Payment Card Industry Data Security Standard (DSS) 3.2 arrives Feb. 1. According to Help Net Security, however, companies aren’t ready.

Despite two years of prep time, many organizations have opted to cram for yearly evaluations instead of adopting long-term PCI compliance policies. But that won’t work under the new framework. How can enterprises make the shift from eleventh-hour integration to cultures of continuous compliance?

Rushing to Meet PCI Compliance

Cramming for PCI DSS has become commonplace. Many companies opt for annual pass models of compliance, which see them shoring up PCI security policies just before yearly evaluations, then letting cardholder protections slide for 11 months.

When compromised, firms are typically compliant with just 47 percent of PCI DSS requirements, noted Help Net Security. Version 3.2 ups the ante: Companies must provide evidence of ongoing compliance rather than once-a-year-conformity.

According to the PCI Security Standards Council, PCI DSS 3.2 aims to make security an everyday priority. To accomplish this, companies must adopt multifactor authentication not just for untrusted, remote access to cardholder networks, but also for administrators working on corporate networks.

In addition, service providers will now be required to document the cryptographic architecture used to protect cardholder data and report any failure of critical security controls. Companies must also verify that all PCI DSS requirements remain intact after any impactful change to the network, and they must conduct penetration testing on segmentation controls at least every six months.

Employing Cultural Change

The bad news? With PCI DSS 3.2 already live, companies don’t have time to build out a complete compliance policy from scratch if they haven’t already. However, cramming isn’t the only option. Start here to toss the pass/fail treadmill:

  • Scan internal systems. It’s worth completing an internal scan to identify any internal issues. A variety of open-source tools are available that will provide an overview of potential PCI compliance issues.
  • Hire an expert. Approved scanning vendors (ASVs) can pinpoint network issues from the outside looking in. Find a reliable ASV to complete scans at least every quarter. This improves overall security and provides necessary data for PCI DSS evaluations.
  • Implement multifactor authentication. Spending here is a requirement, since it not only complies with PCI regulations, but also increases total network security. Two-factor authentication is the bare minimum, but it’s worth considering extra protection where possible to limit the chance of a breach.
  • Crash the network. Penetration testing is now mandatory under the new PCI regulations. Hire a pen testing firm to discover where security is working and where improvements must be made.

PCI DSS 3.2 is here and companies aren’t prepared. Toss the idea of last-ditch cram sessions and instead opt for a culture of consistency while adopting PCI compliance regulations.

More from

Did Brazil DSL Modem Attacks Change Device Security?

From 2011 to 2012, millions of Internet users in Brazil fell victim to a massive attack against vulnerable DSL modems. By configuring the modems remotely, attackers could redirect users to malicious domain name system (DNS) servers. Victims trying to visit popular websites (Google, Facebook) were instead directed to imposter sites. These rogue sites then installed malware on victims' computers.According to a report from Kaspersky Lab Expert Fabio Assolini citing statistics from Brazil's Computer Emergency Response Team, the attack ultimately infected…

Who Carries the Weight of a Cyberattack?

Almost immediately after a company discovers a data breach, the finger-pointing begins. Who is to blame? Most often, it is the chief information security officer (CISO) or chief security officer (CSO) because protecting the network infrastructure is their job. Heck, it is even in their job title: they are the security officer. Security is their responsibility. But is that fair – or even right? After all, the most common sources of data breaches and other cyber incidents are situations caused…

Transitioning to Quantum-Safe Encryption

With their vast increase in computing power, quantum computers promise to revolutionize many fields. Artificial intelligence, medicine and space exploration all benefit from this technological leap — but that power is also a double-edged sword. The risk is that threat actors could abuse quantum computers to break the key cryptographic algorithms we depend upon for the safety of our digital world. This poses a threat to a wide range of critical areas. Fortunately, alternate cryptographic algorithms that are safe against…

Securing Your SAP Environments: Going Beyond Access Control

Many large businesses run SAP to manage their business operations and their customer relations. Security has become an increasingly critical priority due to the ongoing digitalization of society and the new opportunities that attackers exploit to achieve a system breach. Recent attacks related to corrupt data, stealing personal information and escalating privileges for remote code execution all highlight the new and varied entry points threat actors have taken advantage of. Attackers with the appropriate skills could be able to exploit…