Aus langweiliger PCI-DSS-Compliance eine sinnvolle Übung für alle machen: Teil 2 — CISOs und Sensibilisierung von Entwicklern

This is part 2 of a mini-series on PCI-DSS compliance within an organization. In this final chapter, we detail how CTOs and CISOs can lead from the top in reducing cyber risk and making the process seamless, successful... and maybe a little fun for developers. (Did you miss part 1? Check it out here and learn how AppSec specialists can seize this opportunity for better security outcomes).

PCI-DSS best practice is undoubtedly a shared responsibility, but CISOs and CTOs can harness their considerable influence in crafting a thriving, positive security program from the top. They are the figurehead for cybersecurity trust and related sentiment with end-users, and a focus on awareness early has a powerful trickle-down effect, helping developers and AppSec professionals get the knowledge, tools and support they need to contribute to a robust security posture within the company.

Its important to stay compliant, but when everyone is on board with the "why", seeing results and being nurtured in the right way, a program can transcend legislation and become second-nature.

CTOs and CISOs have a role in creating mutual trust

Have you been on a site recently, and thought twice about handing over your credit card details? Unless it's the sketchy-looking web app powering the online ordering for your local pizza shop, this likely isn't something you experience very often, especially not with large corporations and household names in online retail.

Unless they disclose a data breach, of course.

Global accommodation giant, Marriott, just disclosed their second breach in the space of three years, with this one resulting in the theft of 5.2 million customer records. This time, it doesn't yet appear as though payment information was part of the heist, though their catastrophic breach in 2018 took care of that; 383 million customers were compromised, with 5 million unencrypted passport numbers stolen, as well as 8 million credit card numbers.

If customer trust in the Marriott brand wasn't already as low as it could get, I'd say it's close to hitting rock bottom soon. This is the sort of stuff that keeps CISOs awake at night, as they feel like sitting ducks in the war against cyber threats. Just look at Equifax, Yahoo, Sony, Target - these are just a few huge names that have endured large-scale breaches, representing billions of stolen data records, hundred of billions of dollars in damage, and customer-shaped holes punched right through their economic hearts. It's a disaster for the business (Target reported a $440 million profit plunge in the quarter following their 2014 breach), and while individual people aren't typically held responsible -- after all, software security should be a shared responsibility -- it's something you don't exactly want on an otherwise glowing resume if you happened to work for these organizations at the time.

Foregoing a robust security program to achieve compliance in an organization dealing with payments, sensitive data and the intangible gold that is positive customer sentiment, is an indicator of a company that is not only at-risk, but seriously lagging behind in innovation.

Everyone should care about trust issues in the customer/organization relationship.

Apart from the stress and calamity the IT, development, and security departments face after a breach, the trust factor is a major element in the long-term success of a newer company, or the continued growth of an established one. The obvious thing you stand to lose is your job, should the company be faced with an economic downturn as a result of lost faith.

The PCI-DSS regulations hold businesses accountable -- and as above, ignoring these well-laid plans has enormous implications -- but they're only as good as the security program that is put in place, and the people working within it. If you take them seriously, stay aware, and set an example for others, then you are setting yourself apart in a very positive way.

Awareness is everything.

A failing security awareness program is going to make most attempts to stay PCI-compliant close to useless. Organization-wide security awareness forms the most critical part of the best practice guidelines; they even offer their own training modules on how this can be implemented in cross-functional roles, and what this looks like in businesses who are doing it right.

As we move towards DevSecOps as the current gold standard in secure software development -- in which security as a shared responsibility is fundamental -- businesses must spend the time, money and effort to ensure everyone, including vendors and contractors, is security-aware and following best practices.

A security-aware developer is a compliant developer (and getting there doesn't have to be boring)

When it comes to becoming a "certified" compliant PCI-DSS developer, there aren't a whole lot of obvious options. Why? Probably because it cannot be a "one and done" exercise.

The OWASP organization is one of the best on the planet when it comes to learning how to thwart common vulnerabilities, and their Top 10 is formally listed in the PCI-DSS guidelines for developers. However, keeping security front-of-mind and honing skills takes time and continued effort. And nobody wants this to be uninspiring and a waste of effort.

A positive security culture is not a "nice to have" in an organization; if they're taking security seriously, then it needs to be part of the everyday running of the company.

Developers are on the front lines of battle when it comes to stopping vulnerabilities. Are they receiving the support, tools, and training to hold up their part of the security deal in PCI-DSS compliance?

The truth is, the right training is more seamless; it shouldn't feel like a lecture, and it should be highly relevant to the work being done every day. And this kind of hands-on training is an upskilling opportunity - a career move that only has positives for developers who are serious about stopping vulnerabilities and working with the rest of the team to produce a higher standard of code.

Want to test your secure coding skills right now? Choose your mission.