What would Cyber Security Awareness Month with a Standards theme be without discussing some semblance of PCI-related content? Carefully avoiding the debate over the benefits and drawback of PCI DSS, I'll instead focus on a recent read with a quick summary of PCI Mobile Payment Acceptance Security Guidelines for Developers. This guideline hit my radar on 14 SEP courtesy of Ian's Dragon News Bytes and was intriguing as I had just published Mobile application security best practices in a BYOD world a couple of weeks earlier in Information Security. After discussing the security risks of mobile devices the guidelines describe three core objectives:
Good start. Additional wisdom includes:
All common sense, but in my opinion not nearly enough substance to this 20 page document. Some section are single sentences: "4.7 Prefer online transactions - When the mobile payment-acceptance application on the host is not accessible, the mobile device should neither authorize transactions offline nor store transactions for later transmission." Agreed, no doubt, but a bit more detail might be in order. Something along the lines of guidance. If you're looking for more depth to this conversation, consider SANS SEC575: Mobile Device Security and Ethical Hacking. This course is recent addition and was "designed to help organizations struggling with mobile device security by equipping personnel with the skills needed to design, deploy, operate, and assess a well-managed secure mobile environment. From practical policy development to network architecture design and deployment, and mobile code analysis to penetration testing and ethical hacking, this course will help you build the critical skills necessary to support the secure deployment and use of mobile phones and tablets in your organization." With device proliferation rampant and emerging technologies such as near field communication (NFC) used for payment transactions, standards in the mobile development and deployment space are already essential. Make use of them at earliest. Let us know how you're addressing these issues in your enterprises. Cheers.
|
Russ McRee 204 Posts ISC Handler Oct 2nd 2012 |
Thread locked Subscribe |
Oct 2nd 2012 9 years ago |
All good advice regardless, but it should be noted that the scope of this PCI document, as I read it, pertains solely to store-owned devices used for POS. Examples would be Square, Apple Store EasyPay, etc.
|
Anonymous |
Quote |
Oct 2nd 2012 9 years ago |
Sign Up for Free or Log In to start participating in the conversation!