Making Sense of Today's Payment Cybersecurity Landscape

Establish a baseline and review guidance pillars: This may seem like a no-brainer, but with such a dense piece of guidance — fines that can be in the millions of dollars for noncompliance — having a firm grasp of your end-to-end compliance from the start is pivotal. Much like previous versions of PCI DSS guidance, v4.0 is composed of a comprehensive list of 12 pillars that aim to provide the most comprehensive security for the industry and cardholders themselves — tackling things like network security to the cryptography used to transmit cardholder data. In tandem with familiarizing themselves with these pillars and seeing how they stack up, businesses need to determine which PCI DSS level they fall under to determine the exact specifics they are required to adhere to in terms of the rollout of their PCI DSS compliance.

Determine the role of technology in your compliance efforts: One of the most interesting aspects of v4.0 is the latitude that is given to businesses to use technology to achieve and demonstrate their compliance. The compliance technology industry has come a long way since v3.2.1 was introduced. Moreover, the posture within the compliance community toward technology has shifted dramatically — with regulators now expecting, rather than encouraging, that technology be a part of an organization's compliance mix. With that, businesses now have greater latitude to deploy emerging technologies like the cloud and different SaaS tools to help meet their ongoing compliance needs — from network monitoring to vulnerability testing — including when it comes to meeting v4.0 expectations. Thus, in addition to identifying existing gaps or weaknesses in meeting v4.0 oversight expectations, businesses also need to think about how they are going to fill them, and how and when to use technology tools to help them do so.

Embrace flexibility and dynamism: The rapid pace of innovation by well-funded cybercriminals means it is highly likely cybersecurity guidance will be coming at a much greater frequency from PCI in the years ahead. This means businesses need to begin building enabling cybersecurity strategies to be both flexible and adaptable as new payment technology and related threats become realized.  Meeting the compliance standards of today is great. However, as the payments world becomes more complex, global, and interconnected, businesses simply do not have the luxury of waiting around for new guidance to come out before they update their practices. Cybersecurity is a living, breathing ecosystem, and payment stakeholders that prioritize both robust preventative and detectable cybersecurity measures, like anti-malware software and threat hunting and penetration testing, stand a much better chance of not only remaining compliant, but delivering a more secure and enjoyable experience for their customers.