado Privacy Act? The Colorado Privacy Act (CPA), signed into law on July 7, 2021, is a comprehensive privacy legislation that aims to enhance data privacy rights for residents of Colorado. The CPA provides consumers with greater control over their personal data and imposes obligations on businesses that process personal data. It […]
The post Colorado Privacy Act (CPA) appeared first on Centraleyes.
The post Colorado Privacy Act (CPA) appeared first on Security Boulevard.
SaaS security has become organizations' top consideration, highlighted by establishing dedicated SaaS security teams. There’s also a notable increase in SaaS cybersecurity budgets, with 39% of organizations boosting their allocations.
The post Organizations Move to Establish Dedicated SaaS Security Teams appeared first on Security Boulevard.
Spy warez: Assistant director of the FBI’s Cyber Division Bryan Vorndran (pictured) might have the key to unscramble your files.
The post LockBit Victim? Ask FBI for Your Ransomware Key appeared first on Security Boulevard.
Stress? What stress? 43% of IT professionals report that their organization had experienced a security breach that caused downtime and cost $1-10 million.
The post CDW Survey Surfaces Cybersecurity Tool Sprawl Challenges appeared first on Security Boulevard.
“It is clear that HHS’ current approach to healthcare cybersecurity — self-regulation and voluntary best practices — is woefully inadequate and has left the health care system vulnerable to criminals and foreign government hackers.” - Wyden.He stated that the sub-par cybersecurity standards have allowed hackers to steal patient information and disrupt healthcare services, which has caused “actual harm to patient health.”
“HHS’ failure to regulate the cybersecurity practices of major health care providers like UHG resulted in what the American Hospital Association has described as the worst cyberattack against the healthcare sector in U.S. history.” - WydenThe use of MFA is a fundamental cybersecurity practice that HHS should mandate for all healthcare organizations, Wyden argued. He called for the implementation of broader minimum and mandatory technical cybersecurity standards, particularly for critical infrastructure entities that are designated as "systemically important entities" (SIE) by the U.S. Cybersecurity and Infrastructure Security Agency. “These technical standards should address how organizations protect electronic information and ensure the healthcare system’s resiliency by maintaining critical functions, including access to medical records and the provision of medical care,” Wyden noted. He suggested that HHS enforce these standards by requiring Medicare program participants to comply.
Ransomware attacks on healthcare in last three years. (Source: Emsisoft)[/caption]
“In 2023, 46 hospital systems with a total of 141 hospitals were impacted by ransomware, and at least 32 of the 46 had information, including protected health information, stolen.” - EmsisoftA study from McGlave, Neprash, and Nikpay from the University of Minnesota School of Public Health found that in a five-year period starting in 2016, ransomware attacks likely killed between 42 and 67 Medicare patients. Their study further observed a decrease in hospital volume and services by 17-25% during the week following a ransomware attack that not only hit revenue but also increased in-hospital mortality among patients who were already admitted at the time of attack.
It remembers everything you do on your PC. Security experts are raging at Redmond to recall Recall.
The post Microsoft Recall is a Privacy Disaster appeared first on Security Boulevard.
Regardless of where you are in your career in cybersecurity – whether you have been a trusted expert for decades or are just starting out – it can be difficult to keep up with what’s happening in this fast-moving field. One way to kick-start your continual learning is by tuning into top cybersecurity podcasts.
The post Listen up: 10 cybersecurity podcasts you can learn from appeared first on Security Boulevard.
A topic that I recently got asked about was vulnerability mitigation for IoT systems, which shows that even within the security community there is still a belief that mitigation equals threat resolution. For IoT systems this simply does not work for many reasons, first among them is that these IoT, OT, or ICS systems performing […]
The post IoT Security Means Remediation Not Mitigation appeared first on Viakoo, Inc.
The post IoT Security Means Remediation Not Mitigation appeared first on Security Boulevard.
The Australian privacy watchdog on Wednesday filed a lawsuit against Medibank, the country's largest private health insurer, for failing to protect its 9.7 million customers' personal information in a 2022 data breach incident.
The Australian Information Commissioner said in a civil penalty proceedings filed in the Federal Court that Medibank "seriously interfered" with the privacy of Australians by failing to take reasonable steps to protect their data from misuse and unauthorized access. These issues are allegedly in breach of the country's Privacy Act 1988, according to the OAIC.
