Networking & Communications

Pci Router

PCI DSS Compliance Tips and Guidelines for 2011

The Importance of PCI Compliance

Companies accepting credit or debit cards in exchange for goods or services must already be compliant with the PCI DSS (Payment Card Industry Data Security Standard) requirements. Any merchant that does not comply with PCI DSS is at risk of extensive fines from Visa and other card brand companies. To ensure that a PCI-compliant merchant is able to incorporate new technologies and to protect against new ways of hacking personal data, continuous auditing is required to retain PCI DSS compliance.

It is not only the large, household-name companies that face malicious network attacks. Smaller franchises and retailers are under constant threat of theft or damage as they typically do not invest in IT resources, cardholder data monitoring, and preventative network security solutions.

Don't leave PCI Compliance to chance risking a security breach and heavy fines from the credit card companies. Seeking out top IT support consultants can help secure your network and help your company build and maintain PCI compliance.

Begin with a PCI Compliance Overview. Following are some tips and strategies for beginning your PCI DSS compliance validation efforts. These tips may help you eliminate data you do not need, isolate the data you do need to defined and controlled areas, and allow you to limit the scope of your PCI DSS compliance validationeffort. You may be able to remove systems and networks that don't store, process or transmitcardholder data, and that don't connect to systems that do, from the scope of your self-assessment. (Source: PCI Security Standards Council)

1. Sensitive Authentication Data (includes the full track contents of the magnetic stripe orchip, card verification codes and values, PINs and PIN blocks):

a. Make sure you never store this data.

b. If you don't know for sure, ask your POS vendor whether the software product and versionyou use stores this data. Alternatively, consider hiring a Qualified Security Assessor that canassist you in determining whether sensitive authentication data is being stored, logged, orcaptured anywhere in your systems.

2.POS Security: If you are a merchant, ask your POS vendor about the security of your system, with the following suggested questions:

a. Is my POS software validated to the Payment Application Data Security Standard (PA-DSS)? (Refer to PCI SSC's list of Validated Payment Applications.)

b. Does my POS software store magnetic stripe data (track data) or PIN blocks? If so, this storage is prohibited, so how quickly can you help me remove it?

c. Does my POS software store primary account numbers (PANs)? If so, this storage must be protected, so how is the POS protecting this data?

d. Will you document the list of files written by the application with a summary of the content of each file, to verify that the above-mentioned, prohibited data is not stored?

e. Does your POS system require me to install a firewall to protect my systems fromunauthorized access?

f. Are complex and unique passwords required to access my systems? Can you confirm that you do not use common or default passwords for mine as well as other merchant systems you support?

g. Have default settings and passwords been changed on the systems and databases that are part of the POS system?

h. Have all unnecessary and insecure services been removed from the systems and databases that are part of the POS system?

i. Do you access my POS system remotely? If so, have you implemented appropriate controls to prevent others from accessing my POS system, such as using secure remote access methods and not using common or default passwords? How often do you access my POS device remotely and why? Who is authorized to access my POS remotely?

j. Have all the systems and databases that are part of the POS system been patched with all applicable security updates?

k. Is the logging capability turned on for the systems and databases that are part of the POS system?

l. If prior versions of my POS software stored track data, has this feature been removed during current updates to the POS software? Was a secure wipe utility used to remove this data? PCI DSS Self-Assessment Questionnaire Instructions and Guidelines, v2.0 October 2010.

3. Cardholder data—General rule #1: if you don't need it, don't store it!

a. Payment brand rules allow for the storage of Personal Account Number (PAN), expiration date, cardholder name, and service code.

b. Take inventory of all the reasons and places you store this data. If the data doesn't serve a valuable business purpose, consider eliminating it.

c. Think about whether the storage of that data and the business process it supports are worth the following:

i. The risk of having the data compromised.

ii. The additional PCI DSS efforts that must be applied to protect that data.

iii. The ongoing maintenance efforts to remain PCI DSS compliant over time.

4. Cardholder data—General Rule #2: if you do need it, consolidate and isolate it.You can limit the scope of a PCI DSS assessment by consolidating data storage in a definedenvironment and isolating the data through the use of proper network segmentation. Forexample, if your employees browse the Internet and receive e-mail on the same machine ornetwork segment as cardholder data, consider segmenting (isolating) the cardholder data onto itsown machine or network segment (for example, via routers or firewalls). If you can isolate thecardholder data effectively, you may be able to focus your PCI DSS efforts on just the isolatedpart rather than including all your machines.

5. Compensating Controls

Compensating controls may be considered for most PCI DSS requirements when an organization cannot meet the technical specification of a requirement, but has sufficiently mitigated the associated risk through alternative controls. If your company does not have the exact control specified in PCI DSS but has other controls in place that satisfy the PCI DSS definition of compensating controls.

Why eMazzanti for PCI Compliance Solutions?

eMazzanti Technologies provides a six-step PCI DSS Compliance strategy to help protect website customers from a data breach and online merchants from legal and financial repercussions.

Step I: Build and maintain a secure network by installing and maintaining a proper firewall avoiding the use of vendor supplied defaults for passwords and security parameters.

Step 2: Protect Cardholder Data through proper storage strategies and proper cardholder encryption solutions across open, public networks

Step 3: Maintain a vulnerability management program that utilizes regularly updated anti-virus protection and maintains secure systems and applications.

Step 4: Implement strong access control measures by restricting access to cardholder data, assigning a unique ID to each person with computer access, and restricting physical access to cardholder data.

Step 5: Regularly monitor and test networks by tracking and monitoring all access to network resources and cardholder data.

Step 6: Maintain an information security policy that addresses information security for employees and contractors.

About eMazzanti Technologies

With a company name that sounds more like a purebred, high-performance sports car than a IT support and consulting firm, eMazzanti Technologies is all about delivering powerful solutions such as PCI DSS compliance solutions, computer network management, network troubleshooting, business continuity and disaster recovery, green computing, mobile workforce technology, information security, cloud computing, cloud computing services, and business information optimization in the most efficient manner possible. The Hoboken, N.J., firm is located in one of the most densely populated - and competitive - regions in the U.S. It provides business technology consulting services for companies ranging from home offices to multinational corporations throughout the New York metropolitan area and throughout the U.S. For more information visit: www.emazzanti.net/products/network-security/pci-compliance. You can also call: 201-360-4400.

About the Author

Free PCI DSS Compliance NYC for your credit and debit card transactions. Protect customer data from security breaches and extensive fines and penalties. For more Informations Please visit our PCI DSS Compliance New York City website.

I have a pci router and i cant connect my att tilt to the router. how can i connect?

i already have a laptop and pc both installed and already working . but my tilt just says available but when i push connect after a few seconds it just says available. I've connected to wifi on my tilt before.

your tilt may not support the security setting on your router (WPA, WEP) check to make sure that it is set correctly to all of that and make sure that the password is correct