What is PCI DSS?
The Payment Card Industry Data Security Standard (PCI DSS) was established by the PCI Security Standards Council which consists of the leading credit card organisations. The Standard details security requirements for storing, processing or transmitting cardholder data. The latest PCI DSS version, 1.2 was released in October 2008 and is designed to enhance payment account data security.
What does PCI DSS Require?
The Standard requires compliance to the following:
Build and maintain a secure network
Maintain a vulnerability Management Program
Implement strong access control measures
Maintain an information security policy
Protect Cardholder Data
Who is affected by PCI DSS?
Merchants and (IT-) Service Providers who process or store credit card data are advised to comply with PCI DSS. Non-Compliance will lead to increasing transaction costs and/or fines or claims for damages (depending on the size of the organisation).
What does PCI DSS V1.2 say? The latest PCI DSS version 1.2 requirement 6.6 became compulsory in October 2008 saying that organisations must:
Having all custom application code reviewed for common vulnerabilities by an organization that specializes in application security
Installing an application layer firewall in front of web-facing applications
Want to know more about PCI Compliance?
Download our PCI DSS Datasheet here.
Industry Report - IBM's Latest Risk and Threat Report Prioritises Application Security
IBM's Latest Trend and Risk Report stated that corporations are inadvertantly becoming the No. 1 security threat to their own customers and that web application vulnerabilities are "the Achilles heel for corporate IT security". Read the full report here.