The PCI Security Standards Council, which establishes requirements for the payment-card industry, yesterday formally launched its payment-application security program.\nThe Council announced the Payment Application Data Security Standard (PA-DSS) as an effort distinct from its older Data Security Standard 1.1 (DSS 1.1).\nDSS 1.1 comprises a list of 12 broad-based security requirements that the payment-card associations and banks, which enforce compliance mandates, ask any business handling credit or debit cards to follow or face consequences, which could include fines or higher\n fees.\nIn contrast, the PA-DSS program is intended to cover testing and certification requirements for payment applications sold,\n distributed or licensed to third parties and installed off-the-shelf without much customization. The Council has published\n a frequently-asked questions document emphasizing that payment applications developed in-house by merchants or service providers\n are not subject to the PA-DSS requirements.\nPA-DSS entails the Council assuming responsibility for Visa's Payment Application Best Practices program, with the Council's\n payment-brand membership, American Express, Discover Financial Services, JCB International and MasterCard, backing what had\n been only a Visa requirement for vendor-developed payment applications.\nBut more is on tap from the PCI Security Standards Council, says Bob Russo, its general manager. "Later this year we'll be\n rolling out a new version of the DSS," says Russo, noting this is expected to be in the September timeframe, with a possible\n 2.0 version.\nRusso points out that the revised DSS will basically seek to clarify the 12-point DSS guidelines to answer questions that\n have come up, which are impacting decisions that businesses are making to comply with DSS 1.1\nAnd there are many.One security manager for a large U.S.-based bank, who asked he not be named, says it's not clear whether a requirement for\n "segmentation" of the network for purposes of protecting card data means you have to use a LAN.\nIn another instance, the DSS 1.1 requirement for firewalls is subject to question. The Jericho Forum, an international organization of about 60 large multi-national companies dedicated to finding innovative e-commerce security\n methods, believes network firewalls may not be the best approach in all situations involving online collaboration.\nRusso says he would be happy to open a dialog on the question of firewalls in order to hear about what could be viable alternatives.\n He said the Council is receiving input now to grasp the major questions about DSS.\nAnother change already envisioned for DSS entails making the so-called "6.6 requirement" for application security, now a voluntary process that calls for either buying a Web application gateway or performing a code review, mandatory this June.\nRusso said the Council will issue guidance on this in the form of a White Paper next month. It will cover the topics of requirement\n for application security and explain how "payment application qualified security assessors" (PAQSA) will be named through\n an accreditation process.\nThese PAQSAs would be expected to play a role in evaluating applications at businesses handling credit- and debit-card information.Some companies are taking novel approaches to tackling PCI requirements.At the RSA Conference last week, security professionals from office-supply store chain Staples presented a session on masking the 13 to 19 digit\n codes on a credit card \u2014 what's known as the "Primary Account Numbers" \u2014 as they're used in business operations and across\n the network.\nThis data masking was begun after a lengthy effort to map PCI compliance to how Staples business operations really work to\n find out where card data is really used.\nChristopher Dunning, director of enterprise information security at Staples, described an ongoing internal effort that involves\n using technology which RSA, the security division of EMC, helped develop with Staples to scramble live card data as a one-way\n hash.\nDunning called it "Data Aliasing Technology" that works by having applications make use of specialized tokens called "alias\n numbers" for credit cards. These card aliases have the impact of "limiting the scope of PCI," says Dunning because the real\n card numbers aren't in use.