PCI SSC Releases v3.1, Eschews SSL, Early TLS

After Browser Attacks like POODLE and BEAST Took Advantage of Vulnerabilities in Secure Sockets Layer (SSL), the Latest Update to the PCI Data Security Standard, PCI DSS Version 3.1, Released Thursday has Ditched SSL and Early Transport Layer Security (TLS) Encryption Protocols in Favor of the More Secure Current Version of TLS. Noting “Inherent Weaknesses” Identified in SSL by the National Institute of Standards and Technology (NIST) that Could Put Payment Data at Risk, a PCI Council Release Said that, Upgrading to a More Secure Version of TLS, SSL's Successor, "is the only known way to remediate these vulnerabilities”. “The fact that the PCI Council saw fit to release an out-of-band update underscores the real threat that the recent SSL and TLS vulnerabilities pose to payment security”, Brendan Rizzo, Technical Director, HP Security Voltage, Said in an Email Statement Sent to SCMagazine.com. Because SSL and TLS “pre-date the advanced threats we see today”, Mark Bower, Global Director, Product Management, HP Security Voltage, Explained in an Email Statement to SCMagazine.com, “they only protect data in transit for limited paths”. TLS, he Noted, “is often terminated at a load balancing tier, for example, before the data then enters cloud or web applications”.


Version 3.1 Addresses the Risk by Removing SSL and Early TLS as Strong Cryptography Examples in Updates to the Standard's 2.2.3, 2.3 and 4.1 Requirements. While the Council Said the Revisions were Effective Immediately it did Allow a “Sunset Date” of June 30, 2016 so that, Organizations Have Time to Make the Changes but, those Companies Must Implement a Formal Risk Mitigation and Migration Plan in the Meantime. After that Date, Organizations Can No Longer Use Early TLS and SSL as Security Controls to Safeguard Payments. The Exception is Point of Sale (POS) Terminals that Aren't Susceptible to any of the Exploits Known for Vulnerable Versions of the 2 Protocols. Referring to the 14-Month Transition Period as “Liberal” Enough to Give Companies Adequate Time to Make Changes, Rizzo Urged Companies to “begin planning now in order to make sure that they do not overrun” the Deadline. He Warned that Companies that Don't Begin Formalizing Security Upgrade Plans “could result in tough questions being asked and, ultimately, in significant reputational damage” if a Breach Occurs, Even before the PCI Council's Implementation Deadline.


New Implementations Aren't to Use SSL or Early TLS Protocols either, the PCI Council Said. PCI SSC General Manager, Stephen W. Orfei, in a Statement in the Release Said, with Updated Standards, which are “based on industry and market input”, the PCI SSC is “arming organizations with a pragmatic, risk-based approach to addressing the vulnerabilities within the SSL protocol that can put payment data at risk”. Despite the Fixes and its Clear Instructions to Organizations to Implement Change, though, “the SSC has a challenging role in trying to balance the risk of vulnerable protocols against the logistical challenges faced by merchants and other organizations involved in the transmission of payment card data”,  Andrew Wild, Chief Information Security Officer (CISO) of Lancope, Said in a Statement Emailed to SCMagazine.com. “Unfortunately, coordinating the widespread upgrade or replacement of payment card hardware/software isn't trivial, given how geographically distributed the payment systems are.” The Group will Retire PCI DSS Version 3.0 on June 30, 2015 but, the Version 3.1 is Available Now on the PCI SSC Website.




Info Source:

https://www.pcisecuritystandards.org/pdfs/15_04_15%20PCI%20DSS%203%201%20Press%20Release.pdf