What Is PCI DSS?

To know if an organization is truly compliant with PCI-DSS regulations they should become PCI-DSS certified—certification involves following several best practices. Credit card companies mandate standards and meet regularly to review best practices and change requirements as the cybersecurity landscape evolves. PCI-DSS lays out a framework for organizations to follow so that they can ensure that they’re certified. A few practices necessary for PCI-DSS certification are:

Although most compliance regulations require numerous infrastructure changes and security tools, PCI-DSS has very few but critical requirements. Any mistakes or oversights in requirements could result in hefty fines, so it’s imperative that organizations review PCI-DSS guidelines and apply the proper controls to their environment.

Credit card companies mandate 12 requirements that organizations must follow to stay PCI-DSS compliant. Standards aim to protect user cardholder data, therefore requirements revolve around the many ways threats breach network defenses and allow attackers to steal critical information. Any changes to current requirements are announced and published by the Security Council, so organizations must review them yearly to ensure that they continually meet compliance requirements.

The 12 PCI-DSS requirements are:

1. Install firewalls and configure them to block malicious traffic. Most organizations already have a firewall installed between the outside internet and the internal environment, but others are needed in larger environments where public Wi-Fi is offered, and departments must be segmented. For example, organizations would use a firewall to separate financial departments and their data from the sales department to protect cardholder data.
2. Avoid using vendor defaults for system passwords. Every network resource ships with the manufacturer’s default password so that administrators can configure hardware to work specifically with the corporation’s infrastructure. These passwords are openly distributed to the public, which means that attackers can access network resources without obtaining credentials. After connecting a component to the network, the first step for an administrator is to change the default password to their own. Preferably hard to guess but easy to remember passwords.
3. Protect stored consumer financial data. This requirement might seem obvious, but not every organization stores credit card information and not all organizations do what is necessary to ensure basic security. For example, card data stored in a database must be encrypted and no one within the organization should have unfettered access to it. Any access requests must be monitored, and an audit trail created for incident response in case of a breach.
4. Financial data transferred across public networks must be encrypted. Data passing over the internet must be encrypted to avoid eavesdropping. Users submit their credit card information on an ecommerce site, and this information must be encrypted. Merchants send credit card data to a processor, and it must be encrypted as it passes to merchant services. Some organizations take security to another level and encrypt traffic within the corporate network.
5. Install and maintain antivirus software. All servers and workstations across the organization must have antivirus software installed. To take it a step further, any mobile device that is storing or processing credit card data should also have antivirus software installed. Endpoint security is a newer challenge for organizations since the growing popularity of smartphones, but it should be a priority for organizations taking payments over mobile devices.
6. Add systems with data protection in place. Systems constantly change and administrators will add new ones as the corporation grows. Any system installed within corporate infrastructure should be integrated with security in mind. New infrastructure should be installed with security integrated, and any configurations should be set up with security of credit card data in mind.
7. Use least privilege standards for data access. Users should only have access to credit card data if it’s necessary to perform their job functions. Insider threats risk exposure of credit card data, so only employees who need access to perform a job function should have access. In some cases, a portion of the credit card number can be masked from view to increase security. For example, customer service people can see the last four digits of a credit card number but not the full number, but the billing department can see the full number to help customers change their card number on file.
8. Log access requests with the user ID retrieving credit card data. Whether it’s a compromised account or a malicious insider, logging every access request with the user ID will leave an audit trail. Investigators and law enforcement use audit trails to identify a malicious actor, and they help incident response teams identify the extent of damage and consumers affected by a data breach.
9. Limit physical access to credit card data. Servers storing credit card information should have appropriate physical security measures in place. For organizations storing credit card data in the cloud, the cloud provider should provide policies that follow PCI-DSS standards. Physical security should also log access requests to infrastructure to create an audit trail.
10. Log and monitor access requests to network resources storing credit card data. Monitoring data access is a component in several compliance regulations. Logs and monitoring go hand-in-hand in data security and protection. Logs track access request events, and monitoring tools use these events to identify anomalies that trigger notifications sent to administrators. Analysts use monitoring to quickly respond to ongoing incidents to contain them and limit damage from a breach.
11. Test security systems and procedures often. Security systems occasionally fail, or they don’t work as expected, so it’s important for administrators to regularly test security controls across the entire environment. Some organizations do security events where they offer employees prizes for finding vulnerable resources. In addition to yearly testing, administrators should review PCI-DSS compliance documentation for any changes.
12. Document security policies and distribute them to employees. Staff can’t follow security policies if they are unaware of what policies they must follow. PCI-DSS requires employers to document security policies so that employees can reference what needs to be done and identify proper ways to handle customer data.

Most of PCI-DSS best practices follow requirements, but organizations can put additional policies in place to improve security. A few additional practices that organizations should consider: