Mit der richtigen Unterstützung können Entwickler Ihr Unternehmen zu einer überlegenen PCI DSS 4.0-Konformität führen
A version of this article originally appeared in DZone. It has been updated and syndicated here.
The Payment Card Industry Data Security Standard (PCI DSS) version 4.0 will change almost everything about security for any business or organization that accepts electronic payments, which is a vast majority of them. And make no mistake, this update will be transformative for most businesses, requiring them to upgrade many of their security processes and potentially roll out new protections regarding encryption, authentication, access control, key management, and other areas that they may have been slow to embrace before now.
Due to the complexity of the new requirements, organizations have been given until March 2025 to become fully compliant. But that deadline will arrive sooner than most people realize. In fact, many forward-thinking companies are taking steps right now to enable their developers to navigate the pending compliance landscape.
Going beyond check-the-box training
An organization’s developers write the code that much of their infrastructure relies on, so it makes sense that they are a good place to start when it comes to implementing the new PCI DSS 4.0 requirements. However, most developers will need strategic support to upskill as part of an updated security awareness program. This is to ensure that they have the experience needed to implement and maintain the higher levels of security required by the new standard.
In fact, requirement 12.6.2 of PCI DSS 4.0 directs organizations to implement a formal security program, and to keep it updated with the latest threat information and defensive techniques. With the older standard, basic security programs or even “check-the-box”-style annual compliance training met the objective. This new standard mandates so much more, even requiring that security training programs address specific threats and vulnerabilities within a company’s environment. For example, if stolen identities are a big problem for an organization, then the training needs to address that.
It's clear that minimal training will no longer be adequate from either a practical standpoint or for complying with the new standard. Instead, organizations need to provide developers with comprehensive, agile learning pathways that teach them how to apply security best practices to their real, everyday work. By going beyond minimum compliance efforts and providing developers with the resources they need to truly understand security, organizations can empower their developers to make better security decisions overall while also complying with PCI DSS 4.0.
The good news is that many of the new requirements in PCI DSS 4.0 are targeted toward areas that most developers are already familiar with like authentication, encryption, access control, key management, and others. When developers are given right-fit, relevant and familiar resources to grow their skills, organizations can more easily prepare them for the new standards and increased responsibilities that PCI DSS 4.0 will require.
Using PCI DSS 4.0 as a runway to better security overall
While addressing developer needs with good security education will be key to successfully complying with the new PCI DSS 4.0 standard, the effort of moving an organization towards better cybersecurity does not need to end there. Yes, the requirements are rigorous, but since most organizations will need to work to comply with them, there is no reason not to use that effort as a springboard for launching better security awareness and training overall. This will not only help an organization meet compliance requirements, but also start to foster a culture of positive security that prioritizes best practices and ensures that everyone in the organization is working towards the same, security-first goal.
There is a learning curve, sure, but developers will likely be on board with such an effort. In an Evans Data survey of over 1,200 professional developers actively working around the world, the overwhelming majority said they were supportive of the concept of creating secure code and establishing a better security culture at their organizations. It’s clear that most developers welcome a strategic, supported shift to secure coding and a reprioritizing of security as part of the development process.
The security upgrades mandated by PCI DSS 4.0 provide a perfect excuse for companies to invest in improved security best practices and training, and to embrace a better overall security culture within their organization.
Developers can more easily achieve higher levels of security maturity if their companies invest in a program that lets them integrate their skills in secure coding with relevant tools and training. This can, in turn, help to create a culture of security where developers are further empowered to make better decisions that improve their organization’s overall security posture well beyond even the rigorous new PCI DSS 4.0 standards.
Matias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Secure Code Warrior ist für Ihr Unternehmen da, um Ihnen zu helfen, Code während des gesamten Softwareentwicklungszyklus zu sichern und eine Kultur zu schaffen, in der Cybersicherheit an erster Stelle steht. Ganz gleich, ob Sie AppSec-Manager, Entwickler, CISO oder jemand anderes sind, der sich mit Sicherheit befasst, wir können Ihrem Unternehmen helfen, die mit unsicherem Code verbundenen Risiken zu reduzieren.
Eine Demo buchen
Matias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Matias is a researcher and developer with more than 15 years of hands-on software security experience. He has developed solutions for companies such as Fortify Software and his own company Sensei Security. Over his career, Matias has led multiple application security research projects which have led to commercial products and boasts over 10 patents under his belt. When he is away from his desk, Matias has served as an instructor for advanced application security training courses and regularly speaks at global conferences including RSA Conference, Black Hat, DefCon, BSIMM, OWASP AppSec and BruCon.
