Security and Compliance Blog

PCI PIN Security: v3.0 and QPA Program Now in Effect

October 10, 2019 • Published by Sam Pfanstiel
Encryption • Payment Security • PCI Compliance

As of last week—October 1 to be exact—all new assessments for protection of payment card personal identification number (PIN) data must be performed against the latest Payment Card Industry (PCI) PIN Security Requirements and Testing Procedures, version 3.0. The now-effective PCI PIN Security Standard includes changes to requirements and sunset dates that may have a […]

Security Patching: How Fast is Fast Enough?

October 3, 2019 • Published by Tom Callahan
Active Monitoring • MDR • Network Security

October is National Cyber Security Awareness Month (#NCSAM), and one of the topics I like to bring up is security patching. Just about every IT leader will tell you that timely security patching is a priority for their organization. So why did our latest ControlScan research find that 43% of IT teams are taking more than a week to implement even the most critical of security patches?

Protect Your Website from E-Commerce Skimming

August 13, 2019 • Published by Sam Pfanstiel
Coronavirus • Payment Security • Website Security

A new exploit known as e-commerce skimming is making the rounds. The PCI SSC recently released a blog warning of the growing threat of digital skimming, followed immediately by a bulletin from Visa warning of the same. There are three important areas to consider that will help protect your website from e-commerce skimming.

Featured

Tales from the SOC: Surprise! You’ve Got Active Malware.

June 28, 2019 • Published by Tom Callahan
Active Monitoring • MDR

Late in the day on a recent Friday, a new customer began installation of the ControlScan Managed Detection and Response (MDR) service to their end user systems. This customer is an SMB (small to mid-sized business) that relies on personal computers to keep their business running. Sound familiar?A few hours after the customer’s implementation was complete—at 12:05 a.m. Saturday to be exact—our MDR service blocked an attempted execution of malware that was present on one of their remote office computers.As it turns out, this active malware had been on the remote office machine since October 2018. With each user login, the malware was executing and performing data harvesting, as well as making attempts at lateral movement and propagation.

How Much Security is Enough?

May 20, 2019 • Published by Tom Callahan
Risk Management

Every diligent company or organization understands cybersecurity is needed, but often doesn’t know how to budget for the appropriate protection. It’s not always a clear-cut number, but there is a way to develop a return on investment (ROI) or return on expense (ROE) equation that you can share with your budgeting team and C-level executives who are looking to you for answers.

3 Cybersecurity Functions That Should Not Be On ‘Autopilot’

April 25, 2019 • Published by Tom Callahan
Endpoint Security • MDR • Network Security

When cybersecurity coverage gets slim—whether it’s due to a lack of internal expertise or technology capabilities, or both—key business functions tend to go on what I call “autopilot.” Firewalls run using outdated configurations, legitimate security threats go unnoticed, and everyone is just hoping today isn’t the day an employee clicks a bad link and unleashes a crippling malware attack. Learn about the three business functions that should never be put on cybersecurity autopilot, and how to proactively address your organization’s expertise and manpower challenges.

Data Breach vs. Fraud: What’s the Difference?

March 20, 2019 • Published by Chris Bucolo
Payment Security • Point of Sale

Counterfeit payment cards, stolen payment cards, use of an assumed identity to complete a credit card application… these are easily-recognizable examples of payment card fraud. When a fraud incident occurs in the retail setting, it’s often contained with only small losses occurring to the merchant involved. But what happens when a payment card data breach occurs at that same business? Are its causes and consequences basically the same?

SMB Data Monitoring: Yes, It’s a Thing.

January 29, 2019 • Published by Tom Callahan
Active Monitoring • MDR • SIEM

A lot of data runs through your business’s network. Data is coming and going, and moving rapidly, as systems and applications “talk” and pass along information to each other. Most SMBs pay no attention to these internal workings and conversations, unless there is a functional failure that requires someone’s review of the system logs to determine where the breakdown occurred. The rapid increase in malware, however, is causing many executives to choose a more active IT security strategy.

ControlScan Blog

Stay informed with the latest security + compliance updates, news and best practices.

PCI PIN Security: v3.0 and QPA Program Now in Effect

Read More

Security Patching: How Fast is Fast Enough?

Read More

Protect Your Website from E-Commerce Skimming

Read More

Tales from the SOC: Surprise! You’ve Got Active Malware.

Read More

How Much Security is Enough?

Read More

3 Cybersecurity Functions That Should Not Be On ‘Autopilot’

Read More

Data Breach vs. Fraud: What’s the Difference?

Read More

SMB Data Monitoring: Yes, It’s a Thing.

Read More