New PCI DSS Scoping Guidance Corroborates Coalfire’s Approach

Shawn Shifflett, CISSP, QSA, Senior Practice Director, PCI

On Friday, December 6th 2016, the PCI Security Standards Council released their formal information supplement titled, Guidance for PCI DSS Scoping and Network Segmentation. This particular information supplement has been eagerly anticipated in the PCI DSS industry for several years. The document seeks to address some of the numerous, and often extremely varying, interpretations of scoping and segmentation requirements across the QSA population. These scoping choices have immediate impact on near-term costs and attainment of compliance, but ultimately they significantly impact a company’s security posture. How does this affect Coalfire customers? The impact should be fairly limited if you have worked with Coalfire and accepted our recommendations to align with the information that we had from our involvement in the PCI Community.

What’s Your Computer Thinking About? Examining Random Access Memory (RAM)

Robert Meekins, Director, Forensics, Coalfire

How valuable would it be to be able to read another person’s mind? To know what they’re thinking or planning to do would be invaluable. Or, how valuable would it be to know what they have done in the recent past, especially if you believed they were involved in some criminal activity? Who they were talking to, or what they said. If you could recreate the events and determine the timeline of activity, information like this could help you in solving plenty of mysteries.

FedRAMP in Bloomberg

Abel Sussman, Senior Project Manager, Commercial Services, Coalfire

Recently Bloomberg Government published an article that describes the increasing awareness of the Federal Risk and Authorization Management Program (FedRAMP) as a major factor affecting the federal marketspace. The article indirectly indicates a major first-mover advantage, as there are “only 77 products” available to fulfill over two hundred Bloomberg-identified FedRAMP opportunities.

New PCI NESA Guidance is Good News for Non-Listed Encryption Solutions

Sam Pfanstiel, Senior Consultant, P2PE, Coalfire

While PCI P2PE is still the most secure approach, solution providers, who are not yet validated, can now offer additional clarity to merchants, QSAs, and acquirers