Legislation came of age
Eight years after it was first introduced, the Payment Card Industry Data Security Standard (PCI DSS) has not only caught the attention, but gained the respect, of security professionals.
In contrast to other standards, which require companies meet a certain objective offering little explanation of why or guidance on how to become compliant, PCI DSS is different because it’s prescriptive. Now, nothing is perfect, as there is always room for improvement – and PCI DSS is no exception, but what it does do (really well in my opinion) is ensures all organisations who are subject to the regulation can easily adhere to a set of industry standard best practices. Organisations not only have a very clear understanding of what they need to do, but more importantly why they have to do it.
- The legislation itself strikes a good balance between technology, business processes and implementation practices.
- It is regularly maintained and updated so it remains current.
- From an IT perspective, it even outlines the specific security controls and processes it expects organisations to adopt if they’re to adequately manage and secure credit card data.
Organisations are increasingly storing personal and credit card details - whether it be for more direct contact with customers, employee information or government requirements. For that reason I expect, in the coming year, we will see more companies having to comply with PCI DSS in order to make their client data safe.
No longer fantasy but reality
For many years we’ve seen various cyberspace wars played out on the big screen and in sci fi novels. Unfortunately, this year fiction became reality – and in a big way!
Perhaps the most significant incident was Stuxnet – although there have been others. In June, Stuxnet was widely reported to have taken over Iran’s computerised systems, that operated its centrifuges, and having done so destroyed 1,000 used to enrich uranium. In a plot that would have made Ian Fleming proud, this event proved beyond doubt that a cyber-event can actually result in physical damage. The gauntlet could be considered well and truly thrown down as, in October, the U.S. government accused Iran of launching distributed denial-of-service (DDoS) attacks against U.S. financial institutions in retaliation.