Blue Lance InfoSec Blog

Update: MasterCard Responds to Questions About New Audit Requirements

A representative from MasterCard contacted Blue Lance today with the following response to our queries.  Chris Harrall, Senior Business Leader for MC’s Payment System Integrity Group responded with this Q & A:

Q: Is it accurate that MasterCard will require Tier 2 merchants to conduct annual on-site reviews of their security controls by third party QSAs?

A: The company announced revised requirements for Level 2 merchants to use a Qualified Security Assessor (QSA) to complete a mandatory annual onsite data security assessment by December 31, 2010.

Q: If so, when was the change made and why?

A: These changes were announced in the MasterCard Global Security Bulletin No. 6 published on June 15, 2009 and distributed directly to MasterCard acquirers and processors. The current enhancement of validation requirements for PCI compliance provides for independent third party review, enabling consistency of application and implementation of DSS requirements.

Q: How much time do Tier 2 merchants have to comply with the new requirement?

A: Level 2 merchants must use a Qualified Security Assessor (QSA) to complete a mandatory annual onsite data security assessment by December 31, 2010.

To view the post regarding this requirement change, click here.

Nevada Mandates PCI Standard

The state of Nevada is going all in.  By January 1, 2010, every payment card-accepting business in the state of Nevada will be required to comply with PCI DSS regulations.  Nevada is the first state to mandate PCI compliance, trumping Massachusetts, the former data security leader in the US (as far as laws are concerned).

This legislation is more of a statement than an actual change as far as companies accepting credit cards are concerned; all businesses accepting payment card transactions are already required to comply with PCI DSS regulations, and can be fined by PCI if regulations are not adhered to.  Conversely, the state of Nevada had made no remarks about penalties that would be incurred if their new PCI law is broken.

The group to be affected by this legislation most is companies dealing with non-credit card personal data, such as Social Security numbers, drivers’ license numbers, and account numbers in combination with passwords.  Encryption requirements are included in the new law for transfers of these types of personal information outside of a company’s control, though some form of those requirements existed prior to the new legislation.

View the legislation

MasterCard to Increase PCI Compliance Requirements for Level 2 Merchants

As of December 31^st, 2010, all merchants processing between one and six million MasterCard transactions annually will have to undergo a yearly on-site audit to confirm PCI compliance, according to the company’s Site Data Protection Program.  MasterCard has yet to reply to queries regarding the reasoning behind this decision.

Lee Pierce of Security Metrics, a third-party PCI DSS auditing company, speculates that the change was made due to the increasing number of high profile security compromises that have occurred lately.  Pierce expects an increase in call volume to Security Metrics and companies like it from the many Level 2 classified merchants who will now require their services.

This change will put a dent in the budgets of Level 2 merchants, who are presently only required to perform an annual self-assessment, but should ensure more comprehensive PCI DSS compliance.  It is unclear at this time if other credit card companies will follow suit.

MasterCard’s website still states that Level 2 merchants are required to self-assess.  It remains to be seen if this double requirement is apparent simply to ensure that some type of assessment is taking place until the date set for the onsite assessment change, or whether it will remain so to back up either party's compliance conclusions.

Insider Reportedly Arrested in Sony Card Data Theft

Databreaches.net reports that Sony discovered a breach in May where credit card data obtained through the Sony Rewards web site had copied and in some cases, emailed to an outside account.  The data included credit card numbers, names and expiration dates.

After an investigation, a suspect was arrested within Sony's Park Ridge offices.  Sony has sent notices to approximately 5000 customers.

Read the full story

NIST SP 800-53 Solution Brief Now Available

Blue Lance released its LT Auditor+ Solution Brief today for IT controls outlined within SP 800-53 - Recommended Security Controls for Federal Information Systems produced by the National Institute of standards and Technology (NIST).  The document illustrates how LT Auditor+ maps to the NIST IT controls as documented in the framework.  The document is one of several solution briefs being developed on IT security regulations and frameworks including GLBA, FISMA, and Sarbanes-Oxley.

LT Auditor+ is an important step on the path to IT security and compliance.  The tools provide detailed audit trails for Novell NetWare and eDirectory as well as Microsoft Windows file systems, Active Directory and Group Policy.  It allows security and compliance teams to monitor, report and alert on access and changes to sensitive files and configuration settings.

