The reason why PCI scanning vendors were put into place is to create an additional level of protection for consumers by ensuring that merchants meet minimum levels of security when they store, process and transmit cardholder data.

Wikipedia has this to say about internet fraud of credit cards. “Most internet fraud is done through the use of stolen credit card information which is obtained in many ways, the simplest being copying information from retailers, either online or offline. Despite efforts to improve security for remote purchases using credit cards, systems with security holes are usually the result of poor implementations of card acquisition by merchants. For example, a website that uses SSL to encrypt card numbers from a client may simply email the number from the webserver to someone who manually processes the card details at a card terminal. Naturally, anywhere card details become human-readable before being processed at the acquiring bank, a security risk is created. However, many banks offer systems where encrypted card details captured on a merchant’s webserver can be sent directly to the payment processor.”

In order to apply to be able to do this PCI Scanning a company has to first complete a Self-Assessment Questionnaire on an annual basis. During the Spring of 2008 a new SAQ was launched and was re-designed to make the questions more relevant to what merchants actually do. There are now four parts, and depending on which part best matches what a company does, will determine the number of questions that will need to be answered – and whether or not quarterly vulnerability scanning is required. Companies will also need to make sure they attest to the truthfulness and accuracy of their responses on the SAQ.

Scans help identify vulnerabilities and misconfigurations of websites and IT infrastructures containing externally facing IP addresses. This is very important for your company’s piece of mind.

Who has to comply to PCI scanning? If you are a merchant or service provider and accept credit cards you must validate PCI compliance at least annually.

Even if you are a small business and only take a handful of cards on a daily basis, you still need to comply with the PCI scanning.

The primary goal of vulnerability scanning is to pinpoint and identify any device inside your network, which may be susceptible or vulnerable to threats. It’s important to remember that not all vulnerability scanners are created equally. And for this reason, you should do your homework prior to utilizing any vulnerability scanning vendor.

As of late, it has become increasingly important that online e-commerce retailers utilize vulnerability scanning in order to protect themselves from the many electronic threats lurking in the dark reaches of the Internet. The use of a vulnerability scanner can help protect your network in your system from hackers and other electronic “vulnerabilities”. The use of the vulnerability scanning is considered to be a proactive approach to protecting yourself and your customers during the process of e-commerce.

Running a vulnerability scan can reveal areas in your network that are weak or prone to attack. This can allow you to make necessary changes to your network in order to protect yourself and your customers.
As with anything else, it is important to note that the use of a vulnerability scanning is not foolproof. It is important to combine the use of a scanning with other means of protection in order to ensure security.

As mentioned before, it’s a good idea to do your homework and review some of the available Approved Scanning Vendors on the market today. You will find that researching available vulnerability scanning vendors to online resources is one of the smartest ways, and the most time efficient ways, to locate a high-quality vulnerability scanner. You may find it in a fit to note that most vulnerability scanners are relatively simple to use. A few simple instructions should have you up and running in no time. If you find the use of vulnerability scanning to be too complicated, it is possible to find a professional to perform the service for you.

Remember, the reputation of your online business could be at stake, spending a little time in proactive research of your network could end up saving you lots of effort, time, and even money in the long run. So start your vulnerability scanning today.

The Payment Card Industry Data Security Standard (PCI DSS) is a collaborative effort to achieve a common set of security standards for use by entities that process, and store payment card data. There has been a lot of talk about how effective PCI Compliance is and will it really protect you and your customers. What you need to remember is that PCI Compliance is not the end all of security. Security is a mindset and nobody can ever say that they are perfectly secure. PCI Compliance is the first step to building up your security by following the current security standards and scanning your servers for vulnerabilities.

Here are some great statements by Michael Dahn of PCIAnswers.com about Compliance vs. Validation and Compliance vs. Security:

“There is a difference between ‘compliance’ and ‘validation’. Compliance is a state of being, one that must be maintained at all times. Validation is a point-in-time check on that state of compliance. The example I give is auto insurance. In order to comply with state laws I must maintain auto insurance at all times. When I go to register my car I have to show proof of insurance. I am validating my compliance with the law. What if I decide to cancel my insurance because it costs too much? Am I still compliant? No. Now, I still validated, but remember validation is a point-in-time while compliance is measured day by day.