Matias holds a Ph.D. in Computer Engineering from Ghent University, where he studied application security through program obfuscation to hide the inner workings of an application.
A version of this article originally appeared in DZone. It has been updated and syndicated here.
The Payment Card Industry Data Security Standard (PCI DSS) version 4.0 will change almost everything about security for any business or organization that accepts electronic payments, which is a vast majority of them. And make no mistake, this update will be transformative for most businesses, requiring them to upgrade many of their security processes and potentially roll out new protections regarding encryption, authentication, access control, key management, and other areas that they may have been slow to embrace before now.
Due to the complexity of the new requirements, organizations have been given until March 2025 to become fully compliant. But that deadline will arrive sooner than most people realize. In fact, many forward-thinking companies are taking steps right now to enable their developers to navigate the pending compliance landscape.
Going beyond check-the-box training
An organization’s developers write the code that much of their infrastructure relies on, so it makes sense that they are a good place to start when it comes to implementing the new PCI DSS 4.0 requirements. However, most developers will need strategic support to upskill as part of an updated security awareness program. This is to ensure that they have the experience needed to implement and maintain the higher levels of security required by the new standard.
In fact, requirement 12.6.2 of PCI DSS 4.0 directs organizations to implement a formal security program, and to keep it updated with the latest threat information and defensive techniques. With the older standard, basic security programs or even “check-the-box”-style annual compliance training met the objective. This new standard mandates so much more, even requiring that security training programs address specific threats and vulnerabilities within a company’s environment. For example, if stolen identities are a big problem for an organization, then the training needs to address that.
It's clear that minimal training will no longer be adequate from either a practical standpoint or for complying with the new standard. Instead, organizations need to provide developers with comprehensive, agile learning pathways that teach them how to apply security best practices to their real, everyday work. By going beyond minimum compliance efforts and providing developers with the resources they need to truly understand security, organizations can empower their developers to make better security decisions overall while also complying with PCI DSS 4.0.
The good news is that many of the new requirements in PCI DSS 4.0 are targeted toward areas that most developers are already familiar with like authentication, encryption, access control, key management, and others. When developers are given right-fit, relevant and familiar resources to grow their skills, organizations can more easily prepare them for the new standards and increased responsibilities that PCI DSS 4.0 will require.
Using PCI DSS 4.0 as a runway to better security overall
While addressing developer needs with good security education will be key to successfully complying with the new PCI DSS 4.0 standard, the effort of moving an organization towards better cybersecurity does not need to end there. Yes, the requirements are rigorous, but since most organizations will need to work to comply with them, there is no reason not to use that effort as a springboard for launching better security awareness and training overall. This will not only help an organization meet compliance requirements, but also start to foster a culture of positive security that prioritizes best practices and ensures that everyone in the organization is working towards the same, security-first goal.
There is a learning curve, sure, but developers will likely be on board with such an effort. In an Evans Data survey of over 1,200 professional developers actively working around the world, the overwhelming majority said they were supportive of the concept of creating secure code and establishing a better security culture at their organizations. It’s clear that most developers welcome a strategic, supported shift to secure coding and a reprioritizing of security as part of the development process.
The security upgrades mandated by PCI DSS 4.0 provide a perfect excuse for companies to invest in improved security best practices and training, and to embrace a better overall security culture within their organization.
Developers can more easily achieve higher levels of security maturity if their companies invest in a program that lets them integrate their skills in secure coding with relevant tools and training. This can, in turn, help to create a culture of security where developers are further empowered to make better decisions that improve their organization’s overall security posture well beyond even the rigorous new PCI DSS 4.0 standards.
A version of this article originally appeared in DZone. It has been updated and syndicated here.
The Payment Card Industry Data Security Standard (PCI DSS) version 4.0 will change almost everything about security for any business or organization that accepts electronic payments, which is a vast majority of them. And make no mistake, this update will be transformative for most businesses, requiring them to upgrade many of their security processes and potentially roll out new protections regarding encryption, authentication, access control, key management, and other areas that they may have been slow to embrace before now.
Due to the complexity of the new requirements, organizations have been given until March 2025 to become fully compliant. But that deadline will arrive sooner than most people realize. In fact, many forward-thinking companies are taking steps right now to enable their developers to navigate the pending compliance landscape.
Going beyond check-the-box training
An organization’s developers write the code that much of their infrastructure relies on, so it makes sense that they are a good place to start when it comes to implementing the new PCI DSS 4.0 requirements. However, most developers will need strategic support to upskill as part of an updated security awareness program. This is to ensure that they have the experience needed to implement and maintain the higher levels of security required by the new standard.
