What is PCI DSS & how to become Compliant?

What is PCI DSS & how to become Compliant?

While data breaches and data theft are becoming very common, and negatively impacting all payments parties in different ways, PCI Security Standards Council has developed the Payment Card Industry Data Security Standard [PCI DSS], which helps secure and protect the entire payment card ecosystem. From retailers to consumers to banks, any company that processes cardholder data, commonly known as “CHD” in PCI DSS parlance, must comply with the PCI DSS Standard.

Although PCI DSS is a global standard, it is not mandated by any law anywhere in the world. However, all countries have some variation of regulation surrounding cardholder data and non-compliance sometimes results in hefty fines for the company.

So why is it so important to comply with PCI DSS?

Importance of PCI DSS Compliance

Compliance with the PCI DSS Standard is very crucial. It means that you are taking appropriate steps to protect cardholder data from cyber-theft and fraudulent abuse. It can have a deeper impact on your business as it does to the customers because a cyber-attack can mean a potential loss of revenue, brand reputation, trust, and customers.

For small businesses that are less equipped to implement security measures, data breaches have become a regular occurrence for them. For instance, in the UK, an Information Security Breach Survey done a few years back indicated that 74% of small organizations reported a security breach in a year. Keeping this fact in mind, it has become more important than ever to undertake responsibility for your customer’s data and ensure that you make the right provisions to keep it secure.

How to become PCI DSS Compliant?

For any company that wants to become PCI DSS compliant first needs to understand how payment data is captured, stored, and organized. Some companies even use a fully hosted solution to manage this. Here’s a PCI DSS Compliance checklist to help.

Compliance is usually measured by the Service Provider, completing an audit of their cardholder data environment against the standard. Compliance validation is performed by a Qualified Security Assessor [QSA], or by an Internal Security Assessor [ISA]) or by a Self-Assessment Questionnaire [SAQ] for small companies with lesser volumes of cardholder data.

As defined by IT Governance, PCI DSS requires member service providers [MSP] and merchants involved with storing, processing, or transmitting cardholder data to:

Form and maintain a secure IT network;

• Safeguard cardholder data;
• Maintain a Vulnerability Management Program;
• Enable strong access control measures;
• Regularly check and test networks;
• Maintain an Information Security Policy.

These elements are further broken down into 12 Requirements of PCI DSS that every MSP or merchant must follow in order to be PCI DSS compliant.

1. Installing and maintaining a firewall configuration for protecting cardholder data.
2. Never use vendor-supplied default passwords for systems and other security parameters.
3. Protecting stored cardholder data. This includes procedures, policies, and processes to keep and dispose of data, so as to make sure that it is always up-to-date and accurate. Data like contents of the magnetic strip, personal identification number, or card verification number should never be stored. Encryption can help keep cardholder data secure.
4. Transmission of cardholder data across all open public networks should be encrypted. For instance, the internet, wireless technologies like GPRS, Bluetooth, and satellite communications.
5. Protecting systems against malware and regularly updating antivirus programs to mitigate against Trojans, viruses, and worms is very important. Antivirus software programs should be properly implemented, maintained, and kept running.
6. Developing and maintaining secure systems and applications for safeguarding against the latest vulnerabilities at all times.
7. Processes and systems should be put into place for who can have access to this data and why they require access. Access should be provided to only those who need it to perform their role. Otherwise, there should be restricted access to cardholder data by business need-to-know
8. Every user with computer access should be assigned a unique ID. This ensures that you know who is accessing what data at any time and only people with proper authorization are allowed in specific systems. Proper authorization can be ensured by using two-factor authentication that increases security like tokens, smart cards, or biometrics.
9. Physical access should be restricted to cardholder data. Proper care should be taken to ensure access to physical records is limited and monitored. Data centers and server rooms should be restricted, media should be destroyed and devices that carry data should be protected from tampering.
10. All-access to network resources and cardholder data should be tracked and monitored. To detect and minimize the risk of a data breach logging all access is necessary. Secure and controlled audit trails must be implemented for logging all actions from users including privileges, access to data, invalid login attempts, and changes to authentication mechanisms like deletion of objects. These logs must be regularly reviewed.
11. Security systems and processes should be regularly tested. Penetration testing is a crucial aspect of IT security team’s tools and should be carried out after any significant changes to the network, like vulnerability scans, network topology, and firewall maintenance.
12. A policy should be maintained to address information security for contractors and employees. It should be reviewed twice annually and updated according to any new risk environment. A risk assessment must be carried out for identifying any vulnerabilities or threats so that the policy and incident response plan can be formed. Post that, an awareness program should be implemented to share and update staff of any new security protocol.

Neumetric, a cyber security services, consulting & products organization, can help you reduce your pci dss cost without compromising your security posture. Our years of in-depth experience in handling security for organizations of all sizes & in multiple industries make it easier for us to quickly execute cost-cutting activities that do not bring value to you, while you continue focusing on the business objectives of the Organization.