As the retirement countdown for the current version of PCI is now less than six months, a new standard for password length, complexity, and change frequency may create some risk.
Valid credentials have become a very hot item, as threat actors realize the low risk and high value of simply becoming an Initial Access Broker (rather than performing an entire cyber attack themselves). We’ve seen countless attacks where the focus was to simply gather a user’s credential to either an online platform or their on-premises network.
The newest version of the Payment Card Industry’s Data Security Standard (better known as PCI DSS) – version 4.0 – is set to become the standard next April, according to a PCI press release. While many of the new standards will be considered “best practices” for a time, some standards are all too familiar to cybersecurity professionals – which includes some new standards on protecting passwords. In Procedure 8.6.3, there are a few specific requirements around passwords:
- Passwords must be changed periodically (with the frequency based on an organization’s own risk analysis)
- Passwords must be sufficiently complex (taking into consideration the password change frequency as well)
While these requirements are important, they also provide cybercriminals with a new opportunity to send out fake “password reset” requests to any kind of important system, citing the PCI standard to add credibility to the scam. In the end, with a little social engineering and some believable brand impersonation of the soon-to-be-compromised platform, it’s likely users will fall for such a campaign.
So, it becomes important to educate users how to spot fake password reset requests – whether related to PCI v4.0 or not – through continual security awareness training. There are always telltale signs – sender email addresses, poor user experience, improper URLs, etc. – so by training users about these kinds of scams and other cyber attack tactics, you can reduce the risk of successful compromise of your most precious asset – your organization’s credentials.
Here's how it works:
