category:

PCI DSS

Article

Incident Response: Does Your Plan Pass the Test?

It is important that your plan includes specific steps in the event of a cardholder data breach. Creating an initial draft of your plan can be a little overwhelming, but breaking it up into smaller components can help you manage the effort and ensure you are covering all of your bases.

Incident Response
Does Your Plan Pass the Test? about the Incident Response: Does Your Plan Pass the Test?
Article

What is a QSA?

QSAs have a deep understanding of the PCI DSS, the processes involved in card processing, network segmentation, payment card brand validation and reporting requirements, hardware and communications infrastructure, compliance issues, and effective mitigation strategies.

PCI DSS
Read More about the What is a QSA?
Article

Printers, Copiers, Scanners, and Fax Machines: The Not So Hidden Risks

These devices have hard drives full of unencrypted information that may be of interest to criminals. If sensitive information is being inadvertently stored on the machine, criminals may easily be able to access and download this critical data from the machine without your knowledge.

Cybersecurity
Read More about the Printers, Copiers, Scanners, and Fax Machines: The Not So Hidden Risks
Article

EMV Chip Technology: Impact on Merchants

After the recent POS breaches at EMV-capable retailers Kmart and Buckle, many are left wondering how exactly EMV technology will reduce fraud, who is responsible when breaches do occur, and what other protections still need to be put in place.

Compliance
Read More about the EMV Chip Technology: Impact on Merchants
Article

An Introduction to Defining PCI Scope

Properly defining the scope of your organization’s cardholder data environment (or CDE) is a primary success factor for achieving PCI compliance. Too narrow of a scope can leave cardholder data at risk for exposure, while an overly broad scope will lead to unnecessary costs and efforts.

PCI DSS
Read More about the An Introduction to Defining PCI Scope
Article

Mobile Payments: Security vs. Convenience

While making the payment process as simple for the end user is almost always the end goal, you also need to ensure you are not putting your consumer’s data at risk by doing so.

Payments & Treasury Solutions
Read More about the Mobile Payments: Security vs. Convenience
Article

Procurement: An Overlooked Gatekeeper for PCI Compliance

They should know that anytime they receive a contract that mentions payment card information in any way, they need to involve the PCI Team, so you can review what is being proposed and provide the appropriate contract language regarding PCI compliance responsibilities, necessary documentation, etc.

PCI DSS
Read More about the Procurement: An Overlooked Gatekeeper for PCI Compliance
Article

Target to Pay $18.5M in Settlement for 2013 Breach:

Target was certified as PCI compliant in September of 2013, shortly before the breach – so how were they hacked? Unfortunately, as we have seen in a number of recent breaches, compliance is a snapshot in time. Unless the security requirements are maintained, gaps may arise in the infrastructure.

PCI DSS
Read More about the Target to Pay $18.5M in Settlement for 2013 Breach:
Article

Understanding PCI DSS Logging Requirements

From a security perspective, logs should be utilized as more of a prevention tool and configured to alert staff of potential suspicious activities to be investigated before too much damage is done.

PCI DSS
Read More about the Understanding PCI DSS Logging Requirements