Are you in compliance with the current standards that are set in these times of needed security? You must ask this question daily. You and your business needs to be in charge of security for yourself and your customers.

Why has the PCI Council set forth a series of PCI standards? The answer is pretty clear cut — because identity theft has become one of the most rapidly growing and problematic issues to date. In fact, identity theft is a problem crime that’s growing at astronomical rates worldwide. As such, the development of PCI standards seeks only to protect businesses and consumers from would be ID thieves.

PCI standards vary from merchant to merchant based on specific merchant levels. These merchant levels are derived from a series of criteria that were compiled by the PCI Council. Depending upon which merchant level your business carries, you’re PCI standards may vary from that of a different merchant. However, if you plan to continue in e-commerce or you have aspirations of accepting credit card or debit card payments through your website, you will be required to know and adhere to your specific PCI standards.

Today, there is a wide variety of tools designed to help businesses comply to PCI standards. PCI scanners and PCI vulnerability tools are relatively easy to find and can end up saving merchants lots of money and heartache in the long run. In as much as PCI scanning can protect merchants from these scams, it can also protect and save you and your consumers a substantial amount of time and money over the long haul as well.

Statistics indicate that victims of identity theft spend around 600 hours trying to correct all of the problems caused by the crime. This is an increase of over 2000% in the last three years. With technology becoming more advanced, crime is becoming more advanced as well. As such, in order to stay ahead of the thieves, the PCI standards set forth by the PCI Council are becoming mandatory.

It’s also notable that the utilization of tools to help businesses adhere to the PCI standards set forth by the PCI Council is also an excellent marketing tool. In fact, many consumers agree that if a company can provide them constant and consistent safe and secure transactions, they will very likely become repeat customers. It stands to reason that protecting your customers is an act of good faith and also helps to instill confidence in the consumer that you are a reputable business owner, who cares about the client’s needs.

It is possible to learn more about PCI standards and what it takes to be PCI compliant. You will find that, especially as a merchant, questions are readily answered in order to help you best serve yourself and your customers. It’s also important to note that even if you are a sole proprietor, any transaction made over the Internet must adhere to PCI standards.

The time is now, and if not today then tomorrow. It is time to be in charge of your security and to be in compliance with the current standards set forth.

The primary goal of vulnerability scanning is to pinpoint and identify any device inside your network, which may be susceptible or vulnerable to threats. It’s important to remember that not all vulnerability scanners are created equally. And for this reason, you should do your homework prior to utilizing any vulnerability scanning vendor.

As of late, it has become increasingly important that online e-commerce retailers utilize vulnerability scanning in order to protect themselves from the many electronic threats lurking in the dark reaches of the Internet. The use of a vulnerability scanner can help protect your network in your system from hackers and other electronic “vulnerabilities”. The use of the vulnerability scanning is considered to be a proactive approach to protecting yourself and your customers during the process of e-commerce.

Running a vulnerability scan can reveal areas in your network that are weak or prone to attack. This can allow you to make necessary changes to your network in order to protect yourself and your customers.
As with anything else, it is important to note that the use of a vulnerability scanning is not foolproof. It is important to combine the use of a scanning with other means of protection in order to ensure security.

As mentioned before, it’s a good idea to do your homework and review some of the available Approved Scanning Vendors on the market today. You will find that researching available vulnerability scanning vendors to online resources is one of the smartest ways, and the most time efficient ways, to locate a high-quality vulnerability scanner. You may find it in a fit to note that most vulnerability scanners are relatively simple to use. A few simple instructions should have you up and running in no time. If you find the use of vulnerability scanning to be too complicated, it is possible to find a professional to perform the service for you.

Remember, the reputation of your online business could be at stake, spending a little time in proactive research of your network could end up saving you lots of effort, time, and even money in the long run. So start your vulnerability scanning today.

• How many vulnerabilities do you scan for?
• Does your company offer Daily Scanning, Quarterly Scanning or both?
• Does your company offer PCI Seals to place on my website to show my customers that they can trust me? (Very Important)
• Is your company an ASV certified scanner or are you partnered up with an ASV Certified vendor?
• How long does the process take?
• Do you offer me PCI Compliance tools such as the Self Assessment Questionnaire (SAQ) and the Compliance Validation Basics information to help me become compliant?
• Does the scanning vendor send you the scanning reports frequently or can you download them?
• Will you support me in becoming PCI compliant?

So make sure you save these questions or print out this post so that when you go to these PCI Compliance scanning vendors that you can ask these important questions. Lets go over each question in detail at this time to really understand their unique importance.

How many vulnerabilities do you scan for?

The number of vulnerabilities scanned for on you servers and external facing IP addresses is important due to the very fact that hackers are finding different ways all the time to hack into our information. The company that you go with to provide your PCI scanning needs to stay up-to-date on all the vulnerabilities that are out there.