In fact, requirement 12.6.2 of PCI DSS 4.0 directs organizations to implement a formal security program, and to keep it updated with the latest threat information and defensive techniques. With the older standard, basic security programs or even “check-the-box”-style annual compliance training met the objective. This new standard mandates so much more, even requiring that security training programs address specific threats and vulnerabilities within a company’s environment. For example, if stolen identities are a big problem for an organization, then the training needs to address that.
It's clear that minimal training will no longer be adequate from either a practical standpoint or for complying with the new standard. Instead, organizations need to provide developers with comprehensive, agile learning pathways that teach them how to apply security best practices to their real, everyday work. By going beyond minimum compliance efforts and providing developers with the resources they need to truly understand security, organizations can empower their developers to make better security decisions overall while also complying with PCI DSS 4.0.
The good news is that many of the new requirements in PCI DSS 4.0 are targeted toward areas that most developers are already familiar with like authentication, encryption, access control, key management, and others. When developers are given right-fit, relevant and familiar resources to grow their skills, organizations can more easily prepare them for the new standards and increased responsibilities that PCI DSS 4.0 will require.
Using PCI DSS 4.0 as a runway to better security overall
While addressing developer needs with good security education will be key to successfully complying with the new PCI DSS 4.0 standard, the effort of moving an organization towards better cybersecurity does not need to end there. Yes, the requirements are rigorous, but since most organizations will need to work to comply with them, there is no reason not to use that effort as a springboard for launching better security awareness and training overall. This will not only help an organization meet compliance requirements, but also start to foster a culture of positive security that prioritizes best practices and ensures that everyone in the organization is working towards the same, security-first goal.
There is a learning curve, sure, but developers will likely be on board with such an effort. In an Evans Data survey of over 1,200 professional developers actively working around the world, the overwhelming majority said they were supportive of the concept of creating secure code and establishing a better security culture at their organizations. It’s clear that most developers welcome a strategic, supported shift to secure coding and a reprioritizing of security as part of the development process.
The security upgrades mandated by PCI DSS 4.0 provide a perfect excuse for companies to invest in improved security best practices and training, and to embrace a better overall security culture within their organization.
Developers can more easily achieve higher levels of security maturity if their companies invest in a program that lets them integrate their skills in secure coding with relevant tools and training. This can, in turn, help to create a culture of security where developers are further empowered to make better decisions that improve their organization’s overall security posture well beyond even the rigorous new PCI DSS 4.0 standards.
Klicken Sie auf den Link unten und laden Sie das PDF dieser Ressource herunter.
Secure Code Warrior ist für Ihr Unternehmen da, um Ihnen zu helfen, Code während des gesamten Softwareentwicklungszyklus zu sichern und eine Kultur zu schaffen, in der Cybersicherheit an erster Stelle steht. Ganz gleich, ob Sie AppSec-Manager, Entwickler, CISO oder jemand anderes sind, der sich mit Sicherheit befasst, wir können Ihrem Unternehmen helfen, die mit unsicherem Code verbundenen Risiken zu reduzieren.
Bericht ansehenEine Demo buchen
Matias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Matias is a researcher and developer with more than 15 years of hands-on software security experience. He has developed solutions for companies such as Fortify Software and his own company Sensei Security. Over his career, Matias has led multiple application security research projects which have led to commercial products and boasts over 10 patents under his belt. When he is away from his desk, Matias has served as an instructor for advanced application security training courses and regularly speaks at global conferences including RSA Conference, Black Hat, DefCon, BSIMM, OWASP AppSec and BruCon.
Matias holds a Ph.D. in Computer Engineering from Ghent University, where he studied application security through program obfuscation to hide the inner workings of an application.
A version of this article originally appeared in DZone. It has been updated and syndicated here.
The Payment Card Industry Data Security Standard (PCI DSS) version 4.0 will change almost everything about security for any business or organization that accepts electronic payments, which is a vast majority of them. And make no mistake, this update will be transformative for most businesses, requiring them to upgrade many of their security processes and potentially roll out new protections regarding encryption, authentication, access control, key management, and other areas that they may have been slow to embrace before now.
Due to the complexity of the new requirements, organizations have been given until March 2025 to become fully compliant. But that deadline will arrive sooner than most people realize. In fact, many forward-thinking companies are taking steps right now to enable their developers to navigate the pending compliance landscape.
Going beyond check-the-box training
An organization’s developers write the code that much of their infrastructure relies on, so it makes sense that they are a good place to start when it comes to implementing the new PCI DSS 4.0 requirements. However, most developers will need strategic support to upskill as part of an updated security awareness program. This is to ensure that they have the experience needed to implement and maintain the higher levels of security required by the new standard.
