Blog

Sometime last year you achieved total compliance with PCI DSS, the information security standard for all organizations that process credit or debit cards. That means your data is safe, the auditors will leave you alone, and you can kick back and relax, right?

Unfortunately, hackers don’t take breaks. Their methods are constantly evolving, making it essential that you are compliant with the latest security standards. Fortunately, PCI DSS is designed to ensure that you know exactly what to do to stay ahead of new threats. Staying PCI DSS compliant also lets you avoid hefty fines.  

The latest version of PCI DSS is version 3.2, which was announced in April 2016. Hopefully you’ve already seen the new rules and are taking steps to improve your security. You should be aware that some major PCI DSS compliance deadlines are approaching in 2018.

Although PCI DSS 3.1 technically expired in October 2016, all new requirements in version 3.2 will be considered best practices until 2018, when they’ll become mandatory. Here are some of the most important changes:

Multi-Factor Authentication (Best Practice Now, Mandatory February 2018)

PCI DSS version 3.1 called for two-factor authentication. Don’t worry about the name change to multi-factor authentication—it’s just to clarify that more than two types of authentication are possible. The more important update is that the requirement is expanded to include all individual non-console administrative access as well as all remote access to the cardholder environment (CDE).

That means that for any potential CDE access points, including through tools like your managed file transfer solution, you need to have multi-factor authentication either at the network or the system level.

TLS 1.1 or Above (Best Practice Now, Mandatory June 2018)

SSL and its immediate successor, TLS 1.0, are no longer considered strong encryption methods. Originally, the new PCI DSS requirement mandated that every organization migrate to TLS 1.1 and above (ideally TLS 1.2) by June 2016. This deadline was later pushed out to June 2018.

However, if you’re using SSL or early TLS, you should know that you’re not using current security best practices. We recommend that you move your file transfers to a stronger encryption method as soon as possible.

Get the Full Scoop

In order to help you fully understand the changes to PCI DSS 3.2, especially how they relate to managed file transfer, we’ve created a new whitepaper. Download it to learn:

• Who needs to comply with PCI DSS 3.2
• What has changed since version 3.1
• How PCI DSS compliance affects your file transfer processes and solutions

Get the Whitepaper

With the looming 2018 compliance deadlines and the constant news of data breaches, PCI DSS is on the minds of IT and cybersecurity professionals around the world. For organizations that reached compliance within the last year, you may be surprised to know that only 29% of companies are compliant a year after validation.

As processes, partners, and staff shift within an organization, keeping track of the measures required to maintain compliance can be difficult. The first step in becoming or maintaining PCI DSS compliance is understanding the requirements, and how they apply to your organization.

How well do you understand the PCI DSS requirements? 

Find out by taking this fun, interactive quiz for the chance to win a free Google Pixel C. That’s right, one lucky winner will be selected at random to win a free tablet just for taking the quiz.

So what are you waiting for? Test your PCI DSS skills below.

Launch Quiz

Did you know that 80% of organizations are not compliant with PCI DSS requirements? That means, if you’re reading this, there’s a pretty good chance your company needs to make adjustments in order to ensure a fully compliant payment processing infrastructure.

PCI DSS compliance doesn’t happen overnight, and maintaining compliance year after year can be even more difficult. In fact, only 29% of companies surveyed were in compliance a year after validation. With these statistics in mind, we’ve compiled a collection of the best PCI DSS security and compliance resources.

Don’t see your favorite resource listed? Add to the list by commenting below.

1. PCI DSS Quick Reference Guide [PDF]

This PDF guide provides a comprehensive overview of PCI DSS requirements, necessary security controls and processes, instructions on how to comply with PCI DSS and a list of trusted resources. Published by the PCI Security Standards Council, it’s authoritative and comprehensive.

Why we love it:
For anyone just beginning their research on PCI DSS, this guide is a great place to start. Keep in mind, the PCI Security Standards Council typically releases a new guide when the next version of requirements is confirmed. Check their website for the most up-to-date version.

2. Hacking Point of Sale: Payment Application Secrets, Threats, and Solutions [Book]

This book is a must-have guide for anyone responsible for securing credit and debit card transactions, and offers an inside look at how these systems can be hacked. To beat the enemy, you must know the enemy.

Why we love it:
In the last few years POS hacks have become more prevalent (Wendy’s, Cici’s Pizza and Eddie Bauer, for example). With a reader rating of 4.3 out of 5 stars, this book provides real and actionable solutions on how to achieve better security at the point of sale.

