November 2022 Summaries

Achieving PCI DSS compliance, a global standard established in 2005 to protect cardholder data from breaches, is often challenging due to its extensive requirements, which can involve over 300 controls and significant resources. Compliance is mandated by major card brands and enforced through acquiring banks, affecting both merchants and service providers. The complexity of PCI DSS, which includes rigorous audit and security measures, can divert engineering efforts from core product development. However, organizations can reduce the burden through automation, minimizing their cardholder data environment (CDE) footprint, or by ensuring they never handle plaintext card data, which drastically reduces the number of required controls. These approaches help mitigate risks and lower compliance costs, while tools and third-party services can aid in simplifying the compliance process.

The concept of the "Cryptography Lag" refers to the delay in integrating advanced cryptographic techniques from academic research into practical application, creating vulnerabilities in data security. This lag exists due to several factors including the historical cost of encryption, which has decreased over time with advancements like Moore's Law, and the practical difficulties of implementing complex cryptographic methods such as fully-homomorphic encryption. Standardization requires time for testing new algorithms, ensuring that only secure and reliable cryptosystems are widely adopted. Patenting and governmental regulations have historically restricted the use of certain cryptographic systems, further contributing to the lag. Additionally, encryption's complexity and potential for misuse have deterred developers from using it extensively. Companies like Evervault are working to address these challenges by offering tools that simplify encryption processes, aiming to make it easier for developers to secure data without handling plaintext, thus reducing the cryptography lag and enhancing overall data security.