Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats //

Advanced Threats

3/30/2017
01:35 PM
Rob Martin
Rob Martin
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

Payment Card Industry Security Compliance: What You Need to Know

A quick refresher on all the different PCI SSC security standards that are relevant for organizations that accept electronic payments.

In the dynamic world of payments, transaction security is of paramount importance. When we speak with our customers and partners, the topic of payment security and Payment Card Industry (PCI) compliance always comes up. Although there is a lot of useful information about payment security available, the industry is also filled with many questions regarding PCI. So, with the latest PCI Data Security Standard update and the release of the latest security standards for payments terminals, now is a great time to provide a quick refresher on PCI compliance and the various security standards merchants need to know.

The PCI Council and its various Security Standards
The Payment Card Industry Security Standard Council (PCI SSC) is a global, open body created to develop, enhance, distribute, and assist with the understanding of security standards for payment security. The council also provides critical tools needed to implement various security standards. Below is a list of all the different security standards from PCI SSC that are relevant for organizations that accept electronic payments.

1. PCI DSS
The Payment Card Industry Data Security Standard (PCI DSS) covers the security of the cardholder data environment, the IT systems that process, store, and transmit credit and debit card information. Most merchants are familiar with PCI DSS through their annual assessments. As the threat landscape that merchants and payments providers face is not static, neither are the standards for the protection of the cardholder data environment. PCI SSC has released updates to version 3 (the latest being version 3.2) in response to those evolving threats.

2. PA DSS
The Payment Application Data Security Standard (PA DSS) covers security for payment applications that access cardholder data. A payment application is software that is developed to help merchants process electronic payments, including magnetic stripe, EMV (Europay, MasterCard, and Visa), and contactless transactions. This standard ensures that third-party payment applications properly handle cardholder data and meet industry best practices for secure application development.

3. PCI PTS
The Payment Card Industry PIN Transaction Security (PCI PTS) standard is a set of technical and operational requirements for payment terminals focused on protecting cardholder data. The PCI PTS standard is modular, covering hardware and firmware security requirements to protect against physical, logical, and network tamper attacks. The PCI PTS requirements now include security requirements for open protocols — such as TCP/IP, TLS, Bluetooth, and USB — and the ways cardholder data are read and encrypted through the Secure Reading and Exchange of Data module.

PCI PTS standards are updated on a three-year cycle. Unlike most other PCI standards, PCI PTS does not involve point-in-time assessments. Instead, terminals are submitted to approved third-party labs for evaluation against the then-current PTS version. On approval, a Letter of Approval (LOA) is issued with the validity period for the evaluated version of the specification.

Version 1: LOAs expired April 30, 2014
Version 2: LOAs expire April 30, 2017
Version 3: LOAs expire April 30, 2020
Version 4: LOAs expire April 30, 2023
Version 5: LOAs expire April 30, 2026

Terminal manufacturers can't ship a terminal once the LOA for the terminal has expired; however, repairs and warranty replacements are still allowed. The expiration of a terminal's PCI PTS LOA does not, per se, affect the ability of a merchant to continue to use the terminal. Sunset dates for terminals are set by the individual card brands and PCI, both of which recommend that merchants choose terminals that meet the highest security standards and also meet their specific needs.

4. PCI P2PE
The Payment Card Industry Point-to-Point Encryption (PCI P2PE) standard is a set of security requirements that cover all aspects of a P2PE solution, including the payment terminal, terminal application, deployment, key management, and decryption environment. PCI P2PE validated solutions are the "gold standard" for the protection of cardholder data. Merchants that use PCI P2PE validated solutions receive significantly reduced scope of their PCI DSS assessments through the use of Self-Assessment Questionnaire P2PE. PCI P2PE validated solutions are listed on the PCI SSC website.

Who Needs to Be PCI Compliant?
Accepting electronic payment involves handling of sensitive cardholder information, and keeping it secure needs to be a top priority for businesses that accept, process, or transmit credit card information. In simple terms, if you accept electronic payments for selling goods or services, your business needs to be PCI compliant. Businesses that fail to meet the relevant PCI compliance standards not only put sensitive cardholder data at risk, but they're also subject to heavy fines.

Evolution of PCI Standards
The technology to accept payment is constantly evolving, and so are the ways to protect sensitive customer information, such as credit card details, from cyberthreats. The PCI SSC is constantly working toward improving its security standards to align with the changing needs of the payments industry. The last iteration of the PCI DSS standard expired in October 2015, and a new version, PCI DSS 3.2, will be enforced starting in November. These updates include a number of clarifications, updated guidance, and some new requirements. You can read more about the new version on the PCI Security Council's website.

Related Content:

Dr. Robert Martin serves as Vice President of Security Solutions, Ingenico Group/North America. Dr. Martin is active within several industry security bodies and has been involved in the technical and product end of the payments business since 2000. Prior to joining Ingenico ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
The Problem with Proprietary Testing: NSS Labs vs. CrowdStrike
Brian Monkman, Executive Director at NetSecOPEN,  7/19/2019
RDP Bug Takes New Approach to Host Compromise
Kelly Sheridan, Staff Editor, Dark Reading,  7/18/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-14248
PUBLISHED: 2019-07-24
In libnasm.a in Netwide Assembler (NASM) 2.14.xx, asm/pragma.c allows a NULL pointer dereference in process_pragma, search_pragma_list, and nasm_set_limit when "%pragma limit" is mishandled.
CVE-2019-14249
PUBLISHED: 2019-07-24
dwarf_elf_load_headers.c in libdwarf before 2019-07-05 allows attackers to cause a denial of service (division by zero) via an ELF file with a zero-size section group (SHT_GROUP), as demonstrated by dwarfdump.
CVE-2019-14250
PUBLISHED: 2019-07-24
An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simple_object_elf_match in simple-object-elf.c does not check for a zero shstrndx value, leading to an integer overflow and resultant heap-based buffer overflow.
CVE-2019-14247
PUBLISHED: 2019-07-24
The scan() function in mad.c in mpg321 0.3.2 allows remote attackers to trigger an out-of-bounds write via a zero bitrate in an MP3 file.
CVE-2019-2873
PUBLISHED: 2019-07-23
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.32 and prior to 6.0.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox...