Enhanced validation methods and procedures

2022 PSR

Please provide the information below to view the online Verizon Payment Security Report.

First Name: Last Name: E-mail: Organization: Organization type Country:

The information provided will be used in accordance with our terms set out in our Privacy Notice. Please confirm you have read and understood this Notice.

By submitting the form, you are agreeing to receive insights, reports and other information from Verizon and affiliated companies in accordance with our Privacy Policy. California residents can view our California Privacy Notice.

I confirm I have read and understood

Verizon may wish to contact you in the future concerning its products and/or services. If you would like to receive these communications from Verizon, indicate by selecting from the dropdown menu below. Please note that you can unsubscribe or update your preferences at any time.

Indicates a required field. The content access link will be emailed to you.

View only

Thank You.

Thank you.

You will soon receive an email with a link to confirm your access, or follow the link below.

Download this document

Thank you.

You may now close this message and continue to your article.

Major changes introduced by PCI DSS v4.0 include enhanced validation methods and procedures, which evolved from a defined-only approach to include an objective-based customized approach. The PCI SSC announced the plan to introduce these enhanced validation methods and procedures into PCI DSS v4.0 at the 2019 Community Meetings.

The traditional defined approach is the familiar method where required security controls must be implemented when applicable. Requirements need to be met in a very specific manner and validated, sometimes regardless of the actual control outcome, such as whether or not the control system in question is actually effective and sustainable. This method for validating PCI DSS won’t be going away with v4.0. But the new customized approach allows organizations to use security methods that differ from traditional PCI DSS requirements, as long as they can demonstrate that they meet the intent of the relevant PCI DSS requirements and can validate its effectiveness.

Within a PCI DSS compliance assessment, organizations can choose either or both of the approaches on any of the key requirements. For example, PCI DSS v4.0 allows organizations to take a hybrid approach: They are allowed to meet some requirements by following the defined approach and other requirements by following the customized approach. Even within a single DSS requirement, the defined approach and customized approach can be split to meet different aspects of the requirement, as long as the organization meets the security objective of the requirement. However, be aware that some requirements explicitly cannot be met using the customized approach.

The defined approach

The defined implementation refers to the existing traditional approach to security control implementation and compliance validation that has existed since the introduction of the PCI Standard. The sets of requirements, controls and test procedures are fairly prescriptive. The PCI Standard includes descriptions of the controls that need to be in place and how the validation testing procedures should be met.

The defined approach simply means that organizations follow the current requirements and familiar testing procedures as written in the PCI DSS. This approach remains valid. All organizations can continue to benefit from its prescriptive directions. Many organizations may not see any need to follow a customized approach to meet the control objectives.

A customized approach typically requires additional documentation effort for:
Control design, with evidence that it meets the control objective and intent Internal control testing Control risk Control performance Control effectiveness Control maintenance External control compliance validation testing procedures

This alternate approach allows organizations to customize their approach and develop security controls by meeting several criteria:
- Determine the controls for a given security objective
- Submit detailed documentation to the QSA, outlining the approach to achieve compliance and demonstrate the effectiveness of the approach
- After the QSA reviews the evidence, the QSA makes a final decision on the effectiveness of the control, based on the analysis of the documentation submitted
The impact of a customized approach

Customizing security controls should be done in a very structured way that delivers measurable and predictable outcomes.

Organizations with mature control environments are more likely to embrace the new customized validation approach with confidence. They should also find it easier to rewrite how their systems can be tested to validate how they meet the latest PCI DSS requirements.

The new validation method will likely result, at least initially, in additional assessment work for organizations to develop and prepare documentation, control design, evaluations and risk assessment data that a QSA will need to evaluate.

Although this new validation approach offers more flexibility in how the PCI DSS 12 Key Requirements can be met, there’s an explicit expectation that organizations ensure that each of their customized implementations of PCI DSS requirements meet respective control objectives and fulfill the intent.

As such, a customized approach requires adopting a robust method of designing and managing security controls and maintaining the control environment. It requires higher levels of process and capability maturity of control design, control risk evaluation, control implementation and monitoring.

Organizations need to collaborate with the QSA or Internal Security Assessor (ISA) to agree on and develop tailored testing procedures. Some organizations are likely to experience unintended consequences from the design and implementation of their customized controls. It’s critical to be aware of blind spots and seek out cause-andeffect relationships between controls, control systems and the control environment. You need to understand your capability and competency to design, implement, maintain and monitor customized controls, as well as your capacity to maintain all the requirements associated with your approach. The new alternative approach may not be for everyone. It’s best suited for organizations with fairly mature security, compliance and risk assessment processes in place.