“We allege Medibank failed to take reasonable steps to protect personal information it held given its size, resources, the nature and volume of the sensitive and personal information it handled, and the risk of serious harm for an individual in the case of a breach,” Tydd said. “We consider Medibank’s conduct resulted in a serious interference with the privacy of a very large number of individuals.”Privacy Commissioner Carly Kind put the responsibility of data security and privacy on the organizations that collect, use and store personal information. These orgnizations have a considerable responsibility to ensure that data is held safely and securely, particularly in the case of sensitive data, she said. “This case should serve as a wakeup call to Australian organizations to invest in their digital defenses,” Kind added.
A spokesperson for the health insurer did not detail the plan of action against the lawsuit but told The Cyber Express that ”Medibank intends to defend the proceedings.”
The deadline for CJIS compliance is rapidly approaching – it is mandated that all entities accessing criminal justice information (CJI) must have an acceptable multi-factor authentication (MFA) solution in place by October 1st, 2024. As per Criminal Justice Information Services (CJIS) Security Policy 5.9.3, non-compliance with this policy (i.e. not having an acceptable MFA solution) […]
The post The CJIS Compliance Deadline is Fast Approaching | Is your state / local government ready? first appeared on Accutive Security.
The post The CJIS Compliance Deadline is Fast Approaching | Is your state / local government ready? appeared first on Security Boulevard.
5 min read The updated framework addresses the need to secure non-human identities. Here's how that can extend across the guidance's five key functions.
The post NIST 2.0: Securing Workload Identities and Access appeared first on Aembit.
The post NIST 2.0: Securing Workload Identities and Access appeared first on Security Boulevard.
Snowflake, Inc. says NO, threatening legal action against those who say it was. But reports are coming in of several more massive leaks from other Snowflake customers.
The post Was the Ticketmaster Leak Snowflake’s Fault? appeared first on Security Boulevard.
Only half of cybersecurity leaders feel their C-suite understands cybersecurity risks, a Trend Micro survey found. Four in five have been told to downplay a potential risk’s severity.
The post CISOs and Senior Leadership at Odds Over Security appeared first on Security Boulevard.
Artificial intelligence (AI) in cybersecurity presents a complex picture of risks and rewards. According to Hyperproof’s 5th annual benchmark report, AI technologies are at the forefront of both enabling sophisticated cyberattacks and bolstering defenses against them. This duality underscores the critical need for nuanced application and vigilant management of AI in cybersecurity risk management practices....
The post The Dual Edges of AI in Cybersecurity: Insights from the 2024 Benchmark Survey Report appeared first on Hyperproof.
The post The Dual Edges of AI in Cybersecurity: Insights from the 2024 Benchmark Survey Report appeared first on Security Boulevard.
As technology continues to revolutionize healthcare operations, protecting patient data has never been more challenging. In the ongoing struggle against data breaches, last year marked a tipping point, as an unprecedented 133 million healthcare records were breached, according to the HIPAA Journal. In this blog, we will delve into the HIPAA compliance framework, with a...
The post Unlocking HIPAA Compliance: Navigating Access Control and MFA Guidelines appeared first on Silverfort.
The post Unlocking HIPAA Compliance: Navigating Access Control and MFA Guidelines appeared first on Security Boulevard.
Security experts have been frustrated because no one was managing the Common Vulnerabilities and Exposures security reports. Good news: The NIST has hired a company to manage the backlog. Bad news: The company has no experience with this kind of security work.
The post The NIST Finally Hires a Contractor to Manage CVEs appeared first on Security Boulevard.
The UPGRADE program seeks to enhance and automate cybersecurity for healthcare facilities, focused on protecting operations and ensuring continuity of patient care.
The post Cybersecurity Automation in Healthcare Program Launched by HHS Agency appeared first on Security Boulevard.
Microsoft Azure provides a suite of highly integrated security services that provide a cost-effective solution for Defense contractors looking to meet the CMMC 2.0 requirements. The Cybersecurity Maturity Model Certification (CMMC) is a framework designed to enhance the security posture of companies that work with the Department of Defense (DoD) by implementing a set of […]
The post Accelerating CMMC 2.0 Compliance for Defense Contractors with Microsoft Azure appeared first on Security Boulevard.
NYDFS introduced its 2nd amended Cybersecurity Regulation. One requirement is the automated blocking of commonly used passwords.
The post NYDFS Cybersecurity Regulation: Automated Blocking of Commonly Used Passwords appeared first on Security Boulevard.
Security teams often grapple with the uncertainty of data exposure in their SaaS supply chain, especially with third-party SaaS vendors. A proactive approach helps safeguard organizations against SaaS threats. It begins with a comprehensive evaluation of third-party vendor cybersecurity practices to pinpoint potential vulnerabilities and risks within the supply chain.