3. The Hacker Playbook 2: Practical Guide To Penetration Testing [Book]

This resource goes above and beyond PCI DSS compliance to teach security professionals how to protect against hacking through the game of penetration hacking. Described by readers as a “no-fluff” “ultimate playbook”, this top-rated book made our list of recommended PCI DSS security resources for good reason.

Why we love it:
This step-by-step guide is top-rated, and takes a unique approach to preventative security, helping readers to better understand all the ways their infrastructure could be compromised.

4. Validation Requirements [Infographic]

Are you a visual learner? Then this infographic is a great place to start when looking to understand PCI DSS validation requirements.

Why we love it:
The chart is straight-forward, allowing anyone to quickly understand which validation requirements their organization falls under.

5. Reduce PCI DSS Scope [SlideShare]

Most PCI DSS compliant businesses are looking to minimize the cost and effort that comes with PCI DSS compliance. Fortunately, there are a few key ways at reducing the scope of PCI DSS, and this helpful SlideShare explains them.

Why we love it:
Reducing PCI DSS scope is a very important aspect of PCI DSS compliance, and can greatly help to reduce the costs dedicated to maintaining compliance. Beginning on slide 23, this SlideShare offers some great ways to reduce PCI DSS overhead.

6. PCI DSS Compliance Made Easy [Video]

In this 3 minute video, a small business owner explains how PCI DSS compliance affects him, his customers, and his business. He also explains the important risks of non-compliance.

Why we love it:
PCI DSS compliance applies to so many types of businesses, and the importance of these regulations can easily be missed by small business owners focusing on day-to-day operations. This video takes a personable, engaging approach to PCI DSS compliance.

7. Acquirers: How to Give Your PCI DSS Compliance Program a Tune Up [Infographic]

If you’re confident that your organization is already meeting PCI DSS compliance, this infographic is for you. Learn four ways you can give your PCI DSS compliance program a tune-up, to ensure on-going compliance in years to come.

Why we love it:
In a sea of resources on “what is PCI DSS” and the basics to becoming compliant, this infographic speaks to those organizations that have moved past that stage in their compliance.

Want more PCI DSS compliance resources? Check out our new guide on how GoAnywhere Managed File Transfer helps to make PCI DSS compliance easy. 

If you work for any organization that processes credit or debit card information, you’ve heard of the Payment Card Industry Data Security Standard (PCI DSS), the regulatory standard aimed at preventing costly data breaches like the ones you may have heard about at Home Depot or TJX. But how much do you really know about PCI DSS compliance? Here are some interesting PCI DSS compliance statistics you may have missed.

1. PCI DSS compliance has increased by 167% since 2012

This is the best news on the list. According to Verizon’s latest PCI DSS Compliance Report, the number of organizations that are fully compliant at the time of interim assessment is growing rapidly each year.

2. 80% of organizations are still not compliant

While the increase in businesses taking PCI DSS compliance seriously is important, the number of compliant organizations was very low to begin with. According to Verizon’s report, four out of five companies still fail at interim assessment.

3. Only 26% of news media executives feel confident their businesses are compliant

A Newscycle Solutions survey found that only a small number of executives felt confident they had achieved PCI DSS compliance. Another 13 percent were not certain. While this compliance statistic is a snapshot of a specific industry, it’s common across all types of organizations to feel unsure about meeting PCI DSS standards. IT infrastructure becomes more complex every day, PCI DSS rules change frequently, and many companies lack up-to-date expertise.

4. Only 29% of companies are compliant a year after validation

Many businesses check PCI DSS compliance off the list and then stop worrying about it. Unfortunately, less than a third have maintained compliance a year later. While successfully demonstrating PCI DSS compliance to an auditor is a big relief, it won’t keep your business safe from security threats. The Verizon report recommends building a robust framework with security policies, procedures, and testing mechanisms to ensure compliance every day of the year.  

5. You could pay $100,000 a month for being non-compliant…or much more

One of the least understood aspects of PCI DSS compliance is that the fines for non-compliance are levied on the payment processors or credit card companies (the acquirers) that work with the non-compliant business, not the business itself. Those fines range from $5,000 to $100,000 a month. Of course, the acquirer will recoup the money from you, quite likely with added penalties and increased transaction fees.

6. None of the companies breached during Verizon’s investigations were fully compliant

This statistic is just in case you thought that PCI DSS standards were only important for your auditors. In Verizon’s ten years of having a forensics team investigate PCI DSS compliance, they have never found a company that was fully PCI DSS compliant at the time it was breached. Take note.