In fact, requirement 12.6.2 of PCI DSS 4.0 directs organizations to implement a formal security program, and to keep it updated with the latest threat information and defensive techniques. With the older standard, basic security programs or even “check-the-box”-style annual compliance training met the objective. This new standard mandates so much more, even requiring that security training programs address specific threats and vulnerabilities within a company’s environment. For example, if stolen identities are a big problem for an organization, then the training needs to address that.
It's clear that minimal training will no longer be adequate from either a practical standpoint or for complying with the new standard. Instead, organizations need to provide developers with comprehensive, agile learning pathways that teach them how to apply security best practices to their real, everyday work. By going beyond minimum compliance efforts and providing developers with the resources they need to truly understand security, organizations can empower their developers to make better security decisions overall while also complying with PCI DSS 4.0.
The good news is that many of the new requirements in PCI DSS 4.0 are targeted toward areas that most developers are already familiar with like authentication, encryption, access control, key management, and others. When developers are given right-fit, relevant and familiar resources to grow their skills, organizations can more easily prepare them for the new standards and increased responsibilities that PCI DSS 4.0 will require.
Using PCI DSS 4.0 as a runway to better security overall
While addressing developer needs with good security education will be key to successfully complying with the new PCI DSS 4.0 standard, the effort of moving an organization towards better cybersecurity does not need to end there. Yes, the requirements are rigorous, but since most organizations will need to work to comply with them, there is no reason not to use that effort as a springboard for launching better security awareness and training overall. This will not only help an organization meet compliance requirements, but also start to foster a culture of positive security that prioritizes best practices and ensures that everyone in the organization is working towards the same, security-first goal.
There is a learning curve, sure, but developers will likely be on board with such an effort. In an Evans Data survey of over 1,200 professional developers actively working around the world, the overwhelming majority said they were supportive of the concept of creating secure code and establishing a better security culture at their organizations. It’s clear that most developers welcome a strategic, supported shift to secure coding and a reprioritizing of security as part of the development process.
The security upgrades mandated by PCI DSS 4.0 provide a perfect excuse for companies to invest in improved security best practices and training, and to embrace a better overall security culture within their organization.
Developers can more easily achieve higher levels of security maturity if their companies invest in a program that lets them integrate their skills in secure coding with relevant tools and training. This can, in turn, help to create a culture of security where developers are further empowered to make better decisions that improve their organization’s overall security posture well beyond even the rigorous new PCI DSS 4.0 standards.
Inhaltsverzeichniss
Matias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Secure Code Warrior ist für Ihr Unternehmen da, um Ihnen zu helfen, Code während des gesamten Softwareentwicklungszyklus zu sichern und eine Kultur zu schaffen, in der Cybersicherheit an erster Stelle steht. Ganz gleich, ob Sie AppSec-Manager, Entwickler, CISO oder jemand anderes sind, der sich mit Sicherheit befasst, wir können Ihrem Unternehmen helfen, die mit unsicherem Code verbundenen Risiken zu reduzieren.
Eine Demo buchenHerunterladenRessourcen für den Einstieg
Themen und Inhalte der Securecode-Schulung
Unsere branchenführenden Inhalte werden ständig weiterentwickelt, um der sich ständig ändernden Softwareentwicklungslandschaft unter Berücksichtigung Ihrer Rolle gerecht zu werden. Themen, die alles von KI bis XQuery Injection abdecken und für eine Vielzahl von Rollen angeboten werden, von Architekten und Ingenieuren bis hin zu Produktmanagern und QA. Verschaffen Sie sich einen kleinen Einblick in das Angebot unseres Inhaltskatalogs nach Themen und Rollen.
%20(1).avif)
.avif)
Threat Modeling with AI: Turning Every Developer into a Threat Modeler
Walk away better equipped to help developers combine threat modeling ideas and techniques with the AI tools they're already using to strengthen security, improve collaboration, and build more resilient software from the start.
Ressourcen für den Einstieg
Cybermon is back: Beat the Boss KI-Missionen jetzt auf Abruf verfügbar
Cybermon 2025 Beat the Boss ist jetzt das ganze Jahr über in SCW verfügbar. Setzt fortschrittliche KI/LLM-Sicherheitsanforderungen ein, um die sichere KI-Entwicklung in einem großen Maßstab zu stärken.
Cyber-Resilienz-Gesetz erklärt: Was das für die Entwicklung von Secure by Design-Software bedeutet
Erfahren Sie, was der EU Cyber Resilience Act (CRA) verlangt, für wen er gilt und wie sich Entwicklungsteams mit sicheren Methoden, der Vorbeugung von Sicherheitslücken und dem Aufbau von Fähigkeiten für Entwickler darauf vorbereiten können.
