Archive for category PCI

Myths and Facts about PCI DSS

PCI DSS is a popular topic among the credit card and financial gurus of industry. A lot has been said and commented upon and some of those are not really true. To really grasp the PCI DSS, one needs to differentiate between many myths that surround it. Here are the five common myths:

1.    Myth: PCI too Hard

“….PCI is too hard, too complicated, too expensive” 

With 12 requirements of PCI DSS, it does seem too hard but in actual, PCI DSS is basic and practical security practice that is not really too hard. Even with 12 requirements, many services and products are available to help meeting these requirements with ease. As for being too expensive, the cost of being incompliant is far more in terms of security attacks and legal fines. 

2.    Myth: PCI is enough Security

“…We are secure because we got PCI” 

PCI is basic security but not necessary enough. There is more to security than just YOU’RE YOUR system is not safe from security attacks unless continuous efforts are made all the time. Assessment and remedies are must since PCI may cover confidentiality but not integrity and availability of data. 

3.    Myth: PCI is unreasonable

“..we don’t know what to do” 

Many aspects of PCI are already common practice. Standards actually permit compensating controls to meet requirement. PCI DSS documents provide details that significantly benefits merchants and processors. Check out PCI for Dummies for more information. 

4.    Myth: Just one tool, product or vendor makes us PCI Compliant

” …I use PA-DSS tools, thus I am PCI OK” 

No, it doesn’t make you PCI compliant. No single product or vendor can meet all 12 requirements. So instead of focusing on just one product, make sure to follow complete security strategy and focus on the big picture instead of just one aspect. 

5.    Myth: Not enough credit cards to be PCI compliance

“..we don’t need PCI compliance since we don’t deal in credit cards much” 

Even if you make just one transaction then you require PCI compliance because it is required for any business that accepts payments. 

So these are some common myths that surround PCI DSS. However, there are more. You can check them out herehere and here.

, , , ,

What’s this PCI DSS all about?

Attackers are modern version of pocket pickers, only more bothersome as unlike pocket picker they not only just steal your wallet but also your personal confidential information. When plastic money i.e credit cards were introduced, they were hailed as a source of convenience and ease. Unfortunately, it proved to be an easy target for scams, frauds, phishing, and other related attacks. To cater that, giants of the credit card industry established Payment Card Industry (PCI) Data Security Standard (DSS) – PCI DSS.

Just as the name suggests, theses are a set of standards to protect from security breaches in credit card payment networks. These standards are governed by a council comprising of American Express, Discover, JCB, MasterCard and Visa. These standards apply to any financial institution, organization, vendor, and merchant that use, store, process, or transmit payment cardholder data.

In some countries, by now businesses must be PCI DSS compliant or else they can lose the ability to process credit card payments and can be heavily fined. In Pakistan, I believe financial institutions must be PCI DSS compliant by 2010. So, it’s the right time to start preparing for the implementation of PCI DSS controls.

To be PCI DSS compliant, company has to follow twelve specified requirements that are organized into six logically related groups.

Control Objectives

PCI DSS Requirements

Build and Maintain a Secure Network 1.      Install and maintain a firewall to protect cardholder data
2.      Do not use vendor-supplied defaults for system passwords and other security parameters
Protect Cardholder Data 3.      Protect stored cardholder data
4.      Encrypt transmission of cardholder data across open, public networks
Maintain a Vulnerability Management Program 5.      Use and regularly update anti-virus software on all systems commonly affected by malware
6.      Develop and maintain secure systems and applications
Implement Strong Access Control Measures 7.      Restrict access to cardholder data by business need-to-know
8.      Assign a unique ID to each person with computer access
9.      Restrict physical access to cardholder data
Regularly Monitor and Test Networks 10.  Track and monitor all access to network resources and cardholder data
11.  Regularly test security systems and processes
Maintain an Information Security Policy 12.  Maintain a policy that addresses information security

Various revisions in PCI DSS have been released over the years and the current version was released in December 2008 October 2008 (Credit goes to Mr. Yousuf Zubairi for pointing out our lapse here – Thanks alot). Many controversies and criticisms surround these versions that I believe, deserve another post.

, , , ,

Copyright © Rewterz. All rights reserved.