The v3.2.1 revision of the PCI DSS included only minor updates and clarifications. The PCI SSC also revised the SAQs to reflect the PCI DSS V3.2.1 while also adding one additional requirement (6.2) to the SAQ A. We discussed the changes incorporated into the v3.2.1 PCI DSS in our July article (https://sysnetgs.com/2018/07/quick-guide-changes-in-pci-dss-v3-2-1/). The PCI SSC […]
Over the last few months, the PCI SSC has published a set of documents to establish a new program for the specification, testing, evaluation and PCI SSC listing of Software-based PIN entry on Commercial Off The Shelf devices (COTS) Solutions. Solutions also known as SPoC. The PCI DSS developed this new PCI Security Standard […]
Though there have been regular news stories of companies that have suffered data breaches, many smaller businesses are still failing to view cyber security as a major priority. Often the reasoning behind this is that they don’t believe that their business will be targeted due to its size, they think that they don’t have valuable […]
Though 2018 hasn’t reached half way, the number of data breaches thus far in the US through to March 27th has seen more than 250 data breaches, with more than 5.4 million records exposed. In comparison to last year there has been a decline of 36% during the same period of time which saw 392 […]
The growth of mobile payments globally continues to pick up pace; however, it is China, to date, that has embraced it most quickly and readily as we previously reported in our article entitled: Is China leading the way forward with Mobile Payments? In 2016 the mobile payments market in China reached $5.5 trillion. In comparison, during […]
When it comes to compiling with PCI DSS, many small to medium merchants struggle to find the time or resources. As a result often they end up paying non-compliance fees which in turn leaves them vulnerable to security breaches. An alternative to this approach is to replace the non-compliance fee with compliance and security value-added […]
By Natasja Bolton, Senior Acquirer Support QSA Our article of February 2016, discussed upcoming EU requirements for Strong Customer Authentication (SCA). At the time, the European Banking Authority (EBA) had not yet released the implementation requirements for SCA: the Regulatory Technical Standards (RTS). Now, with the revised EU Payment Services Directive (PSD2) having come […]
Many smaller business owners simply don’t have the time or resources to comply with PCI. As a result, they often end up paying ongoing, non-compliance fees leaving them vulnerable to security breaches. So what’s the solution? It’s simple, take the burden away from smaller merchants by providing them with a managed compliance and security […]
We regularly hear news stories about large corporations being hit with fines and suffering significant costs due to data breaches. Many small businesses believe themselves to be immune to this threat as they believe themselves to be “too small to be a target” or that they “don’t hold valuable data.” Sadly, this is no longer […]
Continuing on with our series of articles that focuses on challenges that many smaller businesses have, in this paper we highlight the risks cyber security poses to small businesses. We discuss how company data can be monetised by cybercriminals, why small businesses are at risk and the real cost of ignoring cyber security issues. Share […]
With the General Data Protection Regulation (GDPR) deadline scheduled to go live 25th May 2018, we thought that it was appropriate to have another look at the European directive that will have a global impact. Though a legal requirement created by the EU, GDPR is applicable to personally identifiable information (PII) related to EU […]
With the PCI SSC June 30th deadline fast approaching for all businesses to migrate away from using SSL and early TLS protocols, have your business customers taken the necessary steps to ensure that they are compliant? In this infographic, we examine what the TLS deadline is and what you can do to assist your customers. […]
We previously wrote about the PCI DSS new controls that became mandatory and effective from 1st February 2018. In that article we highlighted the items that impacted merchants, some new controls that impacted only service providers and some that are common to both. This article discusses what is the intent of this control, what […]
Businesses, in particular small to medium ones, often do not consider that they could be targeted by cybercrime. Unfortunately, the reality is that many small to medium businesses are now very much being targeted by cyber-criminals. The vast majority of criminals are opportunists, meaning that they will look to take advantage of any businesses that are […]
Compliance with multiple information security related standards and regulations can be challenging for organisations. However, by aligning all standards using our Combined Assessment Model, requirements, cost and complexity can be significantly reduced. In this infographic, we explore the short and long term benefits.
