vulnerabilities were corrected.” Since 11.3 refers to penetration tests occurring at least annually and whenever there are significant changes in the environment, one could assume that any noted vulnerabilities (not requiring a patch) must be corrected either within a year or before the test scheduled after a major upgrade.
(I suppose I could have also included the recent PCI guidance in the supplement on requirement 6.6, but I think you get the point.)
Thus, PCI’s position on “fast patching” may reasonably be interpreted as follows. If a security vulnerability can be addressed by a patch, the patch must be applied within 30 days. If a security vulnerability is discovered by a network vulnerability scanner but the vulnerability cannot be addressed by a patch, the vulnerability must be fixed before the next quarterly scan. If a vulnerability is only discovered during a penetration test (and cannot be fixed by a patch), then it must be remediated within a year and maybe sooner (if a penetration test is required because of a major upgrade).
Aside from the fact that these well-intentioned requirements don’t really seem to be in synch with one another, what is obvious is that these requirements have differing levels of impact on agility. Additionally, if the conclusions of Verizon’s research are correct, it would appear that PCI DSS requirement 6.1′s focus on 30 days is not justified by the evidence.
Popularity: 2%
2 Comments
Well said Jeff.
I would be willing to bet that they (The Payment Card Industry) do not follow their own patching mandate. It reflects the overall problem with PCI DSS, that it is too prescriptive but fails to meet the intended objective. We can draw a similar parallel to the Department of Defense where they often have a checklist that they have to go through to show compliance with a security directive. The problem with them is you can show compliance with the checklist or with PCI and be inadequately secured, thus meeting the letter of law but failing at the intent. It is time for the PCI to start thinking about adopting a different tactic.
In my opinion, certification to ISO/IEC 27001 would do much more to meet the intent of PCI DSS than PCI DSS does today.
Thanks for the mention, Jeff! I’m glad we inspired you to do this, and I’ve posted some thoughts in response at http://www.emergentchaos.com/archives/2008/06/in_the_land_of_the_blind.html