Definition
The PCI Data Security Standard is a set of policies and requirements for increasing credit card account data security. The standard was developed by the PCI Security Standards Council, which includes American Express, Discover Financial Services, JCB International, MasterCard Worldwide and Visa International. It was created to help companies that work with financial customer data adopt a consistent data security policy internationally.
Business applications
These policies are for interacting with most credit card processing companies. Companies that work with credit card data should already have most, if not all of these policies in place already. However the PCI DSS formalizes the documentation of the policies that are used to meet the requirement of certification of data security.
Concerns
As with any security documentation, it is not valid if it is not frequently updated and implemented in production systems as documented in the standards. The most important part of deployment of new security standards is the audit, which validates that the system administrators and programmers who must abide by the new rules are following them and updating internal documentation to reflect the new policies.
Technical details
The core ideals of the PCI DSS are straightforward, and to most security experts make rational sense. This list is taken from the PCI website that defines the technical requirements of the policy:
Requirement 1: Install and maintain a firewall configuration to protect cardholder data
Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters
Requirement 3: Protect stored card holder data
Requirement 4: Encrypt transmission of cardholder data across open, public networks
Requirement 5: Use and regularly update anti-virus software
Requirement 6: Develop and maintain secure systems and applications
Requirement 7: Restrict access to cardholder data by business need-to-know
Requirement 8: Assign a unique ID to each person with computer access
Requirement 9: Restrict physical access to cardholder data
Requirement 10: Track and monitor all access to network resources and cardholder data
Requirement 11: Regularly test security systems and processes
Requirement 12: Maintain a policy that addresses information security
There are no comments on this document
Six Sigma Framework for IT
This collection of tutorials, calculators, and templates will show you how to apply Six Sigma thinking to IT service management.
The IT Service Catalog Management Toolkit
Bridge the IT-business gap once and for all! A well documented IT services catalog is the conduit for IT services to the rest of the company.
