Monday, February 10, 2025
HomeComputer SecurityPCI DSS Version 3.2.1 Released - Changes that You Need to Know...

PCI DSS Version 3.2.1 Released – Changes that You Need to Know About PCI Data Security

Published on

SIEM as a Service

Follow Us on Google News

PCI Security Standards Council (PCI SSC) published PCI DSS Version 3.2.1 with minor revision to the PCI Data Security Standard (PCI DSS), which businesses around the world use to safeguard payment card data before, during and after a purchase is made.

The Payment Card Industry Data Security Standard (PCI DSS) is a defined standard that acknowledges a set of Policies and Procedures planned to enhance the security of payment card, cash card exchanges and ensure cardholders against abuse of their own data.

The PCI Security Standards Council is a worldwide open body framed to create, upgrade, scatter and help with the comprehension of security measures for payment account security and Last year PCI published  Best practices for securing E-commerce Websites

The PCI DSS was made together in 2004 by four noteworthy Credit-card organizations: Visa, MasterCard, Discover and American Express.

PCI certification ensures the security of card data at your business through a set of requirements established by the PCI SSC. These include a number of commonly known best practices, such as:

  • Installation of firewalls
  • Encryption of data transmissions
  • Use of anti-virus software

You can also get the quote for PCI-compliant security that provides a valuable asset that informs customers that your business is safe to transact with.

PCI DSS Version 3.2.1 replaces version 3.2, no new requirements added to version 3.2.1 and the version 3.2 remains valid upto 31 December 2018 and will be retired as of 1 January 2019.

PCI SSC Chief Technology Officer Troy Leach says “It is critically important that organizations disable SSL/early TLS and upgrade to a secure alternative to safeguard their payment data.”

After 30 June 2018, all entities must have stopped use of SSL/early TLS as a security control, and use only secure versions of the protocol.

POS POI terminals (and the SSL/early TLS termination points to which they that can be verified as not being susceptible to any known exploits for SSL/early TLS, may continue using these as a security control after 30 June 2018.

Removal of multi-factor authentication (MFA) from the compensating control, now MFA is required for all non-console administrative access; an addition of one-time passwords as an alternative potential control for this scenario.

The updates in PCI DSS v3.2.1 do not affect the Payment Application Data Security Standard (PA-DSS), which will remain at v3.2.

POS POI terminals that can be verified as not being susceptible to any known exploits for SSL/early TLS, may continue using these as a security control after 30 June 2018.

The widespread of SSL/early TLS has many vulnerabilities (POODLE, BEAST, CRIME, Heartbleed) making it unsafe for protecting data.

“Online and e-commerce environments using SSL/ early TLS are most susceptible to these vulnerabilities and should be upgraded immediately.” reads PCI Dss statement.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

NetSupport RAT Grant Attackers Full Access to Victims Systems

The eSentire Threat Response Unit (TRU) has reported a significant rise in incidents involving...

Quishing via QR Codes Emerging as a Top Attack Vector Used by Hackers

QR codes, once a symbol of convenience and security in digital interactions, have become...

New ‘BYOTB’ Attack Exploits Trusted Binaries to Evade Detection, Researchers Reveal

A recent cybersecurity presentation at BSides London 2024 has unveiled a sophisticated attack technique...

SAML Bypass Authentication on GitHub Enterprise Servers to Login as Other User Account

A severe security vulnerability, tracked as CVE-2025-23369, has been identified in GitHub Enterprise Server...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

New FUD Malware Targets MacOS, Evading Antivirus and Security Tools

A new strain of Fully Undetectable (FUD) macOS malware, dubbed "Tiny FUD," has emerged,...

Google Blocks 2.28 Million Malicious Apps from Play Store in Security Crackdown

In a continued commitment to enhancing user safety and trust, Google has outlined significant...

Hackers Exploiting DNS Poisoning to Compromise Active Directory Environments

A groundbreaking technique for Kerberos relaying over HTTP, leveraging multicast poisoning, has been recently...