4 ms·
I thought PCI DSS 3.0 was the new standard? Isn't certifying to 2.0 like saying you're Windows XP certified?
by god_bless_texas 12y ago
I thought PCI DSS 3.0 was the new standard?
Isn't certifying to 2.0 like saying you're Windows XP certified?
- jewel 12y agoIt's not quite that bad. 3.0 was released in November of 2013. It's allowed to be certified under 2.0 until the end of 2014. I'm not well-versed in the changes to know off the top of my head if any of the changes would matter to cloudfront.
- WatchDog 12y agoPCI DSS 3.0 is a mess at the moment. Under PCI DSS 2.0 merchants can relieve most of their PCI DSS burden simply by ensuring that the infrastructure and services that process those payments are PCI certified. The simplest way to do this is simply redirect the customer to a PCI certified payment gateway. PCI DSS 3.0 is much more broad and ambiguous, the current interpretation seems to be that every aspect of a merchants website and infrastructure needs to be PCI compliant, regardless of if it ever sees a credit card or not. The reasoning for the changes seems to be an increased number of compromised websites that would normally not accept credit cards directly, but once compromised the intruder can modify the website as they see fit and fool customers into providing card details. As you can imagine, the amount of work and money it would take to certify every aspect of a merchants web infrastructure is prohibitive, as a result until more clarification arises around the requirements, QSA's are recommending qualifying under PCI DSS 2.0 rather than 3.0.