Industrial organizations always attract attention from both cybercriminals and politically-motivated threat actors. Reflecting on the previous half year, we have seen among other findings, growth in the number of cyberespionage and malicious credential stealing campaigns. Their success has most likely been the main factor raising the ransomware threat to such [...]
An individual’s private work-from-home (WFH) environment is not considered a “sensitive area,” and personnel working from home are not required to meet PCI DSS Requirements 9.1.1 or 9.3 for their WFH environments.
“Personnel working from home”
Refers to individuals that are employed by an entity to perform business duties from the individual’s private residence; this does not include individuals running their own home-based business.
A sensitive area is typically a subset of the cardholder data environment (CDE) and is any area that houses systems considered critical to the CDE.
This includes data centers, server rooms, back-office rooms at retail locations, and any area that concentrates or aggregates cardholder or account data storage, processing, or transmission. Sensitive areas also include areas housing systems that manage or maintain the security of the CDE (for example, those providing network security or that manage physical or logical security).
As a WFH environment is not considered a sensitive area, it is not expected that video cameras and/or access control mechanisms are in place to monitor or physically restrict access within these environments.
Personnel working from home are expected to adhere to their organization’s security policies and procedures, including limiting access to cardholder data within their WFH environments.
For example, using only company-authorized devices to access cardholder data, locking computer screens when stepping away from the computer, securing any storage of paper copies of cardholder data to prevent unauthorized access, and following the organization’s policies for securing network and computer equipment used at home for work purposes.
The distributed architectures of cloud environments add layers of technology and complexity that challenge traditional assessment methods. As a result, it may be particularly challenging to validate PCI DSS compliance ...
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.