Overview#Payment Card Industry Data Security Standard (PCI DSS) is a proprietary information security standard for organizations that handle branded Payment Cards from the Payment Card Industry members.
Payment Card Industry Data Security Standard is mandated by the card brands and administered by the Payment Card Industry Security Standards Council.
Validation of compliance is performed periodically, either by an external Qualified Security Assessor (QSA) that creates a Report on Compliance (ROC) for organizations handling large volumes of transactions, or by Self-Assessment Questionnaire (SAQ) for companies handling smaller volumes.
Payment Card Industry Data Security Standard Requirements#Payment Card Industry Data Security Standard specifies twelve requirements for compliance, organized into six logically related groups called "control objectives".
Each version of Payment Card Industry Data Security Standard has divided these twelve requirements into a number of sub-requirements differently, but the twelve high-level requirements have not changed since the inception of the standard.
Control objectives PCI DSS requirements#
- Build and maintain a secure network
- 1. Install and maintain a firewall configuration to protect cardholder data
- 2. Do not use vendor-supplied defaults for system passwords and other security parameters
- Protect cardholder data
- Maintain a vulnerability management program
- 5. Use and regularly update anti-virus software on all systems commonly affected by malware
- 6. Develop and maintain secure systems and applications
- Implement strong Access Control measures
- 7. Restrict access to cardholder data by business need-to-know
- 8. Assign a unique ID to each person with computer access
- 9. Restrict physical access to cardholder data
- Regularly monitor and test networks
- 10. Track and monitor all access to network resources and cardholder data
- 11. Regularly test security systems and processes Maintain an information security policy
- 12. Maintain a policy that addresses information security
Many Versions#TLS" is used in several of their documents which has been clarified "as defined by NIST.SP.52" Multi-Factor Authentication for all remote network access that originates from outside the network to a Cardholder Data Environment (CDE).
Beginning with PCI-DSS version 3.2, the use of Multi-Factor Authentication is also required for all administrative access to the Card Data Environment (CDE), even if the user is within a trusted network.
Some clarification on Payment Card Industry Data Security Standard and Multi-Factor Authentication
[A] significant change in PCI DSS 3.2 adds multi-factor authentication as a requirement for any personnel with administrative access into the cardholder data environment, so that a password alone is not enough to verify the user’s identity and grant access to sensitive information, even if they are within a trusted network… The most important point is that the change to the requirement is intended for all administrative access into the cardholder data environment, even from within a company’s own network. This applies to any administrator, whether it be a third party or internal, that has the ability to change systems and other credentials within that network to potentially compromise the security of the environment.
More Information#There might be more information for this subject on one of the following:
- Cardholder Data Environment
- PCI DSS
- Payment Card Industry
- Payment Card Industry Data Security Standard
- Payment Card Industry Security Standards Council
- [#1] - Payment_Card_Industry_Data_Security_Standard - based on information obtained 2016-07-15-
- [#2] - Multi-factor_authentication - based on information obtained 2017-03-19
- [#3] - For PCI Multi-Factor Authentication is Now Required for Everyone…and You Better Hurry - based on information obtained 2017-03-19