PCI DSS V4: What changes and what is new in this version?

The new V4 edition maintains the principle that the entire transaction chain, from the smallest online shop to the bank itself, requires compliance, but moves towards a different model with greater emphasis on outcomes.

It is worth recalling that the new edition follows two years during which online credit card purchases increased by 150% in 2019–2021 due to coronavirus, attracting corresponding interest from cybercriminals.

Main objectives of PCI 4.0

The 12 main PCI DSS requirement categories remain unchanged, but the new edition:

• Modernises standards to keep pace with current technologies such as cloud computing and MFA.
• Promotes security as a continuous business process.
• Becomes more flexible, officially allowing the selection of remediation actions, which until V3 mainly happened in practice during on-site QSA audits.
• Guides businesses to apply multiple security procedures to improve overall business security.

3DS acquires its own requirements in PCI V4

This edition creates a new security standard for providers of EMV® 3DS solutions. It gives software vendors and managed providers guidelines for implementing appropriate security procedures and safeguards to protect transactions as effectively as possible.

Encryption: Upgraded encryption requirements in PCI DSS v4.0

The standard also brings significant improvements to credit card data encryption. As expected, encryption requirements now extend to internal networks. Until V3, the obligation covered only public networks, although many businesses have already begun adopting the new practice.

Until V3, businesses could use hashing to retain an unreadable copy of a card number without further security measures. The hash itself must now be encrypted and protected (requirement 3.5.1.1). Sensitive Authentication Data (SAD) must also be protected with strong encryption under requirement 3.2.2.

In the new edition, simple disk encryption, such as BitLocker, is not acceptable for storing card data except on removable media. A certificate inventory (12.3.3) is also mandatory for monitoring certificates, which must be included in the annual risk assessment (12.3.3). Three-key triple DES (TDES/TDEA) will cease to be considered secure after 31 December 2023.

The new requirement aims to combat known risks such as:

• Malicious software inside the network: Network sniffers designed to intercept unencrypted data.
• Internal risks: Staff or contractors who have network access to the cardholder environment under their contract and can easily collect card data, such as network administrators.
• Misconfiguration: Protection against incorrect system use or configuration, for example older Wi-Fi protocols whose entire traffic can be intercepted and decrypted.

E-Commerce

Significant changes in e-commerce focus on tampering and skimming attacks, where compromised online shops use JavaScript during checkout to present a card data collection form designed to trick customers into entering their details.

Requirement 6.4.3 therefore allows only necessary JavaScript on the payment page, subject to approval before use. In practice, analytics scripts and advertising scripts are prohibited on the payment page. Script integrity must also be checked according to the relevant Content Security Policy. A Web Application Firewall (WAF) becomes officially mandatory under requirement 6.4.1.

Authentication & Multi Factor Authentication

Following the introduction of MFA requirements in v3.2.1, the new edition further strengthens the use of multiple authentication methods. MFA now extends from administrators to all users with access to credit card data. Requirement 8.4.2 extends its scope beyond non-console connections, including:

• Cloud environments
• Hosted systems
• On-premises applications
• Network security devices
• Workstations, servers and endpoints

The standard requires Multi Factor Authentication to be implemented so that it:

• Is not vulnerable to replay attacks.
• Cannot be bypassed or exempted without management approval.
• Uses at least two authentication methods: something you know, something you have or something you are.
• Denies access unless all the user's authentication methods are satisfied.

The minimum password length is now 12 characters, except on legacy systems where eight is permitted only when upgrading is technically impossible.

Logging and Internal Vulnerability Scanning

PCI requires extensive event logging to record and detect activity within the PCI environment. Logging is now required both for post-forensic investigation and real-time detection. An automated log analysis mechanism to prevent malicious activity is therefore mandatory (10.4.1.1).

Internal vulnerability scanning must also support authentication. In practice, attackers commonly gain access to a system in some way and try to exploit vulnerabilities to escalate privileges.

Legacy systems

PCI DSS v4 significantly affects legacy systems, which must be upgraded to keep pace with new requirements. New requirements therefore arise concerning:

• Technical specifications: Systems must be upgraded to current versions and meet new standards, such as multi-factor authentication.
• Risk management procedures: PCI DSS now requires extensive risk assessments, where legacy systems will begin to produce higher risk indicators.
• Architectural requirements: As with technical specifications, redesign may be needed to support new requirements such as customer segmentation.

Requirements v4

The new edition also changes the number of requirements, adding 64 in total: 53 for merchants and 11 for service providers.

Deadline

PCI DSS version 4 was published on the PCI Council website on 30 March 2022 and is immediately applicable to any business wishing to comply. The transition period to version 4.0 ends on 31 March 2024, meaning all businesses and organisations must have fully complied by then.

Businesses must therefore begin engaging with the new standard immediately to prepare effectively for this new challenge!