PCI SSC Project Report

Another requirement is that the default password must be changed. Default passwords are easily hacked and can lead to access to sensitive information. The second goal, protect cardholder data, this is the personal information about the cardholder. This information can never be stored by any merchant. Also, all information being transmitted must be encrypted when using the public networks. The third goal is maintain a vulnerability management program. Antivirus software must be on all computers connected to the network. Viruses can make their way into a computer system in many ways but mostly from email or other online activity. Also, vendor supplied security patches must be installed within one month to avoid exposing cardholder data. The fourth goal, implement strong access control measures, requires merchants limit the accessibility to cardholder information by use of passwords or other security measures. Correspondingly, an unreadable password should be used to trace employees activities when accessing sensitive data. Furthermore, monitor access to physical cardholder data. The fifth goal,

“The Federal Information Processing Standards Publication Series of the National Institute of Standards and Technology (NIST) is the official series of publications relating to standards and guidelines adopted and promulgated under the provisions of Section 5131 of the Information Technology Management Reform Act of 1996 (Public Law 104-106) and the Federal Information Security Management Act of 2002 (Public Law 107-347)” ("FIPS PUB 199," 2004). In this paper, FIPS PUB 199 has been chosen as the security standard used by State of Maryland Department of information technology. This standard addresses to develop standards for categorizing information and information systems. On the other hand, ISO/IEC 27001 is the other standard not used by State of Maryland which has been discussed as a contrast standard.

In a highly competitive market space, being compliant with PCI standards will make our organization more acceptable in the market, and also help build trust and confidence in our operation among healthcare providers seeking our services. In a constantly evolving threat environment with increased levels of data breaches in recent times, ensuring PCI compliance even though not mandated will help attract customers and would be good return on investment. Along with BAA signed with our clients, being PCI compliant would also ensure extra layer of protection by following the practices suggested by leading payment card brands like Visa, Mastercard, etc. who are constantly looking out for new emerging threats in the industry, and are proactive in incorporating changes to PCI DSS standards to minimize the impact of these new threats. Though complying with standards like PCI doesn’t ensure security, they provide a structure around which organizations can build their information security and assurance program, thereby helping them anticipate and mitigate new risks in the area of storing payment card

Financial services companies that store, transmit and process credit card data are subject to PCI DSS (Payment Card Industry Data Security Standard)

TransNet Payment System is a credit card merchant processing company. They are registered Independent Sales Organization (ISO) of First Data and are also the member of The Electronic Transaction Association (ETA). Merchant service handles the electronic payment transactions that includes the process of obtaining the sales information from the merchant, acquiring bank authorized the transaction and routes it to the processor and then to the card associations, they then routes the transaction to the issuing bank for approval and sending payments to the merchant. This entire process involve a high level of respect for confidentiality of customer’s data. Since TransNet is a member of ETA, the company naturally conducts business based on their values. For instance, one of the code of conducts of ETA states, “Members of the ETA shall take affirmative steps to comply with all industry standards to assure that such

All major credit card issuers must adhere to the Payment Card Industry Data Security Standard (PCI-DSS). This is a mandated compliance standard established by the Payment Card Industry Security Council. This standard

ISO 31000 describes a framework for implementing risk management. As ISO 31000 depicts, it’s essential to manage your cybersecurity program within a continually improving risk management oversight wrapper.

The National Institute of Standards and Technology (NIST) 800 series and ISO/IEC 27002 standards which were created for establishing, executing and refining organizational information security management programs, recommends the following areas to be covered and examined in an organization’s security program (Adler, 2006).

“ISO is commonly known as ‘International Organization for Standardization’, the ISO 9001:2000 standard is used for quality systems audited by outside auditors. This standard is applicable for manufacturing companies not only for software. This standard is given based on the documentation, design, production, testing, servicing and other processes.” (Testing Excellence.com, 2009).

To fully understand the importance of the ISO 27001 model, we need to understand what an IS0 27001 model actually is this will now be discussed. The ISO 27001 is a specific set of standards used to ensure information is kept secure within an organisation. The standards are used to help an organisation manage the security of their assets, for example

The recent compromise of Target has exposed a more underlying issue of merchant’s inability to monitor and secure the payment systems and the databases that store consumer card information. When it comes to the technology in place that monitors and secure customer information, there are no active monitoring of the systems. There will need to be an overhaul of the current technology in place by these organizations, if they hope to combat fraud and protect consumers from data breaches and merchant compromises. (Heun, D. (2013).

The first version of data security standards was released in December 2004 to combat the increasing rate at which cardholder information was being stolen online. The PCI DSS was established in 2006 with the formation of the Payment Card Industry Security Standards Council (PCI SSC). The council focuses on improving security of credit card transactions as technology and market trends change the security concerns in the industry.

The ISO/IEC 27000-series consist of information security standards published jointly by the International Organization for Standardization (ISO) and the International Electro technical Commission (IEC). In accordance with ISO/IEC 2700, we begin to define the guidelines to support the interpretation and implementation of information

A security administrator can look to the Information Technology- Code of Practice for Information Security Management, ISO 17799/BS 7799 as well as ISO 17799/BS 7799, the NIST Security Models including the SP 800-12, 14, 18, 26, and 30, and the VISA International Security Model are just a few of the established security frameworks available.

Requirement number three is to protect stored cardholder data using encryption, truncation, masking and hashing as part of the cardholder data protection. If a hacker manages to bypass the security protection and get access to the encrypted data, the information is unreadable and useless without the correct cryptographic key. Only the minimal amount of cardholder data should be stored whenever possible. There should also be policies for data retention and disposal procedures of cardholder data storage. Only store the minimal data needed, do not store the entire track of contents of magnetic strips, card verification code, or PIN number. PAN numbers must be rendered unreadable anywhere they are stored. Cryptographic keys should be stored in as few locations as possible and under secure encrypted devices.