PCI Data Security Standard v4.0
こんにちは、丸山満彦です。
PCI Security Standards Council: PCI SSC が、PCI Data Security Standard: PCI DSS v4.0を公開していますね。。。原稿のV3.2.1は2年後の2024.03.31に廃止されますね。。。
● PCI SCC
・2022.03.31 (press) Securing the Future of Payments: PCI SSC Publishes PCI Data Security Standard v4.0
変更点については、
| Examples of the changes in PCI DSS v4.0 include: | PCI DSS v4.0の変更点の例としては、以下が挙げられます。 |
| Updated firewall terminology to network security controls to support a broader range of technologies used to meet the security objectives traditionally met by firewalls. | ファイアウォールの用語をネットワークセキュリティ制御に更新し、従来ファイアウォールによって満たされていたセキュリティ目標を満たすために使用される、より幅広い技術のサポート。 |
| Expansion of Requirement 8 to implement multi-factor authentication (MFA) for all access into the cardholder data environment. | カード会員データ環境へのすべてのアクセスに多要素認証（MFA）を実装するための要件 8 の拡張。 |
| Increased flexibility for organizations to demonstrate how they are using different methods to achieve security objectives. | セキュリティ目標を達成するために、組織がさまざまな方法を使用していることを実証するための柔軟性の向上。 |
| Addition of targeted risk analyses to allow entities the flexibility to define how frequently they perform certain activities, as best suited for their business needs and risk exposure. | ターゲットリスク分析の追加により、事業者がビジネスニーズと影響を受けるリスクに最適な形で、特定の活動の実行頻度を柔軟に定義できるようにすること。 |
ということのようです。。。
で基準は...
360ページありますね(^^)...
目次...
| 1 Introduction and PCI Data Security Standard Overview |
| 2 PCI DSS Applicability Information |
| 3 Relationship between PCI DSS and PCI SSC Software Standards |
| 4 Scope of PCI DSS Requirements |
| 5 Best Practices for Implementing PCI DSS into Business-as-Usual Processes |
| 6 For Assessors: Sampling for PCI DSS Assessments |
| 7 Description of Timeframes Used in PCI DSS Requirements |
| 8 Approaches for Implementing and Validating PCI DSS |
| 9 Protecting Information About an Entity’s Security Posture |
| 10 Testing Methods for PCI DSS Requirements |
| 11 Instructions and Content for Report on Compliance |
| 12 PCI DSS Assessment Process |
| 13 Additional References |
| 14 PCI DSS Versions |
| 15 Detailed PCI DSS Requirements and Testing Procedures |
| Build and Maintain a Secure Network and Systems |
| Requirement 1: Install and Maintain Network Security Controls |
| Requirement 2: Apply Secure Configurations to All System Components |
| Protect Account Data |
| Requirement 3: Protect Stored Account Data |
| Requirement 4: Protect Cardholder Data with Strong Cryptography During Transmission Over Open, Public Networks |
| Maintain a Vulnerability Management Program |
| Requirement 5: Protect All Systems and Networks from Malicious Software |
| Requirement 6: Develop and Maintain Secure Systems and Software |
| Implement Strong Access Control Measures |
| Requirement 7: Restrict Access to System Components and Cardholder Data by Business Need to Know |
| Requirement 8: Identify Users and Authenticate Access to System Components |
| Requirement 9: Restrict Physical Access to Cardholder Data |
| Regularly Monitor and Test Networks |
| Requirement 10: Log and Monitor All Access to System Components and Cardholder Data |
| Requirement 11: Test Security of Systems and Networks Regularly4 |
| Maintain an Information Security Policy |
| Requirement 12: Support Information Security with Organizational Policies and Programs |
| Appendix A Additional PCI DSS Requirements |
| Appendix A1: Additional PCI DSS Requirements for Multi-Tenant Service Providers |
| Appendix A2: Additional PCI DSS Requirements for Entities Using SSL/Early TLS for Card-Present POS POI Terminal Connections |
| Appendix A3: Designated Entities Supplemental Validation (DESV) |
| Appendix B Compensating Controls |
| Appendix C Compensating Controls Worksheet |
| Appendix D Customized Approach |
| Appendix E Sample Templates to Support Customized Approach |
| Appendix F Leveraging the PCI Software Security Framework to Support Requirement 6 |
| Appendix G PCI DSS Glossary of Terms, Abbreviations, and Acronyms |
概要
・[PDF] PCI DSS v4.0 At a Glance
変更点
・[PDF] Summary of Changes from PCI DSS Version 3.2.1 to 4.0
説明
PCIについては、最近書いてませんでしたね。。。
でも、色々と本質的なことを書いていますね。。。
● まるちゃんの情報セキュリティ気まぐれ日記
・2010.10.30 PCI Security Standards Council Releases PCI DSS 2.0 and PA-DSS 2.0
・2009.10.13 JIPDEC クレジット加盟店向け“情報セキュリティのためのガイド”（PCI DSS／ISMS準拠のためのガイド）を公開
・2008.06.06 「どこまで情報セキュリティ対策をすればよいのかわからない」という不満について
・2006.08.13 対策強度×保証強度
・2005.06.27 米国カード情報流出と情報セキュリティ監査
・2005.04.27 ビザとマスターカード、大手販売業者にセキュリティ対策を義務付け
・2006.07.05 クレジットカード業界のセキュリティ
Comments