How To Safeguide Your PCI DSS

WHAT IS PCI DSS

PCI DSS compliance involves responding to a series of requirements imposed by the credit card industry. To succeed, organisation must implement strict information security management processes and should master the risks related to the protection of credit card sensitive data. There are many actions that could be accomplished before hand to ease the audit process, to reduce the effort and time consumed by the audit engagement and to ensure audit conclusions reflect the exact risk posture of the organisation.
PCI DSS compliance is the hottest topic for many organisation in today's business world. Conforming to PCI DSS is required by most of the major credit card companies, such as VISA, Mastercard and American Express (among others) to ensure that the card data a company takes from its clients is maintained to a universally accepted level of security. However, there are many companies and organisation that are having difficulty in becoming compliant with PCI DSS. Some organisation do not understand its requirements or, through no fault of their own, misinterpret the requirements entirely. James Rees of Razor Thorn Security looks at where organizations

Why is PCI Compliance Important to an Organization?

Payment Card Industry (PCI) Data Security Standard (DSS) compliance is important to organizations that want to accept payment cards or transmit, process, or store payment card data. Since almost every business accepts credit or debit cards as a form of payment, PCI compliance has a very real appeal for data security.
The control measures laid out in the PCI DSS reduce the risk of credit and debit card data loss. Not only is PCI compliance a requirement to prevent identity theft, but it is also packed full of best practices for detecting, preventing, and remediating data breaches. Becoming PCI compliant also protects an organization should a data breach ever occur and cardholder data become leaked. Visa, Mastercard, Discover, and American Express recognize small businesses that are PCI DSS compliant and strongly promote information security practices. Failure to comply with PCI DSS comes at the cost of fines that may end a business owner’s ability to conduct e-commerce, accept payment cards, accept online payments in the future.

Who Does PCI DSS Apply To?

The Payment Card Industry Data Security Standard (PCI DSS), established by the Payment Card Industry Security Standards Council (PCI SSC), globally applies to any company that stores, processes or transmits cardholder information. Regardless of size, if a business fits into that description it must be PCI DSS compliant to avoid fines and continue to accept payment cards. The PCI Security Council’s founding member include card brands such as American Express, Discover Financial Services, JCB International, Mastercard, and Visa, Inc. Cardholder data is defined as the primary account number (PAN) in conjunction with cardholder name, credit card expiration date, or its service code. Additionally, PCI requires business who collect sensitive authentication data to be compliant. Sensitive authentication credit card data includes, but is not limited to, card validation codes/values, track data from a magnetic stripe or card chip, PINs, PIN blocks, or any other information used to authenticate cardholders or authorize payment card transactions.
The standard established four levels of PCI compliance surrounding information security. The different levels define the physical access, anti-virus software, security systems, public networks, and network resources controls necessary to maintain compliance. To be PCI compliant, merchants must complete a self-assessment questionnaire (SAQ) and have Qualified Security Assessor (QSA) audit the controls’ adequacy to mitigate data breaches. Any point-of-sale technology (including websites), line-busting technology, or WLAN used to store, process, or transmit card information holder data falls under the compliance requirement. If a business chooses to outsource the PCI DSS requirements to a third-party the merchant is responsible for oversight and vendor management to ensure continuous compliance with the standard.
E-commerce merchants must use PCI DSS validated third parties if they choose to outsource payment processing to secure systems. Additionally, they need to ensure that no electronic storage, processing, or transmission of cardholder data remains on their systems or premises. Merchants who only use imprint machines with no electronic cardholder data storage and/or who use standalone dial-out terminals with no electronic cardholder data storage should also consider becoming PCI DSS compliance. Merchants using standalone, PTS-approved terminals that connect to a payment processor using an IP address need to review their individual compliance requirements. In cases where the merchant manually enters individual transactions on a keyboard into an internet-based terminal solution, the business needs to review the PCI DSS validated the third party for compliance. If a merchant uses a payment system connected to the internet with no electronic cardholder data stored, they need to incorporate PCI DSS compliance.
Some merchants only use hardware payment terminals included in and managed by a validated PCI SSC-listed P2PE solution, and they must be compliant and ensure their vendor is compliant. Service providers, defined as business entities that are not payment brands but process, store, or transmit cardholder data on behalf of another entity must be PCI DSS compliant. Service providers may include but are not limited to businesses that provide managed firewalls, IDS, or hosting services.

Companies approach towards PCI DSS compilance

PCI DSS a perfect guide for compliance

The Payment Card Industry Data Security Standard (PCI DSS) must be met by all organizations (merchants and service providers) that transmit, process or store payment card data. It is a contractual obligation applied and enforced-by means of fines or other restrictions-directly by the payment providers themselves. As the cybercrime market evolves, attackers, targets and techniques do as well. The majority of data breaches still occur because basic controls are not in place, or because those that were present were not consistently implemented across an organization. If obvious weaknesses are left exposed, chances are the attacker will exploit them. The objective of this revised practical guide is to give entities advice and tips on the entire PCI implementation process. It provides a roadmap, helping entities to navigate the broad, and sometimes confusing, PCI DSS v2, and shows them how to build and maintain a sustainable PCI compliance program. This latest revision also includes increased guidance on how to ensure your compliance program is' sustainable ‘and has been based on real-life scenarios, which should help to ensure your PCI compliance program remains compliant. Although the guide starts with sections on why and what is PCI, it is not intended to replace the'publicly available'PCI information. This book looks to serve those who have been given the responsibility of PCI, and does not attempt to provide all the answers. It should be read, absorbed and digested only with a good helping of other PCI'publicly available ‘information. In other words, it will help an organization or individual, get started, and hopefully furnish the reader with enough of the fundamental basics to create, design and build the organization's own PCI compliance framework.

---