PCI DSS Compliance basics for credit card data security

PCI DSS Compliance is an industry mandated security standard that applies to all businesses that handle, process or store credit cards. There are 12 requirements but as an oversimplification, it boils down to two things 1) merchants cannot store certain credit card information including CVV/CVV2 codes (three or four digit numbers), track data from the magnetic strip, and PIN numbers, and 2) if permitted credit card information such as name, credit card number and expiration date is stored, the storage security needs to meet certain requirements. A number of recent high profile breaches have been raising awareness of the risks associated with PCI Compliance.

The motivation to become compliant
The major credit card companies have provided both carrots and sticks in order to compel merchants to become compliant. The incentives offered include ’safe harbor’ from certain penalties and fines if a merchant is compliant at the time of breach. Without compliance, if a merchant is breached and has credit card information stolen, depending on the size of the breach, PCI related fines can be as high as $500,000 per incident. In severe cases, merchants can even be given the ‘Death Penalty’ preventing them from accepting credit cards. In addition to the PCI fines, merchants may also be subject to remediation costs that have been estimated to be $90 to $302 per record (see graph below).

The Payment Card Industry Data Security Standard (PCI DSS)

What is PCI DSS?
It’s a comprehensive security standard that establishes common processes and precautions for handling, processing, storing and transmitting credit card data.

Who created it?
While Visa and MasterCard originally developed it, as of September of 2006, American Express, Discover, JCB, MasterCard and Visa jointly formed the PCI Security Standards Council.

Why was it created?
Because in the last few years there have been an spike in data security breaches. Organizations such as TJX, Bank of America, Citigroup, BJ’s Wholesale Club, Hotels.com, LexisNexis, Polo Ralph Lauren and Wachovia have been breached.

Who’s at risk?
Any business that processes, transmits, or stores credit card information. While the publicity of security breaches has recently been focused on larger companies, Visa reports that the majority of breaches are occuring at small businesses.

What are the 12 mandated security requirements?
1. Install and maintain a firewall configuration to protect data
2. Do not use vendor-supplied defaults for system passwords and other security parameters
3. Protect stored data
4. Encrypt transmission of cardholder data and sensitive information across public networks
5. Use and regularly update anit-virus software
6. Develop and maintain secure systems and applications
7. Restrict access to data by business need-to-know
8. Assign a unique ID to each person with computer access
9. Restrict physical access to cardholder data
10. Track and monitor all access to network resources and cardholder data
11. Regularly test security systems and processes
12. Maintain a policy that addresses information security

What type of credit card information can be stored?

What do merchants have at risk if credit card information is breached?
Fines up to $500,000 per incident
Remediation costs estimated at $90 to $302 per record
Potential customer lawsuits
Company reputation and brand damage

There are different requirements for large and small businesses. These transactions volumes apply to highest number of a single card type per year, e.g. a merchant doing 5,000,000 Visa and 2,000,000 MasterCard transactions annually, even though cumulatively equal 7,000,000, would qualify as Level 2.

Definitions from above:

On-Site Security Audit
The audit must be completed by Level 1 merchants. A V/MC approved, Qualified Data Security Company should be engaged to complete the Report on Compliance. PCI Security Audit Procedures & Reporting

Self-Assessment Questionnaire
This must be completed and submitted upon request by Level 2, 3 and 4 merchants. It should address any system(s) or system component(s) involved in processing, storing, or transmitting cardholder data. It is required that Level 4 merchants complete the assessment to ensure their own compliance to the standard.

Network Scans
Network scans check systems for vulnerabilities. The non-intrusive scan is conducted remotely to review networks and Web applications based in the externally facing Internet Protocol (IP) address provided by the merchant. All merchants are responsible for ensuring that a quarterly network scan is performed on their Internet-facing perimeter systems by a qualified independent scan vendor.

Validation
The Card Associations have set specific dates for validation. Level 1 merchants were required to validate compliance by 9/30/2007, Level 2 are expected by 12/31/07, and Level 3 and 4 are processor/acquirer specific.

Next Steps
Here is a list of steps to get started:

1. Identify the individuals that will be responsible for PCI compliance in your organization and assemble a team that includes members from each compliance area.
2. Determine your merchant level.
3. Engage with a certified PCI Compliance provider (we can refer you to our partner if preferred).
4. Make sure that your organization has an Information Security Policy and that it is being enforced.
5. Immediately address any significant deficiencies discovered during the assessment or scan.
6. Retain record of self-assessments, scans, and follow-up activities. Be prepared to provide these documents upon request.

What should you do if you’re compromised?
In the event of a security incident, merchants must take immediate action to:
1. Contain and limit the exposure. Conduct a thorough investigation of the suspected or confirmed loss or theft of account information within 24 hours of the compromise
2. Alert all necessary parties. Be sure to notify:

•· Merchant Account Provider
•· Visa Fraud Control Group at (650) 432-2978
•· Local FBI Office
•· U.S. Secret Service (if Visa payment data is compromised)

3. Provide the compromised Visa accounts to Visa Fraud Control Group within 24 hours.
4. Within four business days of the reported compromise, provide Visa with an incident report.

Here is a step-by-step guide from Visa - What To Do If Compromised.

Additional resources:
A non profit organization, RSPA produced a 12 minute video aimed at educating smaller restaurant and retail merchants about the risks associated with PCI Compliance.

Other related posts:
PCI DSS Compliance and the cost of a credit card breach
PCI DSS Payment Card Industry Self-Assessment Questionnaire (SAQ)
Vulnerability and security assessment scans for PCI DSS Compliance

Braintree solutions:
The Smart Approach to PCI DSS Compliance