Formed in 2004, the PCI SSC (Payment Card Industry Security Standards Council) was established to provide a universal set of security standards that is to be adhered to by merchants who process and transmit credit card data. The council was founded by five of the top credit card companies: American Express, Discover, JCB, Mastercard and Visa. In order to become a PCI compliant company, your business must comply with the standards set in place by PCI Security Standards Council. There are currently 12 standards across six categories that must be met. These standards are as follows:
1.) Create and Maintain a Secure Network
1. Protect cardholder data by implementing and maintaining a reliable firewall configuration.
2. Never use manufacturer-supplied default passwords as means for security mechanisms.
2.) Protect Cardholder Data
3. Protect cardholder data on servers and other storage mediums.
4. Encrypt cardholder data traveling over public and other open networks.
3.) Maintain a Vulnerability Management System
5. Install, use and regularly update malware protective software on all systems commonly affected by malicious programs.
6. Create, deploy and maintain secure systems and applications.
4.) Implement Strong Access Control Polices
7. Restrict access to cardholder data to authorized personnel on a need-to-know basis.
8. Assign each individual with access to cardholder data a unique set of login credentials.
9. Restrict physical access to cardholder data.
5. Test and Monitor Networks Regularly
10. Track and monitor user access to cardholder data and all network resources.
11. Perform regular tests of policies and security systems.
6. Maintain a Policy for Information Security Purposes
12. Implement and upkeep a policy that addresses information security issues.
How PCI Scanning Works
PCI scanning is performed by approved vendors that help online merchants become PCI compliant by providing services that enable them to meet the standards set forth by the Council. The actual scan itself refers to the process of the vendor going through firewalls and other security elements a business has in place to determine if vulnerabilities exist. In the end, PCI compliance benefits all parties involved, including the consumer, retailer and credit card company. After the scanning has been performed, its ensures that your website is free of infection and less vulnerable to threats. When shoppers see that your site is PCI compliant, they will be more comfortable that their personal and financial information is protected from web criminals. Not only is this good from a regulatory standpoint, but from a public perspective as it can help lead to more conversions and sales for the retailer. For the credit card company, it means less reports of fraud and identity theft, thus resulting in fewer headaches.
The market for PCI scanning is growing rapidly, with McAfee and Trust Guard being among the leading service providers. There are also a number of web hosting firms that offer services with security features to help organizations become PCI compliant. A wider variety enables small scale retailers to leverage the best of both worlds in regard to PCI scanning and traditional website security.
