The Lighter Side Of The Cloud – The Knock-Off
The Lighter Side Of The Cloud – Drop Zone
The Lighter Side Of The Cloud – Piggybacking
What PCI DSS 3.0 Means For Cloud Service Providers

What PCI DSS 3.0 Means For Cloud Service Providers

What PCI DSS 3.0 Means For Cloud Service Providers

The only constant is change. Earlier this month, the Payment Card Industry Security Standards Council released version 3.0 of the PCI DSS standard (along with the accompany Payment Application Data Security Standard).  In it are a few key focus areas that will directly affect Cloud Service Providers (CSPs), which is why it makes good business sense to start thinking about version 3.0 right now. While some of the rules aren’t required for existing implementations until 2015, smart CSPs understand that customers will certainly be asking about the changes in 2014.

The most important change for CSPs in PCI DSS 3.0 is that they are required to provide a written agreement (or acknowledgement) to their customers of their explicit responsibilities for supporting the standard. PCI DSS 2.0 had some requirements for service providers, but 3.0 will require that CSPs develop specific, contract-level documentation of their commitments. The idea here is to eliminate the expensive finger-pointing exercise many organizations go through when something as simple as a disaster recovery or backup site, or when an audit finds expected portions of the standard are not met, or in the investigations following a data breach.

Another important change in 3.0 is the need for explicit definitions around the shared responsibility of service providers who provide PCI DSS-compliant environments and services to their customers. There will be no getting off the hook anymore.

This version of the PCI standard will also cause CSPs to take a look at the rest of their compliance offering-related infrastructure and processes — and sooner is better than later.  Here’s one change to watch for: the pen test requirement.  With version 3.0, the cardholder data environment has to be explicitly tested quarterly by an approved scanning vendor to verify that it is properly separated from other network environments.  It is critical that CSPs either work this requirement into their process and infrastructure set to make sure that the environment matches the new data security requirements.

There are also a host of smaller changes and clarifications that will be important to CSPs and thus deserve at least a mention here.  They include:

  • Increased education and awareness for personnel involved in managing the infrastructure and applications for the payment chain;
  • Specific clarifications around the use of encryption and cryptographic keys;
  • Account access procedures that limit CSP access to card payment infrastructure;
  • More detailed guidance about allowed password use;
  • More focused description of the limits of privileged and standard user access controls;
  • New access guidelines for CSPs that have remote access to their customers’ payment card data environments; and
  • New physical access requirements for onsite personnel
  • Increased visibility into the creation of new accounts and escalation of privileges by users with root and administrative access

As I said before, these changes do not need to be implemented until 2015, but affected CSPs should develop plans well ahead of time to ensure they can meet the new requirements. Doing so will give them a clear first-mover advantage in an increasingly security-focused market.

So, whatever your Cloud service offerings, getting ahead of the new PCI DSS requirements will enable you to both differentiate your offerings from the competition and give your customers greater comfort on the cloud security front. Don’t drag your heels addressing the additional requirements; instead, embrace the new PCI DSS standard in ways that will drive new business and also expand opportunities with your existing customers.

c-j-radford

By C.J Radford,

C.J. Radford joined Vormetric in March 2013 as vice president of cloud, a newly created leadership position that is tasked with leading the company’s cloud strategy and growth via strategic partnerships with cloud service providers (CSPs). He came to Vormetric from Symantec Corporation, where he spent more than five years driving business development and new strategic growth initiatives within the rapidly evolving CSP market. He holds a bachelor’s degree in business administration from the University of Oregon and an MBA from the University of California, Berkeley.

Follow Us!

CloudTweaks

Established in 2009, CloudTweaks.com is recognized as one of the leading authorities in cloud computing information. Most of the excellent CloudTweaks articles are provided by our own paid writers, with a small percentage provided by guest authors from around the globe, including CEOs, CIOs, Technology bloggers and Cloud enthusiasts. Our goal is to continue to build a growing community offering the best in-depth articles, interviews, event listings, whitepapers, infographics and much more...
Follow Us!