The post Shining the Light on Shadow IT: Top Five SaaS Security Tips for Third-Party Risk Management appeared first on Security Boulevard.
RBI has issued comprehensive master directions and guidelines for banks and non-banking financial corporations to identify and address operational risks and weaknesses. These guidelines are based on recommendations from working groups focused on information security, e-banking, governance, and cyber fraud. The primary motivation behind these directives is the growing need to mitigate cyber threats arising […]
The post What is an IS (RBI) Audit? appeared first on Kratikal Blogs.
The post What is an IS (RBI) Audit? appeared first on Security Boulevard.
"Recall enables threat actors to automate scraping everything you’ve ever looked at within seconds," he concluded.
In “Living off the Land attacks,” adversaries use USB devices to infiltrate industrial control systems. Cyberthreats from silent residency attacks put critical infrastructure facilities at risk.
The post A Major Industrial Cybersecurity Threat: Living off the Land Attacks appeared first on Security Boulevard.
Daft name, serious risk: Kit from ActionTec and Sagemcom remotely ruined and required replacement.
The post ‘Pumpkin Eclipse’ — 600,000+ Rural ISP Routers Bricked Beyond Repair appeared first on Security Boulevard.
A Business Continuity Compliance Checklist is a comprehensive tool used by organizations to ensure preparedness and resilience in the face of disruptions. It involves conducting a Business Impact Analysis (BIA) to identify and prioritize critical functions, assess the impact of disruptions, and define recovery objectives. A thorough risk assessment identifies potential threats and vulnerabilities, leading […]
La entrada Business Continuity Compliance Checklist se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.
Enterprise risk management (ERM) is an old idea that has gained renewed focus and relevance in the wake of the financial crisis. All industries are now facing unprecedented levels of risk. The pace of change and the speed of information flow are causal factors in the escalation of risk. Advancements in technology have spawned new […]
La entrada Building a Risk Resilient Organisation se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.
Table Showing Individuals Identified in the Latest Pegasus Spyware Infections (Credit: Citizen Lab)[/caption]
Access Now and Citizen Lab confirmed that five victims' phones had Apple IDs used by Pegasus operators in hacking attempts. Exploits leveraging bugs in HomeKit can leave the attacker's Apple ID email address on the victim's device. Citizen Lab believes each Apple ID is tied to a single Pegasus operator, although one operator may use multiple IDs.
The same Apple ID was found on the phones of Pavlov, Radzina, and a second anonymous victim. A different email account targeted both Erlikh and Pavlov’s phones on November 28, 2022. Artifacts from Andrei Sannikov and Natallia Radzina’s phones contained another identical email. This indicates that a single Pegasus spyware operator may have targeted at least three of the victims, possibly all five.
[caption id="attachment_73184" align="aligncenter" width="1024"]
Credit: Citizen Lab[/caption]
The investigators could not attribute the attacks to a specific operator but certain trends pointed to Estonia’s involvement. Based on previous investigation, Poland, Russia, Belarus, Lithuania, and Latvia are all known to be customers of the NSO Group’s spyware, but the likeliness of their involvement is low as they do not target victims outside their borders, the investigators said. Estonia, however, is known to use Pegasus extensively beyond its borders, including in multiple European countries.
“Access Now [urged] governments to establish an immediate moratorium on the export, sale, transfer, servicing, and use of targeted digital surveillance technologies until rigorous human rights safeguards are put in place to regulate such practices, and to ban the use of spyware technologies such as Pegasus that have a history of enabling human rights abuses.”Apple recently issued notifications to users in more than 90 countries alerting them of possible mercenary spyware attacks. The tech giant replaced the term "state-sponsored" in its alerts with "mercenary spyware attacks," drawing global attention. Previously, Apple used "state-sponsored" for malware threats, but now it highlights threats from hacker groups. Apple noted that while these attacks were historically linked to state actors and private entities like the NSO Group’s Pegasus, the new term covers a broader range of threats.
"A first task of the Safety and Security Committee will be to evaluate and further develop OpenAI’s processes and safeguards over the next 90 days."The committee's initial task is to evaluate and further develop OpenAI’s existing processes and safeguards. They are expected to make recommendations to the board within 90 days. OpenAI has committed to publicly releasing the recommendations it adopts in a manner that aligns with safety and security considerations. The establishment of the safety and security committee is a significant step by OpenAI to address concerns about AI safety and maintain its leadership in AI innovation. By integrating a diverse group of experts and stakeholders into the decision-making process, OpenAI aims to ensure that safety and security remain paramount as it continues to develop cutting-edge AI technologies.
