[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:pci-dss\u002Frequirement-8":3},{"item":4,"lessons":16,"controls":66,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"pci-dss","requirement-8","Requirement 8.2","Requirement 8: Identify Users and Authenticate Access to System Components",25,"PCI Security Standards Council","**What it asks for.** Requirement 8 of PCI DSS v4.0 covers user identification and authentication for access to system components in the cardholder data environment. It requires unique IDs, management of user and system accounts, strong authentication factors, protection of credentials, multi-factor authentication and controls on application and system accounts, including their use of passwords.\n\n**In practice.** Organisations assign every user a unique ID, remove or disable accounts promptly, enforce password or passphrase requirements and require multi-factor authentication for access to the cardholder data environment and for remote access. v4.0 extends MFA expectations and adds controls for system and application accounts. Evidence includes account listings, access reviews, MFA configuration and procedures for shared or generic accounts.\n\n**Common gaps.** Service and application accounts with hard coded or never changed passwords are a common gap. Generic shared accounts also persist without the required justification and controls.",null,"https:\u002F\u002Fwww.pcisecuritystandards.org\u002Fstandards\u002Fpci-dss\u002F","Read about PCI DSS","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"ai-powered-rathat-malware-bypasses-mfa-to-steal-banking-credentials-on-android","AI-Powered RatHat Malware Bypasses MFA to Steal Banking Credentials on Android","2026-09-22T18:21:20.981+00:00",{"slug":23,"title":24,"published_at":25},"breeze-comet-exploits-weak-auth-and-unpatched-servers-to-steal-from-brazilian-payment-systems","Breeze Comet Exploits Weak Auth and Unpatched Servers to Steal from Brazilian Payment Systems","2026-09-01T20:21:46.423+00:00",{"slug":27,"title":28,"published_at":29},"expired-visa-cards-exploited-for-contactless-payments-via-authentication-bypass","Expired Visa Cards Exploited for Contactless Payments via Authentication Bypass","2026-08-22T12:20:18.035+00:00",{"slug":31,"title":32,"published_at":33},"android-malware-duo-steals-card-data-and-enables-fraudulent-loans-via-nfc-relay","Android Malware Duo Steals Card Data and Enables Fraudulent Loans via NFC Relay","2026-08-13T00:20:41.041+00:00",{"slug":35,"title":36,"published_at":37},"critical-adobe-commerce-auth-bypass-exploited-in-the-wild","Critical Adobe Commerce Auth Bypass Exploited in the Wild","2026-08-12T22:20:39.613+00:00",{"slug":39,"title":40,"published_at":41},"credential-stuffing-breach-exposes-13000-chick-fil-a-customers","Credential Stuffing Breach Exposes 13,000+ Chick-fil-A Customers","2026-07-24T16:21:59.819+00:00",{"slug":43,"title":44,"published_at":45},"credential-stuffing-compromises-chick-fil-a-loyalty-accounts","Credential Stuffing Compromises Chick-fil-A Loyalty Accounts","2026-07-23T16:21:12.308+00:00",{"slug":47,"title":48,"published_at":49},"credential-stuffing-attack-exposes-chick-fil-a-customer-data","Credential Stuffing Attack Exposes Chick-fil-A Customer Data","2026-07-22T08:20:52.826+00:00",{"slug":51,"title":52,"published_at":53},"missing-mfa-on-admin-accounts-led-to-payment-card-skimming-at-danish-fashion-brand","Missing MFA on Admin Accounts Led to Payment Card Skimming at Danish Fashion Brand","2026-07-17T08:20:23.921+00:00",{"slug":55,"title":56,"published_at":57},"suno-ai-breach-developer-credential-theft-exposes-training-data-scraping","Suno AI Breach: Developer Credential Theft Exposes Training Data Scraping","2026-07-16T19:20:37.467+00:00",{"slug":59,"title":60,"published_at":61},"redwing-maas-turns-android-bank-fraud-into-a-telegram-rental-service","RedWing MaaS Turns Android Bank Fraud Into a Telegram Rental Service","2026-07-07T18:21:10+00:00",{"slug":63,"title":64,"published_at":65},"credential-stuffing-attack-drains-60000-draftkings-accounts","Credential Stuffing Attack Drains 60,000 DraftKings Accounts","2026-06-25T16:20:51.152+00:00",[67,72,77,82,87,92],{"slug":68,"name":69,"problem":70,"stories":71},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",13,{"slug":73,"name":74,"problem":75,"stories":76},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",12,{"slug":78,"name":79,"problem":80,"stories":81},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",11,{"slug":83,"name":84,"problem":85,"stories":86},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",6,{"slug":88,"name":89,"problem":90,"stories":91},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",5,{"slug":93,"name":94,"problem":95,"stories":96},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",4,[98,104,110,115,119,125,130,134],{"family":99,"item":100,"code":101,"title":102,"together":103},"gdpr","32","Article 32","Security of processing",17,{"family":105,"item":106,"code":107,"title":108,"together":109},"cis","6","Control 6","Access Control Management",15,{"family":111,"item":112,"code":113,"title":114,"together":71},"nist-800-53","ac-2","AC-2","Account Management",{"family":105,"item":116,"code":117,"title":114,"together":118},"5","Control 5",10,{"family":120,"item":121,"code":122,"title":123,"together":124},"nist-sp","800-63","SP 800-63","SP 800-63: Digital Identity Guidelines",8,{"family":5,"item":126,"code":127,"title":128,"together":129},"requirement-6","Requirement 6.3","Requirement 6: Develop and Maintain Secure Systems and Software",7,{"family":105,"item":131,"code":132,"title":133,"together":129},"4","Control 4","Secure Configuration of Enterprise Assets and Software",{"family":99,"item":135,"code":136,"title":137,"together":86},"33","Article 33","Notification of a personal data breach to the supervisory authority"]