On March 31, 2022, the PCI Security Standards Council (PCI SSC) released the latest version of the PCI Data Security Standard (PCI DSS), outlining technical and operational requirements for establishing security measures around payment security. It replaced a myriad of compliance programs to reduce confusion and inconsistencies that plagued the process in the past.
The current 4.0 release replaces PCI DSS 3.2.1, released in May 2018. The PCI SSC received input from various organizations to help them develop the new standard. That was done to help the new guidelines align with the realities of business entities tasked with implementing updated security controls.
Organizations have 24 months from the publish date of PCI DSS 4.0 to transition fully to the new standard. In the meantime, businesses need to understand the most significant changes between PCI DSS 3.2.1 and 4.0 and their impacts on established policies. The latest version attempts to address more ambiguous areas that can be interpreted differently.
Let’s look at the most significant changes in the guidelines and their impacts on businesses.
Section 8 of the PCI DSS now includes a requirement to implement multi-factor authentication (MFA) for anyone needing to access the cardholder data environment (CDE). Organizations need to have more than one method of authenticating users. The goal is to reduce the probability of an attacker pretending to be a legitimate user and gaining access to a company’s system.
That means organizations must move on from only requiring a single password for access. The new requirement doesn’t apply to systems or application accounts performing automated tasks. There’s no need to make updates to point-of-sale terminals that only access one card number at a time for sales transactions.
The new MFA requirements apply to access CDE by:
• Any personnel connecting from outside a business entity’s network
• Any remote access given to vendors and third parties
There’s no need to apply MFA for remote access given to parts of the system separated from CDE. They do apply to the following system components:
Any MFA system put in place must meet the following standards:
Another impactful change from the PCI DSS 4.0 update is a new requirement to expand the minimum length of passwords. Instead of seven, businesses must require passwords to be at least 12 characters long. If a company’s systems cannot support that length, then the password must be of at least eight characters. The update applies only to passwords and phrases used in MFA.
Service providers with customers who use only one password to access information must change them at least once every 90 days. If that doesn’t happen, the company should automatically review the security of those accounts and prompt a change. Another update to the password policy in PCI DSS 4.0 includes prohibiting hard coding of passwords into files or scripts used for interactive login.
The new PCI DSS updates recognize the need to add accountability around system and application accounts management. Many companies allow interactive access to these accounts, where they mimic the actions of regular users. Any system or application accounts used for interactive logins must be managed in the following manner:
Section 3, which addresses protections around account data, added new requirements for businesses to minimize the amount of sensitive authentication data (SAD) they store before receiving authorization. The standards around what data to keep and how to dispose of the information should be defined in a company’s retention policy.
Businesses will need to review what information gets kept by a third-party service provider (TPSP), like one that provides cloud services, and ensure they meet those standards. Once stored data exceeds the period outlined in a retention policy, organizations need to find a way to delete the information or make it unrecoverable.
An excellent practice to implement would be to have automation tools running to monitor storage areas that hold SAD. All results should be validated and recorded as completed.
Another data change that impacts companies is a requirement to place restrictions around moving personal account numbers (PANs) using remote access technology like a virtual desktop. Companies need to implement technology that keeps unauthorized users from copying or relocating PAN information from remote devices.
Only individuals with proper authorization and a legitimate business reason should have the authority to move or copy PAN data. Other new restrictions that apply to PANs include:
Business entities will have set up evaluations of system components determined not to be at risk for a malware attack. The frequency of the reviews should depend on the potential of bad actors going after seemingly safe pieces of company system infrastructure.
Organizations must also install a malware solution to protect removable electronic media. The security tools should automatically scan media upon insertion, connection, or mounting. Alternatively, the solution should execute an ongoing behavioral analysis of all systems or processes upon insertion or connection of the removable media.
New security should be placed around public-facing web applications. The security tools should provide ongoing detection and prevention of web-based attacks. Businesses must also identify and list any bespoke, custom, and third-party software to make it easier to manage vulnerability and patch management. Companies can acquire inventory tools that help them with software inventory to accommodate that.
The new PCI DSS standard also requires business entities to
The implementation of PCI DSS 4.0 underscores the continuing evolution of the payment card industry data security landscape. This latest version takes a comprehensive approach to protect cardholder data, introducing new requirements that impact every aspect of payment security, from the transmission of cardholder data to the way we test security systems.
These robust card industry data security standards serve as an important framework for banking organizations worldwide, reinforcing the importance of PCI DSS compliance. Required by all entities involved in payment card processing, PCI DSS is a key tool in the fight against financial fraud and data breaches.
The updated standard emphasizes the necessity to restrict access to cardholder data, with enhanced multi-factor authentication requirements and stricter guidelines around password creation and account management. It also addresses the transmission of cardholder data, providing more rigorous controls to protect sensitive credit card data.
Maintaining security systems in line with these standards is crucial, and the newly enforced PCI DSS 4.0 further stresses the need to restrict physical access to cardholder data. This is a significant stride towards safer banking practices and more secure financial transactions.
At Kiuwan, we understand the challenges of staying compliant with evolving industry standards like PCI DSS. We offer a range of security solutions designed to help your business safeguard credit card data, maintain security systems, and meet PCI DSS compliance requirements.
Learn more about how we can help your company prepare for the full implementation of PCI DSS 4.0 by scheduling a consultation.
