P2PE v3.0 – Why organizations should prepare now
Andrey Sazonov, Senior Consultant, Application Validation, Coalfire
The Payment Card Industry Security Standards Council (PCI SSC) published version 3.0 of the Point-To-Point Encryption (P2PE) standard back in December 2019. The new version simplifies and adds flexibility to the process for component and solution providers to validate their P2PE products for cardholder data protection efforts and will ultimately result in more PCI P2PE solutions available in the market. Organizations should prepare now for moving to the new standard.
So Long, Privacy Shield
Paul Sonntag, Director, GDPR and Privacy
In what’s rapidly becoming the splashiest news to hit the privacy space in years, the Court of Justice of the EU (CJEU), the highest court in the European Union, invalidated the U.S. Privacy Shield, a legal instrument that made it possible for organizations operating in the United States to transfer EU personal data to the U.S.. To add to the impact, the CJEU provided no grace period for this change, meaning that the 5,000+ organizations currently enrolled in the Privacy Shield program are effectively out of compliance as of the decision’s publication on July 16.
So much compliance to do…so little time (and people!)
Kevin Tonkin, VP, Engineering, Coalfire
In my seven years at Coalfire I've had the pleasure of working with dedicated compliance professionals at organizations of all shapes and sizes. Over time I've seen the pressure on these fine folks increase tenfold as the stream of new compliance obligations jumps its banks and becomes a flood. The pressure increases as their organizations try to enter new markets but find they’re thwarted because of new compliance requirements. I hear the same thing over and over – they have too much to do and not enough people to do it.
State privacy laws: 2020 highs and lows
Elizabeth Crooks, Consultant, Privacy, Coalfire
2020 is shaping up to be another interesting year for data privacy, especially given that public health agencies, private companies, and states are now working feverishly to create contact tracing apps and programs while still preserving privacy. Being thoughtful and accountable about data privacy is more important than ever, as some states have made very public mistakes in the rush to roll things out.
The Basics of Exploit Development 4: Unicode Overflows
Andy Bowden, Consultant, Coalfire Labs
If you have read the previous articles in this series, welcome back and keep reading. If not, I would encourage you to read those first before proceeding, as this article builds on concepts laid down in the previous installments. In this article, we will be covering a technique similar to the one in the second installment of this series but with the twist of the character encoding of the input being in Unicode. In order to demonstrate how to get around this impediment, we will be writing parts of the payload and doing some stack realignment manually. Read more