Michael Engle is Cofounder at 1Kosmos and was previously head of InfoSec at Lehman Brothers and Cofounder of Bastille Networks.
In April 2024, PCI DSS version 4.0 will come into effect with new identity and access management mandates that promise better security but bring new challenges. For savvy security leaders, this transition will create an opportunity to modernize identity frameworks and controls.
Implementing MFA Across All Platforms
To begin with, version 4.0 requires the implementation of MFA access across all cardholder data environments (CDEs), as well as all individuals accessing those systems, not merely administrators. This requirement applies to on-premises applications, network security devices, desktop devices, servers, cloud and hosted systems and all endpoints.
The new MFA requirements extend beyond companies and their customers, including vendor and third-party accounts. These accounts must be subject to least privilege policies and continuously monitored for vulnerabilities and security risks.
Because of these changes, security teams must assess all CDE access points and existing MFA solutions to make sure there are no coverage gaps.
Addressing Legacy System Gaps
Among the covered systems, two areas may require special attention. The first is older legacy systems. These often use proprietary access mechanisms, which complicate compliance with MFA requirements. The second is special privileges given to the administrators of these systems. While these privileges may seem necessary or convenient in many cases, they can magnify implementation and audit challenges.
More Complex Password Rules
Another challenge with version 4.0 is the new password rules. Passwords will require 12 characters versus the previous seven and must include numeric, alphabetic (both upper and lower case) and special characters such as # or &. (The mandatory 90-day reset requirement remains in effect.) These new provisions will clearly have a negative effect on the user experience. Longer, more complex passwords will be harder to remember and may encourage insecure practices, such as using the same password for multiple accounts.
Finally, account lockouts will be required after 10 failed attempts, with a lockout duration of 30 minutes. This may impair productivity in some cases. Also, the implementation of this requirement necessecitates identity system enforcement capabilities.
Beyond these specifics, version 4.0 puts more emphasis on continuous security processes and enhanced validation. It also provides more flexibility on how organizations achieve the desired results, opening the door for alternative approaches.
An Opportunity To Modernize
Given the magnitude of changes mandated, CISOs should see version 4.0 as an opportunity to upgrade their security posture. Today’s modern architectures can streamline IT workflows and make the user experience simpler rather than more complicated. Here are some best practices for evolving security systems to the new levels that can now be achieved.
The first step is to centralize security operations on a cloud-based identity platform. This allows security operations to leverage the PCI expertise of identity vendors and benefit from their ability to evolve as threats become more sophisticated and standards change to deal with these new threats.
The next step is to embrace identity-based passwordless authentication. This can be achieved through a combination of biometrics and public key cryptography. This approach not only simplifies the user experience by eliminating the need for complex passwords, but it also meets MFA requirements. Beyond identity-based authentication, access control procedures can and should be adaptive, based on the level of risk as well as the context, so that security is maintained without hindering productivity. Identities can be verified at any time during a customer journey allowing for minimal friction.
While upgrading your security posture, it makes sense to take advantage of the automation tools that are now available for security workflows. Beyond the obvious benefit of greater efficiency, automation also eliminates the human errors that come with manual processes and ensures consistency in policies across multiple applications.
The bottom line in all these improvements is compliance, and for this reason, it’s important to have detailed authentication logs available to provide audit trails.
Data breaches are a disaster for any organization, especially for consumer-facing businesses. They impose millions of dollars in direct remediation efforts and can damage a brand’s reputation for years. The new requirements contained in PCI DSS v4.0 create new, stronger barriers for bad actors. Meeting these requirements is well worth the effort.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
