You may have heard of PCI DSS (Payment Card Industry Data Security Standart) in several different places and might want to know what it is exactly.
PCI DSS is enforced through the terms of a merchant agreement between a business that accepts credit cards and the bank that processes the business’s transactions and it has 12 main requirements:
- Install and maintain a firewall configuration to protect cardholder data
- Do not use vendor-supplied defaults for system passwords and other security parameters
- Protect cardholder data
- Encrypt transmission of cardholder data across open, public networks.
- Protect all systems against malware and regularly update antivirus software or programs
- Develop and maintain secure systems and applications
- Restrict access to cardholder data by business need-to-know
- Identify and authenticate access to system components
- Restrict physical access to cardholder data
- Track and monitor all access to network resources and cardholder data
- Regularly test security systems and processes
- maintain a policy that addresses information security for all personnel.