Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Compliance

PCI Security Standards Council Releases Cloud Computing Guidelines

The PCI Security Standards Council (PCI SSC), the standards body that oversees the Payment Card Industry Data Security Standard (PCI DSS), released the PCI DSS Cloud Computing Guidelines Information Supplement on Thursday.

The PCI Security Standards Council (PCI SSC), the standards body that oversees the Payment Card Industry Data Security Standard (PCI DSS), released the PCI DSS Cloud Computing Guidelines Information Supplement on Thursday.

Designed to help organizations that processes credit cards better understand compliance when using cloud technology, the resource can be used to help select solutions and third-party cloud providers that will help them secure their payment data and support PCI DSS compliance.

PCI Security Standards Council

More than 100 organizations representing banks, merchants, security assessors and technology vendors collaborated on the guidance, the council said.

According to the council, The PCI DSS Cloud Computing Guidelines Information Supplement builds on the work of the 2011 Virtualization Special Interest Group (SIG), and aims to provide guidance around the following primary areas and objectives:

Cloud Overview – provides explanation of common deployment and service models for cloud environments, including how implementations may vary within the different types.

Cloud Provider/Cloud Customer Relationships– outlines different roles and responsibilities across the different cloud models and guidance on how to determine and document these responsibilities.

PCI DSS Considerations – provides guidance and examples to help determine responsibilities for individual PCI DSS requirements, and includes segmentation and scoping considerations.

PCI DSS Compliance Challenges– describes some of the challenges associated with validating PCI DSS compliance in a cloud environment.

Additional Security Considerations – explores a number of business and technical security considerations for the use of cloud technologies.

The document also includes a number of appendices to address specific PCI DSS requirements and implementation scenarios, including: additional considerations to help determine PCI DSS responsibilities across different cloud service models; sample system inventory for cloud computing environments; sample matrix for documenting how PCI DSS responsibilities are assigned between cloud provider and client; and a starting set of questions that can help in determining how PCI DSS requirements can be met in a particular cloud environment.

The supplement is available here

Written By

Click to comment

Expert Insights

Related Content

Audits

Out of the 335 public recommendations on a comprehensive cybersecurity strategy made since 2010, 190 were not implemented by federal agencies as of December...

Application Security

Electric car maker Tesla is using the annual Pwn2Own hacker contest to incentivize security researchers to showcase complex exploit chains that can lead to...

Application Security

Software maker Adobe on Tuesday released security patches for 29 documented vulnerabilities across multiple enterprise-facing products and warned that hackers could exploit these bugs...

Application Security

Fortinet on Monday issued an emergency patch to cover a severe vulnerability in its FortiOS SSL-VPN product, warning that hackers have already exploited the...

Application Security

Virtualization technology giant VMware on Tuesday shipped urgent updates to fix a trio of security problems in multiple software products, including a virtual machine...

Application Security

Password management firm LastPass says the hackers behind an August data breach stole a massive stash of customer data, including password vault data that...

Application Security

Big-game malware hunters at Volexity are shining the spotlight on a sophisticated Chinese APT caught recently exploiting a Sophos firewall zero-day to plant backdoors...

Application Security

Microsoft on Tuesday pushed a major Windows update to address a security feature bypass already exploited in global ransomware attacks.The operating system update, released...