Shaking The PCI Security Standards Council Meeting
It's that time of the year again. No, I am not writing about the best time in a quarter (which is approaching very fast). It's time for the annual PCI Security Standards Council community meeting. Two years ago the meeting took place in Toronto. Last year in Miami and now in Las Vegas. It is very encouraging to see how the community evolved into a large, influential group. The number of active members and other participants that are passionate about PCI and data protection in general is growing very nicely. As one can imagine, there is a direct correlation between the number of data breaches and compromised credit card records and the number of PCI professionals :-(
- Most breaches and nearly all records stolen are a result of “external sources” activity.
- 90%+ of breached records attributed to organized crime activity.
- Of the 284 million records that were compromised last year, most damages from external sources
To quote Brian, "When it comes to insiders and outsiders the terms are losing meaning; it's about data security regardless of the source. If we agree that data is valuable and data mostly resides in databases, and we also agree that most users interact with that data via Web applications, then prudence dictates that safeguards be applied at the Web application and database layer."
Top 3 techniques hackers are using to penetrate networks are
- Unauthorized access
- SQL injection
- Misconfigured ACL
The audience, mostly auditors and other PCI professionals were shocked when Chris provided statistics showing that many attacks could have been prevented by using patches that were available for over a year or mitigating known vulnerabilities (in other words, excluding zero day attacks). Even worse, forensic investigations show that in some cases, attacks were successful in environments with 90% patch ratio. In those cases, the 10% of older systems Unix systems or other obscure systems allowed the hacker to penetrate.
