maravis.com

I get a lot of questions from clients going through PCI or PA DSS assessments about what encryption and key strengths to use. The requirements just say that strong encryption should be used without going into details on algorithms or key strengths. Most people have no clue on what can be used and what cannot.

The next version of both the PCI and PA DSS standards are going to be officially released Oct 28, 2010. The new standards will take effect Jan 11, 2011.

I have written earlier about insider attacks and the need to protect data and resources from employees and others within an organization just as they would be against external threats. There have been several publicized breaches involving insiders, such as when Verizon employees looked up Obama’s records.