PCI DSS 2015 SIG Proposal: Securing Cryptographic Keys and Digital Certificates
Why is securing keys and certificates an
important PCI DSS special interest group (SIG) now? Cybercriminals are using keys
and certificates to gain trusted status, be authenticated, and evade detection, bypassing other security controls and
keeping their actions cloaked. And keys and certificates that protect payment
card information are a particularly attractive target.
Vote for this SIG for guidance on use cases such as detecting, preventing, and remediating exploits of vulnerabilities such as Heartbleed and APTs designed to circumvent and misuse keys and certificates. If not secured, keys and certificates become a weak point in protecting payments systems and even undermine other critical security controls in place.
With the right guidance, you can simplify and
ensure repeated audit success while continually defending against these
trust-based attacks—and avoid being in the headlines with the next breach.
View the proposal on SlideShare at http://www.slideshare.net/Venafi/pci-scc-2015-sig-proposal-securing-keys-and-certificates.
Watch the on-demand webinar with SecurityMetrics at https://www.infosecurity-magazine.com/webinars/get-ready-for-pci-dss-v3/
Vote for the PCI SIG Cryptographic Keys and Digital Certificate Security Guidelines and get involved! Show your support by signing this petition, but then also make sure to vote between October 13-23 on the PCI SSC website. [https://www.pcisecuritystandards.org/]
Updates
October 1, 2014
The momentum behind this proposal proves that the industry is finally waking up to the massive security gaps in our current infrastructure. It is time for the PCI SCC to stop ignoring the blatant misuse of keys and certificates by criminals who exploit our silence.
17 Comments
If the foundations you built your house on was full of holes you would fix them...this should be a P1 for every company.
This is critical and much over due. PKI weaknesses are never crypto related, it is always somewhere else within the trust model.
Time to address a vulnerability that has been increasing risk for merchants everywhere.
I am at a loss on why this even needs to be voted on. The PKI world/Talent is small and requires guidance.
managing cert lifecycles is a nightmare for most teams and this stuff is getting ignored way too often. about time to get some real standards on this.
a must!
Key security is fundamental to use of PKI. Without it everyone is vulnerable.
Sign Petition
We never post to your account. Social sign-in is used only to verify your signature.
Add a comment?
Your signature will be added via . Tell others why you're signing — it's optional.
By signing, you accept our Terms and Privacy Policy and agree to occasional emails about petitions. Unsubscribe anytime.
Share this petition
Share this petition to help it reach more people.
Your share link
PCI DSS 2015 SIG Proposal: Securing Cryptographic Keys and Digital Certificates
Why is securing keys and certificates an
important PCI DSS special interest group (SIG) now? Cybercriminals are using keys
and certificates to gain trusted status, be authenticated, and evade detection, bypassing other security controls and
keeping their actions cloaked. And keys and certificates that protect payment
card information are a particularly attractive target.
Vote for this SIG for guidance on use cases such as detecting, preventing, and remediating exploits of vulnerabilities such as Heartbleed and APTs designed to circumvent and misuse keys and certificates. If not secured, keys and certificates become a weak point in protecting payments systems and even undermine other critical security controls in place.
With the right guidance, you can simplify and
ensure repeated audit success while continually defending against these
trust-based attacks—and avoid being in the headlines with the next breach.
View the proposal on SlideShare at http://www.slideshare.net/Venafi/pci-scc-2015-sig-proposal-securing-keys-and-certificates.
Watch the on-demand webinar with SecurityMetrics at https://www.infosecurity-magazine.com/webinars/get-ready-for-pci-dss-v3/
Vote for the PCI SIG Cryptographic Keys and Digital Certificate Security Guidelines and get involved! Show your support by signing this petition, but then also make sure to vote between October 13-23 on the PCI SSC website. [https://www.pcisecuritystandards.org/]
Updates
October 1, 2014
The momentum behind this proposal proves that the industry is finally waking up to the massive security gaps in our current infrastructure. It is time for the PCI SCC to stop ignoring the blatant misuse of keys and certificates by criminals who exploit our silence.
17 Comments
keys and certs are integral to the safety of the internet, security infrastructures and PCI.
If the foundations you built your house on was full of holes you would fix them...this should be a P1 for every company.
This is critical and much over due. PKI weaknesses are never crypto related, it is always somewhere else within the trust model.
Time to address a vulnerability that has been increasing risk for merchants everywhere.
I am at a loss on why this even needs to be voted on. The PKI world/Talent is small and requires guidance.
managing cert lifecycles is a nightmare for most teams and this stuff is getting ignored way too often. about time to get some real standards on this.
a must!
Key security is fundamental to use of PKI. Without it everyone is vulnerable.
Help this petition grow
Share it with friends to help reach 100 signatures.
Sign Petition
We never post to your account. Social sign-in is used only to verify your signature.
Add a comment?
Your signature will be added via .
Tell others why you're signing — it's optional.
Signing with Google or Facebook verifies your signature instantly — no email needed.
By signing, you accept our Terms and Privacy Policy and agree to occasional emails about petitions. Unsubscribe anytime.
Share this petition
Share this petition to help it reach more people.
Your share link
Petitions like this
Other petitions you might want to support
Scan to share
Anyone who scans this can sign the petition.
keys and certs are integral to the safety of the internet, security infrastructures and PCI.