PCI DSS Compliance

In 2006, a group of credit payment agencies created a council known as the Payment Card Industry Security Standards Council (PCI SSC). This council created a guiding set of payment standards establishing the minimum requirements that must be satisfied for any merchant to store, process, or transmit cardholder data. (Cardholder data consists of the payment account number [PAN] at a minimum but can also include the cardholder name, expiration date, and service code.) These standards became known as the Payment Card Industry Data Security Standard (PCI DSS). The Payment Card Industry Data Security Standard helps companies determine their potential exposure to financial loss when dealing with credit card processing companies.

PCI DSS isn’t a certification. Rather, it’s a checklist of processes and practices that must become part of the framework of any company that handles cardholder data. Compliance with PCI DSS is a continuous process that involves three steps:

1. Assess. Identify and inventory assets and processes that handle cardholder data, and analyze them for vulnerabilities that could lead to exposure.
2. Repair. Remediate vulnerabilities and secure business processes.
3. Report. Document the assessment process and remediation performed to fix the vulnerabilities, and share compliance reports with the bank/card companies that you do business with.

The standard contains controls designed to protect credit card data that should be practiced daily in all payment operations. PCI DSS compliance may differ in the details based on the activities performed by each company. However, to remain PCI compliant, all businesses must comply with five core principles:

• Reduce the vulnerable attack surface.
• Make PCI DSS part of daily operations.
• Monitor for suspicious activity.
• Conduct regular environment penetration tests.
• Consult an expert to confirm the company meets the standards in the PCI DSS.

There are four levels of PCI compliance, organized by number of transactions per year. Any company that handles cardholder data fits into one of those levels. A company’s level depends on how the company handles credit card data and the amount of data it processes annually. The PCI SSC provides a self-assessment questionnaire to help companies determine which levels they fit into.

The PCI SSC isn’t a governmental regulative body. However, it may take punitive actions if a company fails to comply with its standards. The primary consequence of compliance failure is a monetary fine. Penalty fees for noncompliance can include legal fees, banking fines (for every card stolen), cost of federal audits, and cost of cleanup (including investigation by forensics experts).

While the financial cost of not complying with the standard ($500,000 and up) may seem like a strong deterrent, the lack of trust from major banking institutions, third-party partners, and customers represents a longer-term concern.

Another important thing to remember is that using a payment processing firm that is PCI DSS compliant, such as PayPal, does not excuse you from the PCI requirements (although it does limit the scope of compliance). If you handle cardholder data (or integrate with a payment processing firm to do so), you are required to comply.

Maintaining PCI compliance increases developers’ efficiency by providing security guidance as they code and teaching them how to build security into their software consistently. Synopsys provides solutions to help your business meet security requirements and achieve PCI DSS compliance. Our solutions help you implement, enhance, and scale your penetration testing capabilities. They improve your security posture immediately and set the course for ongoing improvement of your software integrity through the maintenance of PCI standards via tools and education. Our PCI compliance approach also promotes cross-functional software security awareness, adoption, and efficiencies.