RSI Security

Rethinking Your Cybersecurity

Category: PCI DSS

Stay up-to-date with PCI DSS compliance. Explore in-depth guides, implementation steps, and best practices to safeguard payment data and meet regulatory standards.

  • Protect Cardholder Data With Antivirus Software

    Protect Cardholder Data With Antivirus Software

    What is Antivirus Software?

    Lets face it, we are living in a highly technical age. Computers and digital technology surround us, cell phones that fit in our pockets have turned into full blown portable computers. There have been threats to computers just about as long as computers have been around. The first antivirus (AV) software was used to protect against just that, a computer virus. The name remains today, but there are far more malicious tools out there other than viruses. Modern anti-virus software protections can include shields against trojan horses, worms, spyware, adware, rootkits and can sometimes include guards against phishing.

    (more…)

  • Restricting physical access to cardholder data (PCI DSS Req. 9)

    Restricting physical access to cardholder data (PCI DSS Req. 9)

    Credit cards hold a remarkable amount of cardholder data. If that data were to fall into the wrong hands, it could ruin a persons life. Now, imagine your company has a database of millions of credit cards that are unique to their cardholder. If that database were to be remotely breached via a phishing scam or hack, your entire database of payment cards could be stolen in a blink of an eye. In 2012 alone, attackers posing as legitimate service people substituted the payment devices and subsequently compromised three large retailers. It was found that 39% of organizations had been breached through insecure remote access (which was the single largest origin of compromise that organizations encountered).

    (more…)

  • Does a P2PE validated application also need to be validated against PA-DSS?

    Does a P2PE validated application also need to be validated against PA-DSS?

    There were 1,579 data breaches with over 178 million records exposed in 2017 alone. That averages about four data breaches a day for the entire year of 2017. Let that sink in for a second. That amounts to a nearly 45% overall increase over 2016 figures. Thankfully, there are ways that you can avoid a data breach, but these figures still lend themselves to have a bit of sticker shock. One way that companies can protect themselves from payment card data breaches is protecting their cardholder data environment (CDE) via PCI (Payment Card Industry) DSS (Data Security Standard) compliance. Any organization or merchant that accepts, transmits or stores any cardholder data must comply with PCI DSS.

    (more…)

  • Is VoIP in scope for PCI DSS?

    Is VoIP in scope for PCI DSS?

    Before we delve into understandingVoice over Internet Protocol (VoIP) and data security on VoIP systems, heres a quick introduction to PCI DSS payment card data security standards.

    The PCI Standard is mandated by the card brands and administered by the Payment Card Industry Security Standards Council. The PCI security standard was created to increase controls around cardholder data to reduce credit card fraud. Validation of compliance is performed annually, either by an external Qualified Security Assessor (QSA) or by a firm specific Internal Security Assessor (ISA) that creates a Report on Compliance for organizations handling large volumes of credit card payment transactions, or by Self-Assessment Questionnaire (SAQ) for companies handling smaller volumes.

    (more…)

  • How Does Encrypted Cardholder Data Impact PCI DSS Scope?

    How Does Encrypted Cardholder Data Impact PCI DSS Scope?

    Merchants need to protect the cardholder data that they collect and encryption is one of the ways this is accomplished. Encryption by itself is not enough to place data out of scope for PCI DSS. This blog will cover what a cardholder data environment is, how encrypted data is part of that environment, and how encryption fits into the scope of PCI compliance.

     

    (more…)

  • How to Gain QSA Designation

    How to Gain QSA Designation

    Becoming a Qualified Security Assessor, commonly referred to as a QSA, is a relatively grueling process that is in line with the important role that a QSA plays. In this article, well answer what a QSA is, how you can gain QSA designation, and why using a QSA to audit your cybersecurity is something you should be already doing. This information should provide insight into the role that QSAs play in cyber-security, and allow you to assess whether outsourcing your cyber-security to a QSA designated firm is a good choice given your security needs.

    (more…)

  • How often should you audit your cyber security?

    How often should you audit your cyber security?

    Cyber security compliance audits are an integral part of securing your networks and systems from data theft or other types of cybercrime attacks. Audits are a process through which your information security policy, framework, and implementation are checked and tested to ensure that they meet the standards for compliance. In this article, well go into greater detail on why audits are an important part of maintaining compliance, and how frequently you should be conducting them.

    (more…)

  • What is PCI administrative access?

    What is PCI administrative access?

    Your organization may feel as though its ready to be PCI DSS compliant, but do you really understand the complexities that come with this undertaking? The multitude of short and long-term intricacies that your business must adhere to is mind boggling. Are you truly ready to take the blue pill and fall down that rabbit hole for your company’s foreseeable future? Well, if you want to keep accepting credit cards at your point of sale (POS), you’re going to need to do more than just cram before your required PCI compliance scans. When 45% of businesses continue to take card payments even though they fail to comply with payment security regulations, you don’t want to become another data breach statistic. To fully grasp the density of requirements surrounding PCI compliance, follow us down the tunnel where we will detail the 4 levels of PCI compliance and the usefulness of PCI administrative access.

    (more…)

  • Can card verification codes be stored for recurring autopay transactions?

    Can card verification codes be stored for recurring autopay transactions?

    Life in 2018 is busy. I know, Im right in the thick of it. The thing that just nags the most? Bills. Call me crazy, but I still make payments manually on a regular basis. Then there are some payments I just leave to the autopay overlords. As much as I like being in control, theres something satisfying about having that bill paid on its own. A small amount of pressure swept away from a busy life.

    (more…)