Were not even midway through 2018, and this year has already seen some of the most high profile companies and brands become victims to potentially malicious cyber attacks. Delta Airlines, Sears, and Panera Bread are just a few examples of high-profile companies that have had to contend with data breach and unauthorized access by outsiders so far this year.
Category: PCI DSS
Stay up-to-date with PCI DSS compliance. Explore in-depth guides, implementation steps, and best practices to safeguard payment data and meet regulatory standards.
-
Protect Cardholder Data With Antivirus Software
What is Antivirus Software?
Lets face it, we are living in a highly technical age. Computers and digital technology surround us, cell phones that fit in our pockets have turned into full blown portable computers. There have been threats to computers just about as long as computers have been around. The first antivirus (AV) software was used to protect against just that, a computer virus. The name remains today, but there are far more malicious tools out there other than viruses. Modern anti-virus software protections can include shields against trojan horses, worms, spyware, adware, rootkits and can sometimes include guards against phishing.
-
How to Keep Data Secure for Cardholders (PCI DSS Req. 3)
The Payment Card Industry (PCI) is a coalition of credit card companies including American Express, Discover, MasterCard and Visa. Non-compliance with the 12 requirements specified in the PCI Data Security Standards (DSS) puts your company at greater risk of a future data breach that comes with a steep financial cost as evidenced by the plethora of well publicized data breaches last year alone. Of the 12 PCI DSS requirements, it was found that 79% of failed PCI Compliance assessments were in non-compliance because of not being able to protect cardholder data via requirement 3. Thats huge.
-
Does a QSA need to be onsite for a PCI DSS assessment?
Keeping cardholder data safe and secure is an important part of your business as well as an agreement with your payment card brands and acquirers in order to accept the credit card based payments. Compromised data has a negative impact on everyone involved. Protecting data can help:
- Improve customer relationships
- Increase overall profitability in any program
- Prevent damage to your business’s reputation
This blog is part of our series of articles that will address frequently asked questions and provide a comprehensive guide on PCI DSS requirements and compliance.
Before we talk about QSA and on site assessment process for PCI compliance, heres a quick recap of the basics on PCI DSS.
-
Restricting physical access to cardholder data (PCI DSS Req. 9)
Credit cards hold a remarkable amount of cardholder data. If that data were to fall into the wrong hands, it could ruin a persons life. Now, imagine your company has a database of millions of credit cards that are unique to their cardholder. If that database were to be remotely breached via a phishing scam or hack, your entire database of payment cards could be stolen in a blink of an eye. In 2012 alone, attackers posing as legitimate service people substituted the payment devices and subsequently compromised three large retailers. It was found that 39% of organizations had been breached through insecure remote access (which was the single largest origin of compromise that organizations encountered).
-
Does a P2PE validated application also need to be validated against PA-DSS?
There were 1,579 data breaches with over 178 million records exposed in 2017 alone. That averages about four data breaches a day for the entire year of 2017. Let that sink in for a second. That amounts to a nearly 45% overall increase over 2016 figures. Thankfully, there are ways that you can avoid a data breach, but these figures still lend themselves to have a bit of sticker shock. One way that companies can protect themselves from payment card data breaches is protecting their cardholder data environment (CDE) via PCI (Payment Card Industry) DSS (Data Security Standard) compliance. Any organization or merchant that accepts, transmits or stores any cardholder data must comply with PCI DSS.
-
Is VoIP in scope for PCI DSS?
Before we delve into understandingVoice over Internet Protocol (VoIP) and data security on VoIP systems, heres a quick introduction to PCI DSS payment card data security standards.
The PCI Standard is mandated by the card brands and administered by the Payment Card Industry Security Standards Council. The PCI security standard was created to increase controls around cardholder data to reduce credit card fraud. Validation of compliance is performed annually, either by an external Qualified Security Assessor (QSA) or by a firm specific Internal Security Assessor (ISA) that creates a Report on Compliance for organizations handling large volumes of credit card payment transactions, or by Self-Assessment Questionnaire (SAQ) for companies handling smaller volumes.
-
How Does Encrypted Cardholder Data Impact PCI DSS Scope?
Merchants need to protect the cardholder data that they collect and encryption is one of the ways this is accomplished. Encryption by itself is not enough to place data out of scope for PCI DSS. This blog will cover what a cardholder data environment is, how encrypted data is part of that environment, and how encryption fits into the scope of PCI compliance.
-
Types of Data Security Standards
Credit and debit cards have been around since the 1850s, but werent commonplace in American wallets until the 1970s. Why? Because consumers were wary of using them due to the nonexistent security measures and legislative support that was in place at the time. Consumer complaints against this lack of regulation led to the implementation of the Fair Credit Reporting Act of 1970, the Unsolicited Credit Card Act of 1970, the Fair Credit Billing Act of 1974, the Equal Credit Opportunity Act 1974, the Fair Debt Collection Practices Act of 1977. The passing of these acts gave consumers the support and confidence to use their credit and debit cards at a merchant without having to worry about having their data stolen or being discriminated for their transactions.
-
How to Gain QSA Designation
Becoming a Qualified Security Assessor, commonly referred to as a QSA, is a relatively grueling process that is in line with the important role that a QSA plays. In this article, well answer what a QSA is, how you can gain QSA designation, and why using a QSA to audit your cybersecurity is something you should be already doing. This information should provide insight into the role that QSAs play in cyber-security, and allow you to assess whether outsourcing your cyber-security to a QSA designated firm is a good choice given your security needs.