The PCI DSS Standards For Information Security

The Standards for information security in the modern, fast-paced business environment will continue to grow and evolve as the tactics and techniques that hackers and other criminals use also evolve. The PCI DSS (Payment Card Industry Data Security Standard) was created by the five major credit card companies to be a tool and a standard by which merchants can employ and maintain a secure business environment for their customers.

The PCI DSS is a set of 12 requirements that any merchant that processes, stores, or transmits sensitive credit card data must adhere to. These requirements are not all easy, nor are they necessarily cheap to implement. They are, however, very necessary.

So what, exactly, are the information security requirements of the PCI DSS? Some are more simple than others, some are (or should be) common sense, others are more complex and, because of their less-than obvious nature, are included specifically because they get overlooked by merchants and targeted by hackers.

We'll begin with the more obvious requirements. The first and second requirements are about building and maintaining a secure network. This includes installing a firewall and keeping it up-to-date, and changing any default vendor-supplied passwords that may have come with your system. Firewalls are important components on any system for information security as they give you control over the traffic that can get into or out of your system. And most vendor-supplied passwords have already made it into the hacker community and are unsafe to keep around.

The next two requirements of the PCI DSS involve taking the necessary steps to protect cardholder data. This begins with simple steps like keeping stored data to a bare minimum, and can also include making sure that you keep all your own passwords encrypted, and all physical access limited to specific people. It gets a little more complex when you start encrypting all transmissions of credit card data.

Again, some of these requirements seem obvious, but many merchants have been caught without implementing this step sufficiently. The recent decision in the famous TJX case, in fact, concluded that the company did not do everything they could have and/or should have done to protect cardholder data. This included storing and transmitting unencrypted data. What's the lesson here? Anyone can get caught not doing everything necessary for their customers' safety.

Requirements five and six of the PCI DSS deal with maintaining a vulnerability management program. This includes using and regularly updating anti-virus programs - because not all threats come from hackers. Any programs or applications you develop must also be secure. This means that you must use all patches and updates that are necessary to remain current with all the new technologies.

The next steps are about implementing strong access control measures. This includes limiting access to carholder data to business need-to-know, assigning unique Ids to everyone who has computer access and restricting physical access to cardholder data. This is important in information security for the simple reason that a lot of security can be added by knowing exactly who can see th info. And if there ever is a problem, tracing the source of the problem can be a much more efficient process.

The PCI DSS also requires that a merchant regularly tests and monitors their systems. Why? Because simple implementation isn't enough. Doing something once and expecting it to be self-sustaining isn't going to work. Regular testing is the only way to ensure that you will find any problems in the system before any criminals do.

The twelfth requirement of the PCI DSS states that you must maintain a policy on information security. What this means is that it is your responsibility to make sure each part of the company understands their own responsibility toward the PCI DSS.

It's about knowledge and information. And in the end, this knowledge can help you provide your customers with a safe environment in which to conduct electronic transactions.

Andy Eliason is a writer at Main10, Inc. If you'd like to learn more about the PCI DSS visit http://www.braintreepaymentsolutions.com/pci-compliance/p/3/ or http://www.braintreepaymentsolutions.com/