Cyber security is a wide-ranging term that can relate to a plethora of complicated issues that are far above the head of the average person. However, small businesses can take strides towards making themselves more secure by taking simple steps to secure their information by avoiding negligent security habits. These small practices begin with […]
With the Payment Card Industry Security Standards Council (PCI SSC) 30th June 2018 deadline fast approaching, it’s important that your customers are prepared to migrate to a secure version of TLS . Back in October of last year, Sysnet’s Natasja Bolton, Senior Acquirer Support QSA, highlighted the key factors as to what the TLS […]
On 2nd February, Sysnet attended the Card & Payments Awards in London in which three clients, Elavon Merchant Services, Lloyds Bank Cardnet and Worldpay were all nominated in the category of ‘Best Security or Anti-Fraud Development’. A fantastic night was had by all even though no awards were won this time round. The Card & […]
PCI DSS compliance clients shortlisted at UK and Ireland’s leading industry awards Dublin, Ireland. 29th January 2018. Sysnet Global Solutions, a leading provider of cyber security and compliance solutions to the payments industry, is delighted to announce that three of its clients – Elavon Merchant Services, Worldpay, and Lloyds Bank Cardnet – are all shortlisted […]
By Francis Kyereh, Information Security Consultant Maintaining payment security is required for all entities that store, process or transmit cardholder data. Guidance for maintaining payment security is provided in PCI security standards. These set the technical and operational requirements for organisations accepting or processing payment transactions. The PCI DSS Version 3.2, containing nine new requirements […]
By Mat Clarke, Information Security Analyst When a face-to-face payment is made, there are typically two types of receipt generated. One of these is handed to the customer for their own records (known as the “cardholder copy”), whilst the other is kept by the merchant. Whilst the PAN (e.g. full card number) has to […]
When undertaking any kind of PCI DSS assessment, whether it is a formal assessment or self-assessment questionnaire (SAQ), the most important thing is ensuring that the scope is correct. Without an understanding of the scope, systems may be overlooked and/or insufficient security controls applied. This may lead to a risk of data breach. Conversely, […]
In part two of his 5 Cyber-predictions for 2018, Sysnet’s Juliusz Idzik continues in examining cyber threats that could impact organisations in a major way in 2018. If you missed the first part of this article or want a recap, then you can read it by clicking here. 4. Phishing methods and techniques […]
The IATA (International Air Transport Association) is requiring that all of their members achieve and maintain PCI DSS compliance as a condition of obtaining and retaining accreditation as an IATA Accredited Agent. A full accredited agent is a travel agent that sells airline tickets on behalf of IATA member airlines. The deadline for compliance […]
By Juliusz Idzik, Senior Information Security Consultant 2017 review During 2017 we witnessed some interesting but unnerving cyber campaigns that have forced many of us to rethink our security posture and whether our organisations are prepared to face sophisticated attacks. These campaigns use new, innovative tools that can pass traditional security mechanisms without any alert or […]
By Judith Clark, QSA Consultant With 95% of credit cards in Canada supporting contactless, 165 million contactless cards across Europe and one out of three card payments being contactless in the UK; the total amount spent in the UK is estimated to be approximately £23 billion for the first six months of 2017. The popularity […]
By Mat Clarke, Information Security Analyst Whilst guarding against a security breach is often high on the agenda for businesses and security professionals alike, making preparations for the worst-case scenario actually occurring can easily be overlooked. Unfortunately, as a number of recent high-profile security breaches have demonstrated, no set of defences is infallible […]
By David Morris, PCI Compliance Analyst Following on from Natasja Bolton’s article that highlighted the PCI Council June 30th deadline in relation to organisations not using Secure Sockets Layer (SSL) or early Transport Layer Security (TLS) as a security control, David Morris discusses the reasons for the requirement to migrate to a secure version of […]
By Natasja Bolton, Senior Acquirer Support QSA Back in January 2016, we highlighted the PCI Council’s extension of the migration completion date for transitioning from SSL and TLS 1.0 to a secure version of TLS (currently v1.1 or higher). Now, with just 8 months to go until the migration date deadline, we’re here to ask: […]
By Natasja Bolton, Senior Acquirer Support QSA In my last article, I discussed whether two-step authentication was ever acceptable to meet PCI DSS’s requirements for multi-factor authentication. In that article, we also noted that PCI DSS requirement 8.3.1 is currently a best practice which becomes a requirement after 31st January 2018. It seems timely […]
Sysnet CEO, Gabriel Moynagh, explains how acquiring organisations can make a real impact on small business security, by replacing revenue from PCI DSS penalties for non-compliance, with a managed service offering that boosts merchant security. The PCI DSS was set up to help businesses process card payments securely and reduce fraud. Most acquirers will […]
by Peter Burgess, Senior Information Security Consultant Hackers are constantly looking for new ways to access an organisation’s data and sometimes they succeed. One of the more bizarre approaches recently was by using a fish tank. The hackers attempted to access and steal data from a North American casino by accessing a fish tank connected to the […]
By Natasja Bolton, Senior Acquirer Support QSA Merchants with more complex payment systems or payment processes that do not fit into the shortened SAQs (A, A-EP, B, B-IP, C-VT, C & P2PE) are required to complete SAQ D or may require an on-site assessment (for merchants with larger amounts of transactions). These questionnaires can take […]
By Jeremy Lacy, Senior Cyber Security Consultant Working as an information security professional, I often assist businesses with their cyber security. Though much of my work is focused around making sure that a business does not become a victim of cybercrime, I never really considered how credit card fraud could affect me on a personal […]
by Natasja Bolton, Senior Acquirer Support QSA In our May 2016 article on the changes brought in by PCI DSS v3.2, we discussed both the PCI Council’s amended terminology from Two-Factor Authentication to Multi-Factor Authentication (MFA) as well as the introduction of an additional MFA PCI DSS requirement: 8.3.1. Since then, due to […]
By Natasja Bolton, Senior Acquirer Support QSA With the increase of malware and other malicious cyber security attacks that have had a global impact in the last few years, governments around the world have been trying to implement concrete safeguards through regulation. The goal of these regulations being to not only protect valuable infrastructure services […]
By Mat Clarke, Information Security Analyst Let’s face it, putting in place the plans and procedures necessary to support a forensic breach investigation isn’t a job which is likely to end in glory (in most cases, the best outcome is that you never have to use them). Nevertheless, it should be recognised that laying the […]
The PCI SSC has published a further update on the applicability and implementation of the SAQ A requirements to merchant web servers that redirect customers to a third party for payment processing. The SAQ A is applicable to merchant entities that have wholly outsourced their entire ecommerce website infrastructure to a PCI DSS compliant […]
Significant progress has been made in the US and European markets in terms of mobile payments, which we explored in our previous article, Mobile Payments – Have they met expectations? In that article Natasja Bolton examined whether mobile payments had been gaining acceptance in the market place with consumers and businesses alike. She established that […]
