Details surrounding the updated Payment Card Industry Data Security Standard show that version 3.2 includes new multifactor authentication and encryption requirements. Also in recent GRC news: SEC enforcement actions — or the lack of them — are raising concerns about the agency’s ability to regulate Wall Street, and IBM rolled out security and compliance standards for blockchain technology use.
Multifactor authentication one of the biggest changes in PCI DSS 3.2
The Payment Card Industry Data Security Standard (PCI DSS) version 3.2 was published on April 28, 2016, and includes stronger encryption and multifactor authentication requirements. The new version also provides criteria for PCI DSS compliance programs, as well as specific dates for banks and merchants to implement the changes.
PCI Security Council CTO Troy Leach said the requirement to implement multifactor authentication for any type of administrative access to payment card data and systems is the biggest change in PCI DSS 3.2. Leach added that a password alone is not enough to very a user’s identity and grant access to sensitive data, even within a company’s own network.
To prepare for this change, Leach recommends that organizations review how they manage data access authentication and examine administrator roles to find the areas that will most likely be affected by the new requirement.
Goldman Sachs cases call SEC’s watchdog role into question
Recent articles by media outlets The New Yorker and Fortune have called into question whether the Securities and Exchange Commission (SEC) is able to adequately regulate Wall Street because it failed to call one firm to task.
The New Yorker highlighted the SEC’s decision not to pursue charges against Goldman Sachs senior executives for their role in a complex deal known as Abacus that the SEC believed involved securities violations by the Wall Street firm. Fabrice Tourre, a low-ranking trader at Goldman, was the only person held liable for any wrongdoing. Although the SEC considers the 2013 case a success, documents provided to The New Yorker by a lawyer who was assigned to the case showed that “SEC officials considered and rejected a much broader case against Goldman.”
Fortune, meanwhile, focused on a Goldman mortgage bond called Fremont Home Loan Trust 2006-e that included more than 5,000 residential subprime mortgages. The SEC had evidence that many of the loans were deficient, including 10% that were classified as EV3s, or “unacceptable risks.” Yet Goldman still waived these deficient loans into the mortgage bond deal, which eventually cost investors more than $500 million when they went into default. While the SEC sent Goldman a notice in February 2012 saying that the regulator was planning on pressing civil fraud charges based on the mortgage bonds, Goldman said in a securities filing in August of that year that the SEC had dropped the case. In April 2016, the U.S. Department of Justice reached a nearly $5.1 billion settlement with Goldman for defrauding investors using mortgage-backed securities.
As GDPR grace period approaches, questions abound
The two-year grace period for companies to prepare for the General Data Protection Regulation, the European Union’s overhaul of its data protection laws, is expected to begin in May. The GDPR’s provisions, however, vary extensively between the 28 EU member countries and create a lot of ambiguity, legal experts told The Wall Street Journal.
These unclear mechanisms include how companies can protect their intellectual property under the regulation and how data use consent is granted.
Companies will likely use the 24-month grace period not only to prepare for the GDPR’s passage, but also to navigate these ambiguities, according to the legal experts. EU officials also said that despite having a privacy working group and a privacy board providing guidance to companies regarding the GDPR mandates, they must still be translated in a manner that accurately conveys the law’s concepts in the 24 working languages used throughout the EU.
IBM releases new blockchain security standards
IBM last week announced a framework to help companies across several industries securely run blockchain technology that underpins Bitcoin and other digital currencies. Jerry Cuomo, vice president of blockchain for IBM, told Forbes that the standards are aimed to help companies in industries such as financial services, healthcare and government navigate data security regulations. Under the new standards, companies using IBM’s cloud-based blockchain technology will be able to create comprehensive log data to use for audits and compliance. IBM’s framework could also help companies comply with data privacy regulations such as the Gramm leach Bliley Act, HIPAA and the EU Data Protection Directive, Cuomo added.