Another thing to remember is that compliance, even the continuous state of compliance, does not equal security if not done right. If a company focuses on check box compliance and doing the minimum they may be able to complete the baseline audit, but does that mean they are properly managing their risk and protecting payment card data? Let me explain, I’ve asked many people, “can a firewall be used to segment a network?” Everyone agrees YES, but they are wrong. Only a properly configured firewall can segment a network. So if I check the checkbox saying that something is out of scope of the audit because it is segmented off, the question remains: was it properly segmented? Did you really eliminate known attack vectors?”

So ask yourself what your mindset is and where you are with the PCI Compliance and security realms of your business. Becoming compliant and secure takes time and some money, let’s be honest. The amount of money and time you spend will save you in the long run and here is why.

• First of all if you are hacked and something does happen with your customer’s personal and private information you could potentially be liable for the money and information lost. Also imagine the PR nightmare.
• Next think of all the sales that you are missing out on by providing trust and confidence to your visitors because you are not showing them that your site is secure and that they can trust you.

So keep all of this in mind when you are reading and pondering PCI Compliance. A suggestion would be to work with a company that can help start the process to become PCI Compliant like vulnerability scanning. A company that I would suggest is Trust Guard PCI Compliance Scanning.

“Hi, my name is Ward Spangenberg. I’m a Delivery Director with IOActive, in Seattle, Washington. Today, I’m going to talk about PCI and what it means to Europe and how it’s affecting operations in Europe. The first question you might ask is “What is PCI?” PCI stands for Payment Card Industry. That doesn’t mean much. What we’re really talking about are the Data Security Standards, so PCI DSS.

These are twelve standards requirements that are required by companies that process credit cards. We have three different types of companies that do this. We have Level 1, Level 2, and Level 3 merchants.
The merchant is based upon the number of credit card transactions that occur during a year’s span. You have anywhere from anything less than a million cards would be considered a Level 3 merchant. Anything from one million to five million is going to be a Level 2 merchant. Anything beyond five million is going to be a Level 1 merchant.

With Level 1 merchants, those are required to have a third party come in and perform an audit. That’s what I do. I’m the auditor. What happens is I have to understand all twelve of those requirements and sub-points underneath those requirements. We have things like understanding firewalls and the firewall rule sets, to actual compliance regulations. Do you have HR? Are you doing things like background checks on your employees? It’s a comprehensive baseline. This is really important to understand with PCI. It’s not the end-all/be-all of security. It’s the start of a good security program.

Why is this important to you? The big thing is a merchant, a retailer, or anybody who takes credit cards, this is important to you because it allows you to have the baseline, the beginning of a security program. As I said, it’s the requirements. We can talk about the requirements.

Requirement number one is having network diagrams. It’s amazing, today, how many companies don’t know what their networks look like. One of the first requirements is sitting down and documenting, and understanding what your network is all about, understanding what your firewalls are doing, understanding what your rules sets involved in this firewall. Are we protecting credit card data that is coming in and out through our Web applications? Are we segregating databases properly between what’s exposed on the Internet from what’s protected in the background?

You might be asking yourself, “What does this mean if I’m a grocery store or a shoe retailer?” You may not have a Web presence if you’re a grocery store, but you do still process credit cards. You’ve got a couple of hundred stores and you may be processing credit cards. You still have to follow that methodology as to how do you protect those credit cards.

Look at each store as sort of your remote branch. Are you protecting the credit card information locally, at that remote branch, and are you protecting in transit, and “in store” at your corporate headquarters before you do your batch processing?

When we look at PCI, it’s spread. It goes across merchants. If you’re processing credit cards, it’s really recommended that you understand what’s required of it. Now, you may question, “I’m interested in PCI. I think I process credit cards. Do I need to go through the PCI certification process?”

That’s pretty easy. If you’re a Level 1 merchant, then you do. You have to contact a third party. Once a year that third party will send an assessor onsite, or a group of assessors, and they will perform what should be a very exhaustive process. We’ll cover that in a second. They should cover this very exhaustive process and ask questions, and gather evidence, and at the end of that, they will write what’s called a ROC, or Report On Compliance.