Source: securityboulevard.com – Author: Kyle Morris, Senior Compliance Success Manager, Scytale ‘Vendor Risk Management’ is more than just a buzzword in the information security and compliance landscape. It’s a crucial aspect that can make or break your organization’s security. Consider this: 98% of organizations have had vendor relationships with at least one-third party experiencing a […]
La entrada Vendor Risk Management Best Practices in 2024 – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.
“We have been clear that organizations must consider the risks associated with AI, alongside the benefits. Today's preliminary enforcement notice shows we will take action in order to protect UK consumers' privacy rights.”On the basis of the ICO’s investigation that followed, Snap took substantial measures to perform a more comprehensive risk assessment for ‘My AI’. Snap demonstrated to the ICO that it had implemented suitable mitigations. “The ICO is satisfied that Snap has now undertaken a risk assessment relating to My AI that is compliant with data protection law. The ICO will continue to monitor the rollout of My AI and how emerging risks are addressed,” the data watchdog said. Snapchat has made it clear that, “While My AI was programmed to abide by certain guidelines so the information it provides is not harmful (including avoiding responses that are violent, hateful, sexually explicit, or otherwise dangerous; and avoiding perpetuating harmful biases), it may not always be successful.” The social media platform has integrated safeguards and tools like blocking results for certain keywords like “drugs,” as is the case with the original Snapchat app. “We’re also working on adding additional tools to our Family Center around My AI that would give parents more visibility and control around their teen’s usage of My AI,” the company noted.
“We will continue to monitor organisations’ risk assessments and use the full range of our enforcement powers – including fines – to protect the public from harm.”Generative AI remains a top priority for the ICO, which has initiated several consultations to clarify how data protection laws apply to the development and use of generative AI models. This effort builds on the ICO’s extensive guidance on data protection and AI. The ICO’s investigation into Snap’s ‘My AI’ chatbot highlights the critical need for thorough data protection risk assessments in the development and deployment of generative AI technologies. Organizations must consider data protection from the outset to safeguard individuals' data privacy and protection rights. The final Commissioner’s decision regarding Snap's ‘My AI’ chatbot will be published in the coming weeks. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.
Slack reveals it has been training AI/ML models on customer data, including messages, files and usage information. It's opt-in by default.
The post User Outcry as Slack Scrapes Customer Data for AI Model Training appeared first on SecurityWeek.
Vermont legislature passed a bill that prohibits the sale of sensitive data, such as social security and drivers’ license numbers, financial or health information.
The post Vermont Legislature Passes One of the Strongest Data Privacy Measures in the Country appeared first on SecurityWeek.
The PCI Security Standards Council (PCI SSC) is a global forum that connects stakeholders from the payments and payment processing industries to craft and facilitate adoption of data security standards and relevant resources that enable safe payments worldwide.
According to the PCI SSC website, “PCI Security Standards are developed specifically to protect payment account data throughout the payment lifecycle and to enable technology solutions that devalue this data and remove the incentive for criminals to steal it. They include standards for merchants, service providers, and financial institutions on security practices, technologies and processes, and standards for developers and vendors for creating secure payment products and solutions.”
Perhaps the most recognizable standard from PCI, their Data Security Standard (PCI DSS), is a global standard that provides a baseline of technical and operational requirements designed to protect account data. In March 2022, PCI SSC published version v4.0 of the standard, which replaces version v3.2.1. The updated version addresses emerging threats and technologies and enables innovative methods to combat new threats. This post will cover the changes to the standard that came with version 4.0 along with a high-level overview of how Rapid7 helps teams ensure their cloud-based applications can effectively implement and enforce compliance.
So, why are we talking about the new standard nearly two years after it was published? That’s because when the standard was published there was a two year transition period for organizations to adopt the new version and implement required changes that came with v4.0. During this transition period, organizations were given the option to assess against either PCI DSS v4.0 or PCI DSS v3.2.1.
For those that haven’t yet made the jump, the time is now This is because the transition period concluded on March 31, 2024, at which time version 3.2.1 was retired and organizations seeking PCI DSS certification will need to adhere to the new requirements and best practices. Important to note, there are some requirements that have been “future-dated.” For those requirements, organizations have been granted another full year, with those updates being required by March 31, 2025.
The changes were driven by direct feedback from organizations across the global payments industry. According to PCI, more than 200 organizations provided feedback to ensure the standard continues to meet the complex, ever-changing landscape of payment security.