Does your company offer Daily Scanning, Quarterly Scanning or both?

This is really a preference of yours. A lot of people including myself would want daily scanning mainly for the fact that I would want to show my visitors and customers that my site is scanned daily. But to become compliant with the PCI Security Standards Council all that you will need is Quarterly. So really it is up to you. Most companies offer at least quarterly so that should be a minimum requirement.

Does your company offer PCI Seals to place on my website to show my customers that they can trust me?

Placing a seal on your website letting your visitors know that your site is secure is so very important and is a must. Providing trust and confidence to your visitors and customers mean more sales, higher conversion rate and more repeat purchases. Make sure that the company that you are purchasing from has seals for all of their PCI scanning services.

Is your company an ASV certified scanner or are you partnered up with an ASV Certified vendor?

To be in compliance with the PCI Security Standards you must be scanned by an approved ASV certified vendor. So when you are shopping around this is a must. Some companies partner directly with ASV certified companies, so and if you can’t find them listed as an ASV certified scanner, simply ask them who their ASV certified partner is.

How long does the process take?

The actual process of becoming PCI compliant can take some time but to actually get your servers scanned should take that long to implement. So this is a great question to ask, if you are impatient like me.

Do you offer me PCI Compliance tools such as the Self Assessment Questionnaire (SAQ) and the Compliance Validation Basics information to help me become compliant?

Having these tools are essential in becoming PCI compliant and your scanning vendor should have these readily available for you with simple explanations of how to fill them out. Granted you can find it all online but it is nice when the scanning vendor has it ready for you to fill out.

Does the scanning vendor send you the scanning reports frequently or can you download them?

Once you have been scanned your PCI scanning vendor should either send you the scanned reports to you by email or have a secure control panel where you can download them easily. It is that simple.

Will you support me in becoming PCI compliant?

Although the PCI scanning vendor really has nothing to do with you becoming compliant other than scanning your website for vulnerabilities and giving you the reporting required. It is important that they guide you through the process and give you a helping hand.

All of these things need to be answered the way you would like to hear them and if they are then you have found the correct company.

Trust Guard offers a great pci scanning comparison chart that you really need to check out. They compare website verification companies and PCI compliance scanning companies. So learn more about Trust Guard PCI Scanning and also compare McAfee Secure and Control Scan.

So there it is a great checklist of items to help you with your PCI compliance scanning vendor searching. Hope it has helped direct you in the correct path.

The Payment Card Industry Data Security Standard (PCI DSS) is a collaborative effort to achieve a common set of security standards for use by entities that process, and store payment card data. There has been a lot of talk about how effective PCI Compliance is and will it really protect you and your customers. What you need to remember is that PCI Compliance is not the end all of security. Security is a mindset and nobody can ever say that they are perfectly secure. PCI Compliance is the first step to building up your security by following the current security standards and scanning your servers for vulnerabilities.

Here are some great statements by Michael Dahn of PCIAnswers.com about Compliance vs. Validation and Compliance vs. Security:

“There is a difference between ‘compliance’ and ‘validation’. Compliance is a state of being, one that must be maintained at all times. Validation is a point-in-time check on that state of compliance. The example I give is auto insurance. In order to comply with state laws I must maintain auto insurance at all times. When I go to register my car I have to show proof of insurance. I am validating my compliance with the law. What if I decide to cancel my insurance because it costs too much? Am I still compliant? No. Now, I still validated, but remember validation is a point-in-time while compliance is measured day by day.

Another thing to remember is that compliance, even the continuous state of compliance, does not equal security if not done right. If a company focuses on check box compliance and doing the minimum they may be able to complete the baseline audit, but does that mean they are properly managing their risk and protecting payment card data? Let me explain, I’ve asked many people, “can a firewall be used to segment a network?” Everyone agrees YES, but they are wrong. Only a properly configured firewall can segment a network. So if I check the checkbox saying that something is out of scope of the audit because it is segmented off, the question remains: was it properly segmented? Did you really eliminate known attack vectors?”

So ask yourself what your mindset is and where you are with the PCI Compliance and security realms of your business. Becoming compliant and secure takes time and some money, let’s be honest. The amount of money and time you spend will save you in the long run and here is why.

• First of all if you are hacked and something does happen with your customer’s personal and private information you could potentially be liable for the money and information lost. Also imagine the PR nightmare.
• Next think of all the sales that you are missing out on by providing trust and confidence to your visitors because you are not showing them that your site is secure and that they can trust you.

So keep all of this in mind when you are reading and pondering PCI Compliance. A suggestion would be to work with a company that can help start the process to become PCI Compliant like vulnerability scanning. A company that I would suggest is Trust Guard PCI Compliance Scanning.