PCI DSS stands on Payment Card Industry Data
Security Standard & It is an information security standard which designed
to ensure that ALL companies that accept, process, store or transmit credit
card information maintain a secure environment. All major credit card companies
have mandated that members, merchants and service providers who store, process
or transmit cardholder data must demonstrate how they follow the
requirements. Failure to do so may result
in fines or termination of credit card processing privileges.
The Payment Card Industry Security Standards Council
(PCI SSC) was launched on September 7,
2006 to manage the ongoing evolution of the Payment Card Industry (PCI)
security standards with a focus on improving payment account security
throughout the transaction process. The PCI DSS is administered and managed by
the PCI SSC (www.pcisecuritystandards.org), an independent body that was
created by the major payment card brands (Visa, MasterCard, American Express,
Discover and JCB.).
All merchants will fall into one of the four merchant levels based on Visa transaction volume over a 12-month period. Transaction volume is based on the aggregate number of Visa transactions (inclusive of credit, debit and prepaid) from a merchant Doing Business As (‘DBA’). In cases where a merchant corporation has more than one DBA, Visa acquirers must consider the aggregate volume of transactions stored, processed or transmitted by the corporate entity to determine the validation level. If data is not aggregated, such that the corporate entity does not store, process or transmit cardholder data on behalf of multiple DBAs, acquirers will continue to consider the DBA’s individual transaction volume to determine the validation level.
a secure network must be maintained in which
transactions can be conducted. This requirement involves the use of firewalls
that are robust enough to be effective without causing undue inconvenience to
cardholders or vendors. Specialized firewalls are available for wireless LANs,
which are highly vulnerable to eavesdropping and attacks by malicious hackers.
In addition, authentication data such as personal identification numbers (PINs)
and passwords must not involve defaults supplied by the vendors. Customers
should be able to conveniently and frequently change such data.
User questions & answers