If an organisation’s financial data is not protected, then it can enable criminals to steal and use the data from the system. The data must be protected from vulnerabilities that can occur in the payment card processing ecosystem. It is a serious problem; therefore, standard security procedures have been developed.
PCI DSS (Payment Card Industry Data Security Standard) is a set of security rules developed to ensure the security of payment card accounts. The account data covers the
Cardholder Data (CHD) and Sensitive Authentication Data (SAD). The CHD includes the cardholder’s name, PAN and the card’s expiration date. SAD includes full track data, which is magnetic strip data or the equivalent on a chip. The environment where this account data exists is called the Cardholder Data Environment (CDE).
Merchants and other entities that store, process or transmit cardholder data must get a PCI DSS certification. To adhere to PCI DSS, an organisation must follow these three important steps:
- Find all the locations of the cardholder data and make an inventory of the IT assets and business processes used for payment card processing, and analyse them for vulnerabilities.
- Fix the identified vulnerabilities and delete any unnecessary cardholder data storage. Implement secure business processes.
- Document assessment and remediation details and submit the required compliance reports to the cardholder brands and acquiring banks you do business with.
PCI DSS requirements
- Develop and maintain a secure network and systems.
Establish and maintain firewall and router configuration standards. Identify all connections between the CDE and the other networks/wireless. Review the configuration rule set every six months. Install personal firewall software on any devices used by the employees, and can also access the CDE.
- Do not use defaults provided by vendors for system passwords and other security parameters.
The easiest way for a hacker to enter your network is by using the default passwords or the default system software settings in your payment card infrastructure. Always change all vendor-supplied defaults and disable or delete all unnecessary default accounts before you install a system on your network.
- Must protect stored cardholder data.
Unless cardholder data is necessary to meet the needs of the organisation, it must not be stored. Limit cardholder data storage to the time required by the organisation, legal or regulatory purposes, as per your data retention policy. Render all authentication data unrecoverable upon completion of the process.
- Encrypt cardholder data when transmitting across open and public networks.
Cyber criminals may intercept the transmission of cardholder data on the network; therefore, it is important to prevent their ability to view the data. Encryption technology can be used to make the transmitted data unreadable to any unauthorised person.
- Protect all systems against malware and regularly update anti-virus software and programs.
Malicious software can exploit the vulnerabilities once it enters the system. Anti-virus software must be used on all systems which are affected by malware. This will help to protect the system from current and evolving software threats.
- Develop and maintain secure systems and applications.
Security vulnerabilities in the system and applications may allow criminals to access the cardholder data. Vulnerabilities can be eliminated by using the vendor-provided security patches. Use the most recent security patches for all your critical systems. For developing applications, secure coding practices.
- Control access to cardholder data by business need-to-know.
To ensure that sensitive data is accessible by authorised personnel only, limit access by need-to-know and job responsibilities. Access rights should be granted to only the least amount of data and privileges needed for a job.
- Identify and authenticate access to system components.
Each person with access to critical data must be assigned a unique identification number. This will ensure that the actions taken on critical data and systems are performed by and accessed by known authorised users.
- Restrict physical access to cardholder data.
Use organisation entry controls to monitor and limit physical access to the systems in the CDE. Use ID batches to distinguish between the on-site personnel and visitors.
- Monitor and track access to all the networks and cardholder data.
Maintain system activity logs in all environments to track and analyse in case something goes wrong. Determining the cause of the compromise without logs can be very difficult.
- Regularly test security systems and processes
Vulnerabilities are discovered continually; therefore, you should test your system components, processes and software frequently.
- Maintain an effective information security policy for all personnel.
Establish, maintain, publish and propagate a security policy and review it annually.