The Complete Guide to PCI DSS Compliance

What is PCI-DSS Compliance?

PCI-DSS (Payment Card Industry Data Security Standard) is a compliance standard established to reduce credit card fraud by increasing controls around credit card holder data that help protect the safety of that data. They set the operational and technical requirements for organizations accepting or processing payment transactions, and for software developers and manufacturers of applications and devices used in those transactions.

PCI-DSS, one of the most commonly known credit card standards, was established by the PCI SSC (PCI Security Standard Council). PCI SSC was itself created in 2006 by VISA, MasterCard, American Express, JCB International and Discover with the goal of developing common standards across payment processing companies.

What Are the PCI-DSS Compliance Requirements and How Do You Comply with PCI-DSS?

PCI-DSS (and the other PCI standards) emphasizes the physical and digital security controls that are to be implemented during payment transactions. These include storing, processing and transmitting cardholder data. PCI DSS applies to organizations, vendors and merchants who deal with cardholder data.

To be PCI-DSS compliant, there are 12 controls that need to be fulfilled.

These requirements cover organizational policies and procedures, secure device management, access control and authentication mechanisms, physical security procedures, cardholder data management, payment application management, monitoring and testing, and a strong vulnerability management process.

12 PCI-DSS Compliance Requirements, according to current version 3.2.1

The 12 requirements are:

1. Installing and maintaining a firewall configuration to protect cardholder data

2. Replacing vendor-supplied defaults for system passwords and other security parameters

3. Protecting stored cardholder data

4. Encrypting the transmission of cardholder data across open, public networks

5. Using and regularly updating antivirus software or programs

6. Developing and maintaining secure systems and applications

7. Restricting access to cardholder data according to a need-to-know basis

8. Authenticating access to system components

9. Restricting physical access to cardholder data

10. Tracking and monitoring all access to network resources and cardholder data

11. Regularly testing security systems and processes

12. Maintaining an information security policy for employees, contractors and all personnel

In addition, PCI-DSS also clarifies which cardholder data can be stored. This includes the Permanent Account Number (PAN), Cardholder Name, Service Code and Expiration Date.

PCI-DSS strictly forbids the storage of sensitive authentication data like the CVV, CVC, CV2 data or the PIN. For example, when returning to an e-commerce website you’ve made a purchase on before, the site may have stored the card details and display the last 4 digits of your card, but the CVV/CV2 code will need to be entered manually each time to complete the transaction.

How Can Organizations Comply with PCI-DSS?

Organizations that store, process or maintain payment card data must comply with the PCI-DSS standard. They can achieve compliance by performing the audit and submitting a Report of Compliance (ROC) or by going through a full fledged onsite audit performed by an authorized external party.

Complying with PCI is a continuous process. It requires constant efforts to maintain the security posture of systems through established policies and procedures and making sure they are followed at every stage.

How to Get Started with PCI-DSS for Compliance

There are several different stages involved in complying with the PCI standard. They include:

1. Building a secure network around the systems that hold or process cardholder data, with an emphasis on avoiding the use of any system’s default credentials provided by the vendor.

2. Enforcing controls to protect cardholder data at all stages of the data lifecycle through the basic security principle of following the CIA triad – Confidentiality, Integrity and Availability. Cardholder data must be encrypted during the communication phase, while in transit or when at rest. Encryption keys/decryption keys are to be stored and secured in certified hardware models designed specifically to handle this process, by using intensive mathematical computations that leverage the HSM-hardware security modules.

3. Implementing strong access control measures with industry-standard IAM tools, to enforce the principle of least privilege.

4. Continuous monitoring of resources and actions taking place across networks, while identifying anomalies and mitigating threats.

5. Segregating production networks from test networks as a means to avoid data mishandling.

6. Developing and implementing a strong security policy to incorporates all the measures already mentioned.

7. Keeping systems up-to-date with relevant security patches and having a robust vulnerability management program to efficiently identify and resolve perpetually evolving security threats.

How Zero Trust Can Help Achieve PCI Compliance

Zero trust is a revolutionary security approach fit for modern, distributed networks. At the core of the zero trust model is the principle that no identity or device should be inherently trusted, regardless of its location or connection to the corporate network.

The zero trust model directly challenges the traditional approach in which network controls or layers were given a trust level. For example, the traditional method of firewalls by Cisco or Palo Alto Networks required to assign a trust level to the interface. More specifically, the internal network side was provided a 100% percent trust level, whereas the ISP or the internet interface was assigned a 0% trust level and the DMZ level, where both public access and internal user access was required, was usually set at a 75% level.

In the zero trust framework, by contrast, every connection and request for access is verified through strong authentication and continuous authorization. The network credentials that once guaranteed access are no longer sufficient.

Here’s how implementing zero trust can help achieve PCI-DSS compliance:

1. Application segmentation – PCI-DSS requires network segmentation to protect cardholder data. Zero trust authorizes access to each application and system in order to protect data and critical applications. This is a more advanced level of segmentation.

2. Password replacement – The Cyolo zero trust access solutionreplaces centralized password databases with a personal vault, keeping attackers from having a single resource to exploit if they want to compromise passwords. Cyolo also offers a passwordless user experience, rendering password attacks obsolete. In any case, it is strongly recommended to use MFA.

3. Protecting cardholder data – The zero trust model protects data by securing access to critical applications and through encryption.

4. Maintaining device posture – When authorizing a device, Cyolo checks its antivirus, encryption status, if it’s up-to-date, etc.

5. The principle of least privilege – Zero trust is based on this principle and grants access only to identities that have proven they need access at this time.

6. Monitoring and testing – Cyolo provides auditing and monitoring capabilities, enabling real-time tracking of users and systems as well as audit logs to investigate incidents or track access.

Adopting zero trust security can help organization achieve PCI-DSS compliance and implement strong network controls. For a commitment-free demo of the Cyolo zero trust access solution, sign up here.