A primary goal for PCI DSS v4.0 was to provide greater flexibility for organizations in how they can achieve their security objectives. PCI DSS v4.0 introduces a new method – known as the Customized Approach – by which organizations can implement and validate PCI DSS controls Previously, organizations had the option of implementing Compensating controls, however these are only applicable when a situation arises whereby there is a constraint – such as legacy systems or processes – impacting the ability to meet a requirement.
PCI DSS v4.0 now provides organizations the means to choose to meet a requirement leveraging other means than the stated requirement. Requirement 12.3.2 and Appendices D and E outline the customized approach and how to apply it. To support customers, Rapid7’s new PCI DSS v4.0 compliance pack provides a greater number of insights than in previous iterations. This should lead to increased visibility and refinement in the process of choosing to mitigate and manage requirements.
Alongside the customized approach concept, one of the most significant updates is the introduction of targeted risk analysis (TRA). TRAallows organizations to assess and respond to risks in the context of an organization's specific operational environment. The PCI council has published guidance “PCI DSS v4 x: Targeted Risk Analysis Guidance” that outlines the two types of TRAs that an entity can employ regarding frequency of performing a given control and the second addressing any PCI DSS requirement for when an entity utilizes a customized approach.
To assist in understanding and having a consolidated view of security risks in their cloud environments, Rapid7 customers can leverage InsightCloudSec Layered Context and the recently introduced Risk Score feature. This feature combines a variety of risk signals, assigning a higher risk score to resources that suffer from toxic combinations or multiple risk vectors.Risk score holistically analyzes the risks that compound and increase the likelihood or impact of compromise.
PCI DSS v4.0 has provided improvements to the self-assessment (SAQ) document and to the Report on Compliance (RoC) template, increasing alignment between them and the information summarized in an Attestation of Compliance to support organizations in their efforts when self-attesting or working with assessors to increase transparency and granularity.
PCI DSS v4.0 has brought with it a range of new requirements to address emerging threats. With modernization of network security controls, explicit guidance on cardholder data protections, and process maturity, the standard focuses on establishing sustainable controls and governance. While there are quite a few updates - which you can find detailed here on the summary of changes - let’s highlight a few of particular importance:
These controls place role-based access control, configuration management, risk analysis and continuous monitoring as foundations, assisting organizations to mature and achieve their security objectives. Rapid7 can help with implementing and enforcing these new controls, with a host of solutions that offer PCI-related support – all of which have been updated to align with these new requirements.
InsightCloudSec allows security teams to establish, continuously measure, and illustrate compliance against organizational policies. This is accomplished via compliance packs, which are sets of checks that can be used to continuously assess your entire cloud environment - whether single or multi-cloud. The platform comes out of the box with dozens of compliance packs, including a dedicated pack for the PCI DSS v4.0.
InsightCloudSec assesses your cloud environments in real-time for compliance with the requirements and best practices outlined by PCI It also enables teams to identify, assess, and act on noncompliant resources when misconfigurations are detected. If you so choose, you can make use of the platform’s native, no-code automation to remediate the issue the moment it's detected, whether that means alerting relevant resource owners, adjusting the configuration or permissions directly or even deleting the non-compliant resource altogether without any human intervention. Check out the demo to learn more about how InsightCloudSec helps continuously and automatically enforce cloud security standards.
InsightAppSec also enables measurement against PCI v4.0 requirements to help you obtain PCI compliance. It allows users to create a PCI v4.0 report to help prepare for an audit, assessment or a questionnaire around PCI compliance. The PCI report gives you the ability to uncover potential issues that will affect the outcome or any of these exercises. Crucially, the report allows you to take action and secure critical vulnerabilities on any assets that deal with payment card data. PCI compliance auditing comes out of the box and is simple to generate once you have completed a scan against which to run the report.
InsightAppSec achieves this coverage by cross referencing and then mapping our suite of 100+ attack modules against PCI requirements, identifying which attacks are relevant to particular requirements and then attempting to exploit your application with those attacks to obtain areas where your application may be vulnerable. Those vulnerabilities are then packaged up in the PCI 4.0 report where you can see vulnerabilities listed by PCI requirements This provides you with crucial insights into any vulnerabilities you may have as well as enabling management of those vulnerabilities in a simplistic format.
For InsightVM customers, an important change in the revision is the need to perform authenticated internal vulnerability scans for requirement 11.3.1.2. Previous versions of the standard allowed for internal scanning without the use of credentials, which is no longer sufficient. For more details see this blog post.
Rapid7 provides a wide array of solutions to assist you in your compliance and governance efforts. Contact a member of our team to learn more about any of these capabilities or sign up for a free trial.
Login