One Response to What PCI DSS 3.0 Means For Cloud Service Providers

Recent

Surprising Facts and Stats About Your Online Security

Surprising Facts and Stats About Your Online Security

Surprising Facts and Stats – Online Security It’s easy to get lulled into a false sense of security when browsing the web. As more and more devices join the internet of things, the risk of becoming a victim of a criminal cyber gang is increasing – we have more unsecured access points and offer would-be…

World Backup Day: Understand The Data You Are Protecting

World Backup Day: Understand The Data You Are Protecting

World Backup Day: Understand The Data You Are Protecting Did you know that 113 phones are lost or stolen every minute? What about the fact that 1 in 10 computers are infected with a virus every month? Thanks to World Backup Day, an independent initiative that was started in 2011, awareness is being raised about…

The E-Learning Market – Cloud Computing Adoption

The E-Learning Market – Cloud Computing Adoption

The E-Learning Market  We’ve talked a fair bit about e-Learning and MOOCs (Massive Open Online Courses) technologies here on CloudTweaks over the past number of years. The industry is expected to continue to grow at a brisk pace as more and more firms and educational institutions start to adopt cloud based services.  Docebo has an excellent…

Popular

5 Mistakes That Adversely Impact Seamless Cloud Migration

5 Mistakes That Adversely Impact Seamless Cloud Migration

There is absolutely no doubt migrating a section of your IT assets, non-core business processes or the entire spectrum of business systems to the cloud makes immense sense. There are plenty of business benefits linked to cloud computing; most astute businesses are using cloud computing in some capacity or other and if you aren’t doing…

Cloud-Based VOIP – 4 Alternatives To Skype

Cloud-Based VOIP – 4 Alternatives To Skype

Cloud-Based VOIP – 4 Alternatives To Skype Skype is the most popular cloud-based VOIP service. Since being bought out by Microsoft for $8.5 billion in 2011 the company has grown to more than 300 million users and now accounts for 34% of all international calls. Some people don’t want to use Skype though. Reports of…

The Cloud Above Our Home

The Cloud Above Our Home

Our Home – Moving All Things Into The Cloud The promise of a smart home had excited the imagination of the movie makers long ago. If you have seen any TV shows in the nineties or before, the interpretation presented itself to us as a computerized personal assistant or a robot housekeeper. It was smart,…

5 Ways The Internet of Things Will Drive Cloud Growth

5 Ways The Internet of Things Will Drive Cloud Growth

5 Ways The Internet of Things Will Drive Cloud Growth The Internet of Things is the latest term to describe the interconnectivity of all our devices and home appliances. The goal of the internet of things is to create universal applications that are connected to all of the lights, TVs, door locks, air conditioning, and…

2014 Future Of Cloud Computing Survey Results

2014 Future Of Cloud Computing Survey Results

Engine Yard Joins North Bridge Venture Partners, Gigaom Research and Industry Collaborators to Unveil 2014 Future of Cloud Computing Survey Results SAN FRANCISCO, CA–(Marketwired – Jun 25, 2014) – Engine Yard, the leading cloud application management platform, today announced its role as a collaborator in releasing the results of the fourth annual Future of Cloud Computing Survey,…

Sponsored Posts

From C:\Prompt To CYOD – The Timely Shift To Desktop as a Service

From C:\Prompt To CYOD – The Timely Shift To Desktop as a Service

The Timely Shift to Desktop as a Service There may be some colleagues lurking within any given workforce who remember what a C:\> prompt meant. Much like the ring from Middle Earth, it had the power to make things happen. Desktop computers at that time were large grey beasts, with their only wired connection being…

Cloud Logo Sponsors

hp Logo CityCloud-PoweredByOpenstack-Bluesquare_logo_100x100-01
cisco_logo_100x100 vmware citrix100
Site 24x7
Backup


Contributor Spotlight

Established in 2009, CloudTweaks is recognized as one of the leading influencers in cloud computing, big data and internet of things (IoT) information. Our goal is to continue to build our growing information portal, by providing the best in-depth articles, interviews, event listings, whitepapers, infographics and much more.

Branded Content Programs

Advertising