Protecting Against Emerging Threats: What You Need to Know About PCI DSS v 4.0’s New Controls

As online transactions grow in popularity, secure payment systems have become increasingly vital. As a result, organisations must comply with Payment Card Industry Data Security Standards (PCI DSS) to ensure these transactions are safe and secure. The latest version, PCI DSS v 4.0, was released in 2022 and included several new controls that must be implemented to enhance security.

One of the most significant changes in PCI DSS v 4.0 is the increased focus on risk management. Organisations must now conduct a comprehensive risk assessment to identify potential vulnerabilities in their payment systems. The assessment should include internal and external risks, such as those posed by employees, third-party vendors, and cybercriminals. Organisations must also implement risk-based approaches to address these vulnerabilities and ensure they have the appropriate controls.

Another new requirement in PCI DSS v 4.0 is protecting payment data at rest, in transit, and use. Organisations must use encryption to protect sensitive data, including cardholder information, from unauthorised access. The new standard also requires organisations to implement multi-factor authentication (MFA) for all non-console access to cardholder data. MFA is an essential security measure ensuring only authorised users can access sensitive data.

Organisations must also implement additional controls to protect against emerging threats such as phishing, malware, and ransomware attacks. One of the new controls is implementing rules that can detect and prevent ransomware attacks. Ransomware attacks are one of the most significant threats facing organisations today, and they can have devastating consequences. Therefore, the new standard requires organisations to have a ransomware response plan and to test it to ensure its effectiveness regularly.

Another new control is the need to implement controls to protect against supply chain attacks. Supply chain attacks are becoming increasingly common and can be difficult to detect and prevent. The new standard requires organisations to conduct due diligence on all third-party vendors and suppliers to ensure appropriate security controls are in place. Organisations must also monitor these vendors and suppliers for suspicious activity.

PCI DSS v 4.0 also places a greater emphasis on the need to maintain a secure network. Organisations must implement controls to monitor network traffic and detect unauthorised access or activity. The new standard requires organisations to have a network segmentation strategy to isolate cardholder data and prevent unauthorised access. Organisations must also implement controls to prevent and detect any unauthorised wireless access.

Another new requirement in PCI DSS v 4.0 is implementing controls to protect against physical security threats. Organisations must implement controls to protect against physical theft or unauthorised access to cardholder data. The new standard requires organisations to have a physical security plan that includes access control, video surveillance, and alarms.

Finally, organisations must implement controls to prepare for a data breach. The new standard requires organisations to have an incident response plan outlining the steps they will take in case of a violation. Organisations must also regularly test this plan to ensure its effectiveness.

In conclusion, PCI DSS v 4.0 includes several new controls that organisations must implement immediately to enhance the security of their payment systems. These controls focus on risk management, the protection of payment data, the detection and prevention of emerging threats, the maintenance of a secure network, the protection against physical security threats, and the preparation for a data breach. Organisations that fail to comply with these new controls risk facing severe consequences, including financial penalties, reputational damage, and legal action. To mitigate these risks it’s advisable for organisations to take the necessary steps to comply with PCI DSS v 4.0 and protect their customers’ payment data. Speak to one of Gradeons’ consultants…