[Autogenerated] even if you do not plan on taking the customized approach,
I find the customized approach objectives really useful to be able to
understand why a requirement is in the standard.
This can help you to explain to colleagues and to management
why a certain control needs to be in place.
The customized approach objectives follow one of three standard forms.
Their intended either to prevent something happening to
make the organization do something which if it didn't do
would result in a security issue.
Or thirdly providing assurance that a critical control is working,
prevent objectives generally take the form of an
asset or assets cannot be something.
So for example,
requirement 4.2.1 clear text pan cannot be read or intercepted
from any transmissions over open public networks,
prevent type objectives are absolute statements.
They say something cannot happen and I know that many people will
argue well you can't write that in a standard because you can never
guarantee that something cannot happen.
But that's the objective of the control.
The objective of the control is to prevent a thing happening.
You don't design a control to prevent a thing happening most of the time.
Do objectives are typically of the form that artifacts are and then a verb.
And here's an example from 11.4.4 vulnerabilities and security weaknesses found.
Well,
verifying system defenses are mitigated and finally assure objectives will
say that something typically an asset or a control is or are verified and it
might include how frequently something is verified or state a quality
measure or point to a reference standard.
And an example here is from requirement 11.3.1,
which is that the security posture of all system components is
verified periodically using automated tools designed to detect
vulnerabilities operating inside the network.
Most of the customized approach objectives are
prevent type or do type objectives.
There are very few assured type objectives.
Before we finish our look at the customized approach,
I just quickly want to show you how I translate an objective into the mischief.
Then the consequence of the mischief that the
requirement is really trying to prevent.
So I start with the objective which in this case is all keys
and certificates used to protect Pan during transmission are
identified and confirmed as trusted.
Then the next thing I do is try to turn the objective into a negative.
The opposite of the objective, which in this case would be all cases,
certificates used to protect Pan during transmission
are not identified and are untrusted.
So far certificates are not identified and are not trusted.
What would be the outcome of that?
And I guess that is a threat actor will be able to
substitute a key or a certificate.
And then finally we have to ask ourselves well what would happen if
the threat actor was able to substitute their key or certificate for
the organization's key or certificate?
And the answer to that question is that the threat actor would be able to
intercept encrypted transmissions and extracts the plaintext pan,
they would be an attacker in the middle.
Both the mischief and the consequences are required for the targeted
risk analysis that supports the customized approach.
But more importantly, knowing why a requirement is in p C I D S.
S,
what mischief is trying to stop and what would happen if that
mischief occurred is actually really useful for explaining why the
requirement needs to be in place and making that explanation to
management and two colleagues.
This customized approach is new and maybe it's not the perfect answer
to an objective or outcome based security standard.
PCISS Version four tries to be two standards at the same time.
Both prescriptive for organizations that need a prescriptive security standard
to follow and objective based for organizations that know how to manage
information security by meeting security objectives.
And that's quite a hard thing to pull off which in my opinion,
PCIDSS four has done quite well.
I expect that between the standard being released and it
becoming mandatory in 2024 that the PCISS.
C will put a significant amount of guidance and worked examples
of how to undertake the customized approach.
So I would encourage you to check the P C I D S.
S.
Version for resource hub on the P.
C.
I.
S.
C.
Website regularly and to subscribe to their news feeds