PCI DSS Compliance

The exponential growth of online transactions with credit and debit cards, though has facilitated the process, but has made itself susceptible to insecurity; it has opened the gateway to greater and devastating security risks. Thus emerged the need of curbing this issue with a set of security standards which is known as the PCCI DSS, the Payment Card Industry Data Security Standard (PCI DSS), created by the major credit card companies, intending to protect their customers from increasing identity theft and security breaches.

PCI DSS originally began as five different programs: Visa Card Information Security Program, MasterCard Site Data Protection, American Express Data Security Operating Policy, Discover Information and Compliance, and the JCB Data Security Program. Each of these companies intended to create an additional level of protection to customers, hence ensuring that merchants meet minimum levels of security when they store, process and transmit cardholder data. The Payment Card Industry Security Standards Council was formed, and on the 15 December 2004, these companies aligned their individual policies and created Payment Card Industry Data Security Standard version 1.0 and further updated to 1.1 with some revisions added to it. Now, implementing PCI DSS has been made mandatory within the timeline of 2010.

Virtually all businesses, regardless of their size, need to understand the scope of PCI DSS, and ways to implement network security that is compliant with PCI DSS guidelines. In doing so, they will avoid penalties or the possibility of having their merchant status revoked and potentially being banned from accepting or processing credit cards.

AppLabs, an independent software company, is such a service provider, which is compliant with PCI DSS guidelines and satisfies the PCI DSS requirements, which include security management, policies, procedures, network architecture, software design and other critical protective measures. This comprehensive standard is intended to help organizations to proactively protect customer account data.

For the compliance process of PCI DSS, a multifaceted security standard, AppLabs conducts an annual onsite PCI and sometimes a Self-Assessment Questionnaire (SAQ), which is filled in to validate the compliance. In addition to this, AppLabs scans the network perimeter by an Approved Scanning Vendor (ASV) every quarter, submits the report and hence highlights the compliance status, network vulnerabilities and vulnerable services classified as per the scoring pattern and severities prescribed by PCI DSS. The evidences of these and the application and network penetration tests are shared with card brands, hence proving that that AppLabs practices sound patch management and vulnerability management processes.

Read the complete white paper PCI DSS Compliance.

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine