Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

8/21/2018
02:00 PM
50%
50%

Clinging to TLS 1.0 Puts Sites Outside PCI DSS Compliance

More than half of organizations could be out of compliance, new research shows.

When an old protocol refuses to die, it can have a major impact on security — and cause an organization to fall out of regulatory compliance. Case in point: New research from Panorays shows more than half of organizations could be out of PCI compliance because they just can't let go of TLS 1.0.

Panorays' review of 1,150 organizations indicated that 52% use TLS 1.0 on all of their websites (a total of 29,000), while another 45% use TLS 1.0 on at least one site. PCI DSS requires organizations to replace TLS 1.0 with TLS 1.1 or 1.2. The older protocol has been shown to be more vulnerable to man-in-the-middle and other attacks than its replacements.

Among the reasons speculated for companies retaining TLS 1.0 on their websites are the need to take care of endpoint users with old browsers and applications that don't support newer versions of TLS, and a lack of awareness of the PCI DSS requirements.

Read more here.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
7 Truths About BEC Scams
Ericka Chickowski, Contributing Writer,  6/13/2019
DNS Firewalls Could Prevent Billions in Losses to Cybercrime
Curtis Franklin Jr., Senior Editor at Dark Reading,  6/13/2019
10 Notable Security Acquisitions of 2019 (So Far)
Kelly Sheridan, Staff Editor, Dark Reading,  6/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-9391
PUBLISHED: 2019-06-17
An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are available on port 3480 and can also be accessed via port 80 using the url "/port_3480". It seems that the UPnP services provide "request_image" as one of the s...
CVE-2017-9392
PUBLISHED: 2019-06-17
An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are available on port 3480 and can also be accessed via port 80 using the url "/port_3480". It seems that the UPnP services provide "request_image" as one of the s...
CVE-2018-18958
PUBLISHED: 2019-06-17
OPNsense 18.7.x before 18.7.7 has Incorrect Access Control.
CVE-2019-5016
PUBLISHED: 2019-06-17
An exploitable arbitrary memory read vulnerability exists in the KCodes NetUSB.ko kernel module which enables the ReadySHARE Printer functionality of at least two NETGEAR Nighthawk Routers and potentially several other vendors/products. A specially crafted index value can cause an invalid memory rea...
CVE-2019-5017
PUBLISHED: 2019-06-17
An exploitable information disclosure vulnerability exists in the KCodes NetUSB.ko kernel module that enables the ReadySHARE Printer functionality of at least two NETGEAR Nighthawk Routers and potentially several other vendors/products. An unauthenticated, remote attacker can craft and send a packet...