how to guide: PCI DSS
can sit on the same virtual machine. This is to prevent the chance of a hacker accessing a high-security system via a low-security system hosted on the same virtual server. It also spelt out the fact that organisations
must install separate firewalls both between the public Internet and the ‘demilitarised zone’ (DMZ) in which secure payments data can be transferred, but also between the DMZ and the internal network where cardholder data is kept. This point is especially important when it
comes to situations in which third parties, such as an external payments processor or cloud provider, might have a trusted connection into the DMZ. Targeted cyber attacks often exploit
‘trusted’ connections, compromising a less secure third-party service provider in order to gain access to the more secure target. Version 2.0 of PCI DSS makes it clear that trusted connections should be treated with the same caution as the public Internet. One quirk of the PCI
standard is that while most systems needed to be compliant with version 2.0
14
WWW.INFORMATION-AGE.COM
by 1 January 2012, organisations that operate unmanned machines that accept credit card transactions, such as ATMs or ticket machines, have longer to implement that standard on those machines.
No-risk approach Since the Heartland data breach in 2009, in which the US payments processor found that it had been infiltrated by hackers who were stealing data from its network, businesses whose products and services are involved in handling credit card data have taken a no-risk approach. Many manufacturers of ticket machines, for example, will have introduced keypad-level encryption, as mandated by version 2.0, already. But organisations cannot pass
off responsibility for PCI DSS compliance to their suppliers, and if they are using third-party technology to handle credit card data then they must make sure that it meets the requirements themselves.
WWW.F5.COM
Page 1 |
Page 2 |
Page 3 |
Page 4 |
Page 5 |
Page 6 |
Page 7 |
Page 8 |
Page 9 |
Page 10 |
Page 11 |
Page 12 |
Page 13 |
Page 14 |
Page 15 |
Page 16 |
Page 17 |
Page 18 |
Page 19 |
Page 20