PCI
COMPLIANCE, What it is and what it isn't. (This might be a little
heavy reading, but it's important stuff!)
If you are in Retail, Hospitality or any
Service Industry that accepts credit cards you have heard about PCI
Compliance unless you have been hiding under a rock.
First, what is it? PCI DSS stands for
Payment Card Industry Data Security Standard. It was developed by
the major credit card companies as a guideline to help organizations
that process card payments prevent credit card fraud, cracking and
various other security vulnerabilities and threats. A company
processing, storing, or transmitting payment card data must be PCI
DSS compliant or risk losing their ability to process credit card
payments and being audited and/or fined [1]. Merchants and payment
card service providers must validate their compliance periodically.
This validation gets conducted by auditors - i.e. persons who are
the PCI DSS Qualified Security Assessors (QSAs). Although
individuals receive QSA status reports, compliance can only be
signed off by an individual QSA on behalf of a PCI council approved
consultancy. Smaller companies, processing fewer than about 80,000
transactions a year, are allowed to perform a self-assessment
questionnaire. (Wikipeda)
The current version of the standard (1.1) specifies 12
requirements for compliance, organized into 6 logically related
groups, which are called "control objectives." These
are:
Build and Maintain a Secure Network
- Requirement 1: Install and maintain a firewall configuration
to protect cardholder data
- Requirement 2: Do not use vendor-supplied defaults for system
passwords and other security parameters
- Protect Cardholder Data
- Requirement 3: Protect stored cardholder data
- Requirement 4: Encrypt transmission of cardholder data across
open, public networks
- Maintain a Vulnerability Management Program
- Requirement 5: Use and regularly update anti-virus software
- Requirement 6: Develop and maintain secure systems and
applications
- Implement Strong Access Control Measures
- Requirement 7: Restrict access to cardholder data by business
need-to-know
- Requirement 8: Assign a unique ID to each person with computer
access
- Requirement 9: Restrict physical access to cardholder data
- Regularly Monitor and Test Networks
- Requirement 10: Track and monitor all access to network
resources and cardholder data
- Requirement 11: Regularly test security systems and processes
- Maintain an Information Security Policy
- Requirement 12: Maintain a policy that addresses information
security
Okay, now we know what PCI compliance mandates. But what
'ISN'T PCI?'
It's not a cure all for every possible security breach.
For example the recent Hannaford Bros. breach illustrates what is
lacking. Hannaford was in complete compliance with the 12
requirements of PCI compliance. Their systems where the
customer credit card information was stored were secure, their
systems were secure, firewalls were in place, anti-virus software
was installed and up to date. So what happened? The
information was stolen while the data was in transit, meaning that
it was moving from one system to another. This was the first
time a breach like this occurred. But it probably won't be the
last. Anywhere data travels opens a potential 'hole' where
information can be compromised and stolen. If you were to
transmit your database from one machine to another, complete with
customer records, payment types etc. over an unsecured transmission,
that data could be copied and extracted without you aware of
it.
So, PCI Compliance is only the beginning. Most people
know enough that they wouldn't think of sending their Credit Card
information via email, but they forget about the other areas where
this information can be stolen. All machines should be
encrypted, all machines should be password protected, all users
should be trained on security and regularly questions, observed and
retrained on security issues.
All of the Point of Sale software programs that we sell
and install in their LATEST versions are PCI
compliant. Previous versions may not be and you risk
fines, penalties and the loss of your business should a breach
occur.
What should you do if you believe
that you may be at risk?
- Insure that your POS Software package is the latest available
version. You may be required to purchase a Service Contract
before being allowed to Upgrade. We can assist you with
that.
- Insure that your anti-virus software is current and updated on
a regular basis.
- Insure that your system with the customer database is
protected by a Hard Firewall. Software Firewalls only offer
limited protection from threats.
- Install and regularly update a SPYWARE Program.
- Insure that your Database where all of your customer sales
information is stored is ENCRYPTED.
Assured Computing Technologies is ready and able to
assist you with any and all of the above points. We have
ANTI-VIRUS, SPYWARE and Encryption Tools available. Call us
today (877)
627-0636.
WATCH for our
JULY 4TH Blow Out Specials all during the month of July. Be
sure to check your email and include us in your list of approved
email senders to insure that we don't end up in
the Filter!
Quality receipt
paper 3" x200', 50 rolls per case. This should help you ring
up those sales during the current year.
