Address Security Vulnerabilities & Achieve PCI Compliance

The latest revision of the Payment Card Industry Data Security Standards, version 4.0, was released on March 31, 2022. PCI-DSS v4.0 replaces PCI-DSS version 3.2.1 to address emerging threats and technologies and provide innovative ways to combat new threats.

There are sixty-four new requirements in PCI-DSS v4.0. Some of these requirements are effective immediately for all PCI-DSS v4.0 assessments, but most of these remain best practices for now and will not come into effect until March 31, 2025.

The twelve core PCI-DSS requirements did not fundamentally change with PCI-DSS v4.0, and they remain the critical foundation for securing payment card data.

However, the requirements were redesigned to focus on security objectives and to guide how security controls should be implemented. It’s also worth noting that PCI-DSS v3.2.1 will be retired on March 31, 2024.

What’s New in PCI-DSS v4.0?

The goal of the updated security payment standard is to “address emerging threats and technologies and enable innovative methods to combat new threats,” per the PCI Security Standards Council. Some of the key high-level objectives are:

1. Continue to meet the security needs of the payments industry.
2. Promote security as a continuous process.
3. Increase flexibility for organizations using different methods to achieve security objectives.
4. Enhance validation methods and procedures.

Address Security Vulnerabilities with CSP Vulnerability Scanner v1.5

CSP Vulnerability Scanner™ is a vulnerability scanning and reporting solution for HPE NonStop systems. The tool analyzes risks and identifies vulnerabilities by checking the NonStop system configuration, access permissions, and security settings. It generates insightful reports for users and recommends changes to improve the security posture.

To effectively audit the security of the systems, the CSP Vulnerability Scanner gathers a vast amount of information from different sources, including Safeguard, Guardian, and other subsystems. It automates this task by providing reports and analysis from a single source for both technical and non-technical users. The CSP Vulnerability Scanner also includes access to CSP-Wiki®, where users can get more details on the settings, security, and compliance implications.

Installation and Use

The installation process is quick, and the solution is easy to use. There are two ways to select the desired scans and generate reports:

1. VSREPORT Macro- This TACL macro guides the users to build a report
2. TACL command line – For users that are very familiar with command syntax

The users will be able to select from a list of available reports and, based on the selection, may be prompted for some additional information.

Key Features:

• Scans NonStop systems to identify vulnerabilities
• Provides recommendations to improve security
• Very easy to install and use
• Quickly perform scans and generate insightful reports
• Easily select from the list of available reports
• Export reports with Spoolview
• Share reports with management and auditors

Examples of Reports:

1. Security Analysis Report
2. Authorization Report
3. Examine Sub-volume Access Report
4. Explain Access to Object Report
5. Group Members Report
6. Show Access Report
7. Safeguard Globals Report

What’s New in Version 1.5:

1. Critical File Vulnerability Report:

• • This report verifies the files mentioned in the input file

2. New Program Discovery Report:

• • This report shows a list of programs created from a specific date or time frame on a specified sub-volume, which helps identify suspicious/unauthorized new programs

3. Orphan Files Report:

• • This report shows a list of orphan files (files owned by an undefined user)

4. Group Members report now has two new options:

• • List Safeguard groups where a user is a member
  • List Safeguard groups where an alias is a member

CSP – Compliance at your Fingertips®

For complimentary access to CSP-Wiki®, an extensive repository of NonStop security knowledge and best practices, please visit wiki.cspsecurity.com

We Built the Wiki for NonStop Security ®

The CSP Team      

+1(905) 568 –8900