When choosing to follow the customized approach, organizations that don’t have a robust control environment backed by reasonably mature compliance management processes and capabilities are advised to improve their level of maturity and implement changes in small, incremental steps. This avoids making changes to substantial portions of the control environment, which can lead to unintended consequences— a range of good, mixed and bad unexpected outcomes.

For an overview of capability maturity and metrics, revisit the Verizon 2019 Payment Security Report, pages 21 to 29.⁴⁴

The new alternative approach may not be for everyone. It’s best suited for organizations with fairly mature security, compliance and risk assessment processes in place.

- Examples of unintended consequences
  
  Unintended benefit: The creation of email
  
  Described as windfalls, good fortune, luck or serendipity, unintended benefits result from an unexpected positive outcome in which no significant, clear-cut drawback or perverse result occurs. For example, when the internet was first designed, email programs were never intended to become extensive communications channels. However, their extreme popularity, practicality and ability to be sustained definitely pegs this innovation as an unintended benefit.
  
  Unintended drawback: LED traffic lights
  
  The world’s first electric traffic signal was put into place in Cleveland, Ohio, on August 5, 1914.⁴⁵ Today, traffic lights are one of the most common and effective traffic-control tools available. But they can also cause accidents when they go out.
  
  Recently, cities around the globe sought to increase the energy efficiency of traffic lights by switching from incandescent bulbs to long-lasting light-emitting diode (LED) bulbs, only to discover a new set of problems. It’s an apt example of how proposed changes to controls should be carefully studied; environmental factors must be taken into account to uncover unintended consequences.
  
  Local and state governments in the U.S. began replacing incandescent traffic-signal light bulbs with LED lighting in response to the United States Energy Policy Act of 2005 minimum standards for energy efficiency for traffic and pedestrian lights. While the efficient and longer-lasting LED bulbs improved energy costs by 90%, when incandescent bulbs burn out, they go out completely without warning. On the other hand, LEDs often go out in parts, leaving part of the string of LEDs inside the traffic light operative and emitting light. Drivers then alert the authorities, who send out a crew to replace the failing light.
  
  However, since LED lights don’t emit heat, they don’t melt snow the way incandescent light bulbs do. The changing directional lights can become obscured with snow and ice buildup, according to a 2014 U.S. Department of Transportation Federal Highway Administration study. Partial or complete covering of the signal with snow and ice resulted in at least one fatality and numerous vehicular accidents. Drivers unfamiliar with an intersection may not notice the covered lights, which can lead to potentially devastating collisions.
  
  Efforts were made to address the problem by installing weather shields and snow scoops to reduce or resolve accumulation. Some city workers also used compression air devices to blow the snow off and manually scraped the lights. Local and state governments argued that drivers should respond to such obstructed LED lights in the same way they do for a power outage—by treating the traffic signal as a four-way stop.⁴⁶ While some might argue that the environmental and energy-saving benefits outweighed the unintended drawbacks, the main purpose of the LED lights was to protect human lives and avoid accidents. Therefore, the LED lights also could be viewed as having a perverse result.
  
  Unintended drawback/perverse result: Passenger-side airbags
  
  Sometimes an unintended consequence crosses over and cannot be clearly identified as either a benefit, drawback or perverse result. An example is passenger-side airbags created as a safety device in cars in the mid-1990s. The devices inadvertently led to an increase in child injuries and fatalities. When the air bags automatically deployed in a crash, small children were injured or killed from the impact. Child seats were then moved to the backseat of the vehicle to avert this outcome, but that led to an increase in the number of children being left unattended in extreme temperature conditions. While passenger-side airbags definitively save lives, the perverse result on small children cannot be ignored.⁴⁷
  
  Perverse result: The cobra effect
  
  Colonial Delhi, India, was suffering from a proliferation of cobras, so the local government placed a bounty on them. Ironically, this resulted in an increase in the species. As the cobra population fell, people started raising cobras in their homes, which they would then kill to collect the bounty.
  
  Local authorities eventually realized that while very few cobras were evident in the city, a bounty was still being paid on large numbers of snakes. So, they canceled the bounty. In response, the people raising cobras in their homes released all of their now-valueless cobras back into the streets. In the end, Delhi had a bigger cobra problem after the bounty ended than it had before it began. The unintended consequence of the cobra eradication plan was an increase in the number of cobras.⁴⁸

Enhanced validation methods and procedures

Please provide the information below to view the online Verizon Payment Security Report.

Thank You.

Thank you.

Thank you.

The defined approach

The customized approach

A customized approach typically requires additional documentation effort for:

The impact of a customized approach

Examples of unintended consequences

Unintended benefit: The creation of email

Unintended drawback: LED traffic lights

Unintended drawback/perverse result: Passenger-side airbags

Perverse result: The cobra effect

Great News!
5G is available in your area