PCI DSS specifies 12 different requirements to secure cardholder data and requires a qualified assessor to examine a merchant's environment to ensure compliance. Penalties for non-compliance range from small fines to the inability to use a specific type of credit or debit card.
Specific to risk assessment, the PCI DSS standard requires that "security controls, limitations, network connections and restrictions" are tested at least annually. It also mandates quarterly use of a wireless analyzer to see if your Wi-Fi networks are vulnerable. Additionally, the regulation requires quarterly vulnerability scans to ensure that no known vulnerabilities put cardholder data at risk.
I strongly recommend that organizations also conduct a more formal penetration test, ideally performed by outside resources, at least once a year, and also use automated pen testing tools internally more often. Why? Because the bad guys are testing your network and applications every day. They are performing risk assessments all the time, trying to figure out how to compromise your systems, so you should use their same tools and techniques to find and remediate problems.
For more information:
- In this tip, contributor Khalid Kark defines the framework that makes organizational risk management work in your enterprise.
- In this expert response, Joel Dubin discusses whether or not tokenization can meet PCI DSS standards for storing credit card data.
Dig Deeper on PCI Data Security Standard
Related Q&A from Mike Rothman
Pirated software is still a major concern nowadays. Uncover how to prevent software piracy and protect your organization's intellectual property. Continue Reading
While liaison officer responsibilities vary depending on the company they work for, their strong organizational and communications skills make them ... Continue Reading
The CISSP certification can be a challenge to obtain. Mike Rothman unveils how to get on the right education and career tracks in order to get CISSP ... Continue Reading