The SP 800-53 Solution Brief is available now through the LT Auditor+ User Center.

Kaiser Hospital Hit with $250,000 Fine After Breach

The LA Times is reporting that Kaiser Permanente's Bellflower hospital has been fined $250,000 by the California Department of Public Health over a breach that occurred in January of this year.

The California Department of Public Health charged that the hospital "failed to prevent unlawful or unauthorized access to, or use or disclosure of a patient's medical information".  It is the first monetary penalty from an amendment to the California Health and Safety Code enacted January 1.

In all, the investigation found that 21 employees and 2 physicians viewed Nadya Suleman's medical record without need or authorization.  Many of the accesses had apparently taken place after the initial breach notification to the state.

I think California is sending a clear message here about their commitment to enforcement here.  I will also be interested to see if HHS will follow California's lead with its own penalties for HIPAA violations.

LA Times Article

California Penalty Notice

U.S. ICE Legislation Aims to Refocus Goverment IT on Security

Last week, the Senate introduced the United States Information and Communications Enhancement Act of 2009, also known as U.S. ICE in an effort to reform FISMA.

FISMA had long been characterized as waste of time with a focus primarily on compliance and paperwork, with very little focus on security.  Several high profile breaches over the years since FISMA was enacted have brought Federal information systems security back into the spotlight, encouraging Congress to reexamine the issue.

The U.S. ICE Act will create the National Office of Cyberspace, headed by a presidential appointee, and will be responsible for, "coordinating issues relating to achieving assured, reliable, secure, and survivable global information and communications infrastructure and related capabilities."

According to a recent presentation by Erik Hopkins, the goals of the U.S. ICE legislation will

• Recognized global interconnectedness

• Increased situational awareness by leverage the resources of the entire Federal government

• Greater accountability within agencies

• Enhanced monitoring, detection, and responsive

• Elimination of distinction between NSS/ NNSSS

• Effective partnership between public demand and private supply

The bill is available for download in PDF format from here.

HHS Issues HITECH Act Notification Guidance

The Department of Health and Human Services on Friday issued guidance for breach notifications as required by Subtitle D of the Health Information Technology for Economic and Clinical Health (HITECH) Act.

The guidance specifies the technologies and methodologies that render protected health information unusable, unreadable, or indecipherable to unauthorized individuals.  According to the announcement,

This guidance relates to two forthcoming breach notification regulations – one to be issued by HHS for covered entities and their business associates under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Sec. 13402 of HITECH) and one to be issued by the Federal Trade Commission (FTC) for vendors of personal health records and other non-HIPAA covered entities (Sec. 13407 of HITECH).  HITECH requires these regulations to be published within 180 days of enactment.  If the entities subject to the regulations apply the technologies and methodologies specified in the guidance to secure information, they will not be required to provide the notifications required by the regulations in the event the information is breached.

The HHS also issued a request for information (RFI), asking for public comment of the breach notification provisions.  Once published, comments may be submitted through www.regulations.gov.

COBIT 4.1 Solution Brief Now Available

Blue Lance released its LT Auditor+ Solution Brief today for compliance with the COBIT 4.1 Framework.  The document illustrates how LT Auditor+ maps to the COBIT controls as documented in the framework.  The document is one of several solution briefs being developed on IT security regulations and frameworks including GLBA, FISMA, and Sarbanes-Oxley.

Summary
LT Auditor+ is an important step on the path to compliance with COBIT.  The tools provide detailed audit trails for Novell NetWare and eDirectory as well as Microsoft Windows file systems, Active Directory and Group Policy.  It allows security and compliance teams to monitor, report and alert on access and changes to sensitive files and configuration settings.

The COBIT 4.1 Solution Brief is available now through the LT Auditor+ User Center.

Former Employee Arrested in Fox Data Breach

A former employee of Fox Entertainment Group was arrested last week for stealing the confidential information of approximately 10 other employees of the company.  The data included names, social security numbers and compensation information.  The employee had worked in the benefits department at Fox.

After becoming aware of the breach, Fox notified law enforcement, who subsequently arrested the former employee.  The data was recovered in the former employee's home during the execution of a search warrant.

In the Notice of Security Breach submitted to the New Hampshire Attorney General's Office, Fox Vice President Timothy Lykowski stated "We have no evidence to suggest that this personal information was disseminated by the employee to any third party or otherwise misused."