The Report On Compliance is then turned in to your credit card processor, your requiring bank. They are the ones that when a credit card is swiped in your store, they’re the ones that give you authorization on that credit card. They are also the ones that move the money into your account after the sale has occurred.
If you are a Level 2, Level 3 or below, you get something kind of fun. It’s call the “Self Assessment Questionnaire”. For those in the SAQ, there are two versions of it. The newest version just came out this year and is sort of the 1.1 version of the Self Assessment Questionnaire.

Because it just came out, companies have the choice of doing compliancy to the 1.0 version or to the 1.1 version. Your first question is “What’s the difference?” The difference is that the 1.1 version is a lot more comprehensive and a lot more reflective of what a Level 1 merchant will go through.

The belief is that as Level 2 merchants grow – the whole idea is to grow our companies. As Level 2 merchants grow, they are going to become Level 1 merchants. The more comprehensive you are about your security the easier it will be, as your corporation grows, to establish yourself as a compliant Level 1 merchant.

Let’s get back to this Level 1 merchant. Once a quarter, they have this auditor come in. The auditor comes in and performs, we hope, a quality, comprehensive assessment of your organization. What does that mean? Again, it’s the twelve requirements with the subsets of those. I believe it’s 256 requirements, total, if you mean everything.

What should happen with an auditor, they should first ask the question, and then once you give them the answer, they should ask for proof. The process could include sitting down with HR and going through with HR and determining whether the process includes background checks on anyone who has access to credit card data. We can sit down with the encryption experts within your company, or your database administrators, and review how credit card information is processed, how it enters into the database, how it is dumped into the batch settlement reports, which are then transmitted to the credit card companies – usually at close of business or midnight, or however the business is transacted to occur.

That’s the comprehensive approach. There are – in the questions I receive when I speak about PCI is “We’ve had what we call check box auditors. Is that good? Is that bad?” It’s all about what risk you’re willing, and your company is willing to except. PCI is really, truthfully a risk mitigation tool. It’s not going to be the end-all/be-all to the security for your organization. It’s also not the stopping point, either. As you’ll see, each year there will be standards and new requirements associated. By having that growth pattern, where at least there is a good baseline to work with, you need to continue to process your security.
That’s some interesting things about your ROC. You’ve passed it. Everybody has signed off. You’re done. What happens? Once a ROC has been submitted and the payment inquirer, your merchant bank, has accepted the ROC as your compliance, some paperwork is exchanged and you get a certificate. You can say, “I’m PCI compliant”. What happens if, after that’s all gone through, someone gets hacked?

The first thing that happens is that you’re told by your merchant bank to contact a forensic investigator. There is a group of certain forensic investigators that are allowed to come in and perform an assessment. The first thing they do is pull that handy-dandy ROC back out and they start looking at it. They look to determine whether compensating controls that were accepted were strong enough, in terms of if the hack was associated to that. These are some important things to think about.

Again, it’s risk mitigation. Are you willing to accept the risk associated with a compensating control? Those are the things. Again, you start off; you have a baseline. You get audited to it and then you work from that. It’s a good place to start. I highly encourage companies that are processing credit cards to try to hold the standards of the PCIDSS 1.1 and to hire an external company to come in and help you determine your compliancy level, and to work with you to achieve those. Eventually, everything will be moving to those levels. The brick and mortar stores will be required to be just as safe as an online company is.
Thank you for your time.”

So there it is PCI Compliance all explained. Now of course there is more to it than that but having a PCI Compliant site will be the best thing you can do for your company and customers.

Here is a quick explanation of each of the words above and this blog will be a constant resource for your PCI Compliance Requirements needs.

PCI – Payment Card Industry is the definition of PCI. The major credit card issuers created PCI (Payment Card Industry) compliance standards to protect personal information and ensure security when transactions are processed using a payment card.

PCI Scanning – the scanning part of PCI requirments is where a ASV certified scanner scans your website, servers, ip addresses for any potential vulnerabilities that would allow hackers to take personal or private information.

PCI Compliance Requirements – Merchants must meet the Payment Card Industry (PCI) requirements of the Visa CISP, MasterCard SDP, American Express^®DSOP, and Discover^®Card DISC standard. The requirements are set up by the PCI Security Standards Council These requirements can be very confusing hense the reason for this blog.

So again this is just a very basic explanation of PCI Compliance, so stay tuned for more great blog posts, tips, and resources on PCI Requirements.