Overview#

Payment Card Industry Data Security Standard (PCI DSS) is a proprietary information security standard for organizations that handle branded Payment Cards from the Payment Card Industry members.

Payment Card Industry Data Security Standard is mandated by the card brands and administered by the Payment Card Industry Security Standards Council.

Payment Card Industry Data Security Standard was created to increase controls around Cardholder Data to reduce credit card fraud.

Validation of compliance is performed periodically, either by an external Qualified Security Assessor (QSA) that creates a Report on Compliance (ROC) for organizations handling large volumes of transactions, or by Self-Assessment Questionnaire (SAQ) for companies handling smaller volumes.

Payment Card Industry Data Security Standard Requirements#

Payment Card Industry Data Security Standard specifies twelve requirements for compliance, organized into six logically related groups called "control objectives".

Each version of Payment Card Industry Data Security Standard has divided these twelve requirements into a number of sub-requirements differently, but the twelve high-level requirements have not changed since the inception of the standard.

Control objectives PCI DSS requirements#

  • Build and maintain a secure network
    • 1. Install and maintain a firewall configuration to protect cardholder data
    • 2. Do not use vendor-supplied defaults for system passwords and other security parameters
  • Protect cardholder data
  • Maintain a vulnerability management program
    • 5. Use and regularly update anti-virus software on all systems commonly affected by malware
    • 6. Develop and maintain secure systems and applications
  • Implement strong Access Control measures
    • 7. Restrict access to cardholder data by business need-to-know
    • 8. Assign a unique ID to each person with computer access
    • 9. Restrict physical access to cardholder data
  • Regularly monitor and test networks
    • 10. Track and monitor all access to network resources and cardholder data
    • 11. Regularly test security systems and processes Maintain an information security policy
    • 12. Maintain a policy that addresses information security

Many Versions#

"Secure Version of TLS"#

"Secure Version of TLS" is used in several of their documents which has been clarified "as defined by NIST.SP.52"

Multi-Factor Authentication[2]#

Payment Card Industry Data Security Standard requirement 8.3, requires the use of Multi-Factor Authentication for all remote network access that originates from outside the network to a Cardholder Data Environment (CDE).

Beginning with PCI-DSS version 3.2, the use of Multi-Factor Authentication is also required for all administrative access to the Card Data Environment (CDE), even if the user is within a trusted network.

Some clarification on Payment Card Industry Data Security Standard and Multi-Factor Authentication

Troy Leach, Payment Card Industry Data Security Standard's Chief Technology Officer clarifies this further by stating,[3]

[A] significant change in PCI DSS 3.2 adds multi-factor authentication as a requirement for any personnel with administrative access into the cardholder data environment, so that a password alone is not enough to verify the user’s identity 
and grant access to sensitive information, even if they are within a trusted network…
The most important point is that the change to the requirement is intended for all administrative access into the cardholder data environment, even from within a company’s own network. 
This applies to any administrator, whether it be a third party or internal, that has the ability to change systems and other credentials within that network to potentially compromise the security of the environment.

More Information#

There might be more information for this subject on one of the following:

Add new attachment

Only authorized users are allowed to upload new attachments.
« This page (revision-14) was last changed on 20-Mar-2017 10:20 by jim