A set of security rules is outlined in the PCI DSS in order to protect payment systems from being hacked, fraudulently used, or their identities stolen. American Express, Discover, JCB, MasterCard, and Visa all had their security requirements harmonised and aligned. The Payment Card Industry Security Standards Council (PCI SSC) was founded by the five corporations to monitor the evolution of PCI DSS.
Any business that accepts credit or debit card payments in person, over the phone, or online must adhere to the PCI Data Security Standard, which has been approved as a global standard by financial institutions around the world.
As of 2018, the PCI DSS now includes more than 243 different types of security controls. Using firewalls and anti-virus software, as well as changing your default passwords, is a must if you want to keep your systems safe from hackers.
PCI DSS has a clear objective.
Payment processors, issuers, and service providers are all safeguarded by the PCI DSS standards.. Companies that handle, store, process, and transmit sensitive authentication data, such as credit card numbers, are at risk. Payment processing can't be outsourced without ensuring the security and compliance with PCI DSS of the credit card data.
Data from credit cards is protected by PCI DSS.
Information about credit cards and privileged authentication is safeguarded by the PCI DSS. All cardholders are asked to provide their primary account numbers, names, expiration dates, and service codes. Personal identification numbers (PINs) and credit card verification numbers are examples of authentication data that must be kept secret (CVCs, CVVs etc.).
Maintain a record of consumer information.
It is against PCI DSS 3.2 for sensitive authentication data to be stored in any form, even if it is encrypted. After the authorization procedure is complete, all sensitive authentication data should be completely deleted from all computer systems.
This includes portable digital media, backup data and logs. Primary account numbers are required to be encrypted. There are a number of ways to make data unreadable using key-based encryption, including hashes and truncation.
Retailers have been urged by the Council to use both hashed and shortened versions of a single account number in order to prevent outsiders from successfully matching the numbers. The names, expiration dates, and service codes of the cardholders can be stored in plaintext.
Criteria for core security of PCI DSS
For account data protection, the PCI DSS sets a technological and operational standard. Nearly 250 distinct kinds of security measures are included in each of the twelve standards.
- Setting up a firewall is a good way to safeguard the personal information of customers.
- Passwords and other security measures that aren't part of the normal configuration not be used
- Always transfer credit card data safely via open networks.
- Antivirus software updates are an important part of keeping your computer safe from infection.
- Keep your systems and applications safe.
- Restrict access to cardholder information only for business needs.
- Authenticate the identification of the people who have access to a network
- Access to cardholder information to be restricted.
- It is imperative that all network resources and access to cardholder data is logged.
- Do a periodic check to ensure that your security measures are current and functioning properly.
- Employees are expected to follow a strong code of ethics when it comes to protecting company data.
The PCI DSS outlines the rationale behind each criterion, as well as the methods for verifying compliance. Even without the use of typical anti-virus and firewall software, restricting access to credit card data is achievable. Data loss prevention (DLP) software can keep track of and restrict access to cardholder data, including card numbers, names, and expiration dates.
PCI DSS Certification Levels
The PCI Data Security Standard is divided into four categories . This is determined by the company's annual card transactions. Approximately 6 million card transactions must be processed each year in order to meet the criteria of PCI DSS Level 1.
Level 1 organizations are expected to provide an annual Report on Compliance that has been audited by a PCI-certified QSA or ISA (RoC). The auditor delivers RoCs to the company's lending banks. Once a year, a recognized vendor must also do a scan.
Companies of all sizes can find a SAQ version that works for them. When it comes to credit cards, this depends on the one you have: QSA or ISA certification is required by MasterCard for Level 2 organizations to complete the SAQ.
What happens if you are non-compliant?
Organizations who flout the regulations could face fines of up to $100,000 per month and additional transaction costs on a monthly basis. The worst-case scenario is that they could be kicked off their bank's good list and placed on the Merchant Alert to Control High-Risk (MATCH) list, making it impossible for them to accept credit card payments in the future. After a data breach, a merchant's PCI DSS compliance level might be increased.