Recent Changes to the Payment Card Industry Data Security Standard

Earlier this month, the PCI Security Standards Council announced version 1.1 of the Payment Card Industry Data Security Standard (PCI DSS). It is a bit challenging to find a description of the changes from the original version, at least on the “official” sites. However, there have been some fairly informative articles in industry publications that address some of these points.

In an article in InfoWorld entitled Card Industry Targets App Security, Paul F. Roberts highlights how the new standards focus on application security, especially as it relates to track data. Citing an analyst at Gartner, Mr. Roberts writes that track data “is valuable to hackers and identity thieves because it can be used to make counterfeit cards.” Martin Elliott, director of corporate risk and compliance at Visa, also spoke with Mr. Roberts about the risks related to track data, and Mr. Roberts writes, “In fact, many merchants may be unaware that their payment applications collect and cache the track data, leaving the merchant unprotected while giving the merchant a misplaced sense of security.” Mr. Roberts has exposed the myth of security from packaged applications. Visa has published its Payment Application Best Practices to address these security concerns, as well as a List of CISP-Validated Payment Applications.

Another article, published in Transaction World under the title What’s Next With PCI Compliance, also addresses the Payment Application Best Practices. She points out how the credit card companies have imposed tighter restrictions on even lower volume merchants, stating that ”POS developers as well as smaller and mid-size merchants are now under scrutiny.”

Certainly, by imposing the tighter standards on payment applications and smaller merchants, Visa and MasterCard are forcing these organizations to spend drastically more on PCI compliance. However, with the proliferation of hacking, the entire payment network is only as strong as its weakest link, so even these holes must be plugged. As an alternative, these organizations — especially merchants — should investigate their options for outsourcing their payment processing to a certified PCI compliant service provider, which may offer substantial savings versus the costs of self-compliance.

This entry was posted on September 29, 2006 at 11:08 am and is filed under Payment Card Industry / Credit Card Security. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response or trackback from your own site.