Fraud Management & Cybercrime , Fraud Risk Management , PCI Standards
PCI DSS to Focus on Phishing-Resistant Authentication
PCI Security Standards Council's Yew Kuann Cheng on Moving to the Latest Version
While PCI DSS 4.0 tackled evolving threats, the newly introduced version 4.0.1 focuses on phishing-resistant authentication factors. Yew Kuann Cheng, regional vice president for the Asia Pacific region at PCI Security Standards Council, shared insights on adapting to the new requirements and the role of MFA in security.
See Also: Breaking Down Silos With a Holistic View of Security, Risk
"One very interesting update in version 4.0.1 is the recognition of phishing-resistant authentication factors," Cheng said. "For companies who have adopted leading technology to protect themselves from phishing attacks, these companies can use that as a way to satisfy MFA requirements more easily."
MFA works effectively only when implemented correctly, Cheng said. He urges organizations to follow the guidelines meticulously and move away from vulnerable methods such as SMS-based one-time passwords.
He advises companies not to wait until the April 2025 deadline to adopt the new requirements, as the updates are designed to address emerging threats proactively.
In this video interview with Information Security Media Group, Cheng also discussed:
- The role of phishing-resistant MFA in meeting PCI DSS 4.0.1 requirements;
- Best practices for implementing MFA to ensure robust security;
- How organizations can prepare for compliance ahead.
Cheng leads PCI engagement activities in the region for the PCI Security Standards Council and is based in Singapore. He has more than 20 years of experience in risk management, payments and cybersecurity.
