Caveat

PCI Is Security Simplicity, Not Complexity

Payment card industry data security: the standard that makes people stupid.

By Ben Rothke

August 02, 2007 — CIO —

There is something odd about the payment card industry (PCI) standard that seems to make relatively smart people instantly dim-witted and complain about its so-called complexity. The irony is that PCI, as the standard is called, is one of the best things to happen to the security of consumer data, yet many think it is as complex as rocket science.

PCI’s Genesis
The last decade has seen the growth of security and privacy standards and regulations, from decent standards such as ISO-17799 to abhorrent regulations such as Sarbanes-Oxley. At the same time, billions of dollars of credit card purchases, combined with insecure networks and systems that process consumer data, have placed consumer data at significant risk. Credit card fraud is getting out of control and the losses are becoming too great to bear. The outgrowth of that was the PCI data security standard, or PCI DSS.

Visa, MasterCard, American Express, Diner’s Club, Discover and JCB collaborated to create a new set of standards and require that all merchants and service providers that handle, transmit, store or process information concerning any of these companies’ cards, or related card data, be compliant with them. If they are not compliant, they can face monetary penalties and/or have their card processing privileges terminated by the credit card issuers.

The primary purpose of PCI is to force organizations to embrace common security controls to protect credit card data and reduce fraud and theft. The following are the six primary control areas comprising 12 specific requirements of the PCI DSS:

Build and maintain a secure network
- Install and maintain firewall configurations
- Do not use vendor-supplied or default passwords

Protect cardholder data
- Protect stored data
- Encrypt transmissions of cardholder data across public networks

Maintain a vulnerability management program
- Use and regularly update anti-virus software
- Develop and maintain secure systems and applications

Implement Strong Access Control Measures
- Restrict access to need-to-know
- Assign unique IDs to each person with computer access
- Restrict physical access to cardholder data

Regularly monitor and test networks
- Monitor and track all access to network resources and cardholder data
- Regularly test security systems and processes

Maintain an information security policy
- Maintain a policy that addresses information security

A quick review of these 12 items reveals a textbook outline of the fundamentals of information security. They reflect attention to detail and risk management. One can sum up PCI in a single word: pragmatic. It takes a realistic approach to the problems of consumer credit data and applies a common sense set of security solutions. PCI takes a narrow focus on what it attempts to solve, as opposed to Sarbanes-Oxley, which lacks any form of specific detail. PCI is a godsend for the protection of consumer credit card data.