7. 39% of organizations were breached through insecure remote access

A 2017 study from SecurityMetrics reported that in 2016, the largest single origin of compromise was through insecure remote access. PCI DSS regulations recognize remote access as a vulnerability, and instructs organizations to protect against breach via remote access by implementing “two-factor authentication for remote access to the network by employees, administrators, and third parties,” in requirement 8.3.

8. The average total cost of a data breach is $4 Million

According to the Ponemon Institute, which tracks the costs of data breaches every year, the current amount is up 29 percent since 2013. Refer to #6 for why this statistic directly relates to your PCI DSS compliance.

9. 69% of consumers would be less inclined to do business with a breached organization

According to Verizon, the majority of consumers would be hesitant to do business with an organization that has suffered a data breach. If you’re having trouble justifying the cost of robust security solutions, this is what you need to think about: being complacent about PCI DSS compliance today could lead to years of lost customers and a damaged reputation for your brand.

10. The average merchant, at the time of data compromise, wasn't compliant with at least 47% of PCI DSS requirements

Stemming from statistic number six, the 2017 SecurityMetrics study also found that the average breached merchant was not compliant with a significant percentage of PCI DSS requirements at the time of breach. The study supposes that this lack of compliance is attributed to a lack of trust in the effectiveness of these regulations, or a believe that PCI requirements are too technical or too costly to implement.

It’s clear that many organizations are struggling with PCI DSS compliance. It doesn’t have to be difficult. Seek out security software solutions that protect your valuable data using up-to-date methods, generate detailed logs to keep auditors happy, and allow you to easily test for PCI DSS compliance.

The next set of PCI DSS deadlines are coming in 2018. Is your business prepared? Read this whitepaper to learn what changes are necessary before the 2018 deadline.

“Dear Valued Customer,

As you may have heard, on September 8, 2014, we confirmed that our payment data systems have been breached, which could potentially impact customers using payment cards at our U.S. and Canadian stores.”

This is an excerpt from an actual email distributed by a large retailer, in the wake of a massive data breach jeopardizing over 50 million credit cards. Since 2004, Payment Card Industry Data Security Standards (PCI DSS) has stood as a core regulation aimed at thwarting breaches like the above, and any organization that accepts, transmits or stores cardholder data must comply.

Now, here’s the shocking truth: In the latest PCI DSS Compliance Report conducted by Verizon, none of the companies it had investigated in ten years had been fully PCI DSS compliant at the time they were breached.

In many cases, companies achieve total PCI DSS compliance once but don’t sustain it. According to the Verizon report, 80 percent of companies fail at interim assessment. Technology moves quickly, and compliance solutions and policies implemented in past years may not be enough to stand up to modern security threats.

Other organizations believe that they don’t have to worry about protecting data. They believe their business is too small to be the target of hackers, or too large and successful to be using outdated, inadequate security practices. Sometimes they believe that data breaches only affect big retailers, not other industries.

But PCI DSS compliance needs to be taken seriously by everyone or the consequences can be devastating. Here are three organizations that experienced the detriment of non-compliance.

#1: Data Breach at Home Depot Compromises 56 Million Credit Cards

In what went down in history as one of the worst retail data breaches of all time, malware infected Home Depot point-of-sale systems and stole millions of customer credit and debit cards. The Home Depot attack seems to be a case of relying on inadequate software solutions and policies for data breach prevention. Employees later said that the company used outdated antivirus software and failed to monitor the network for unusual behavior.

PCI DSS standards require routine vulnerability scans, but according to employees, more than a dozen systems handling customer information were not assessed and were off limits to much of the security staff. In Home Depot’s case, investing in a security software with the ability to audit security infrastructure for PCI DSS compliance, may have been the difference between a $19.5 million data breach settlement, and business as usual.

#2: Office of Personnel Management Data Breach Affects Millions

After hackers attacked the Office of Personnel Management (OPM)’s servers and stole the personnel files of 4.2 million former and current government employees, as well as the security clearance background investigation information of millions more, a congressional investigation uncovered the organization’s security shortcomings.

Among many other findings, the report took especial issue with the department’s lack of two-factor authentication for employee access to sensitive data, claiming it was an oversight that could have prevented the security breach. This points to a key problem that PCI DSS compliance is meant to address. It’s not enough to encrypt and protect your files during transfer, you need to monitor internal actors as well. A robust security solution will authenticate users, give them only the access they need, and maintain a detailed log of each user’s actions.

#3: Over 45 Million Credit Card Numbers Stolen in TJX Breach

TJX Companies, owner of popular home brands such as TJ Maxx, Marshalls, and HomeGoods, experienced a data breach in which more than 80GB of cardholder data was stolen over a period of 18 months. Before the company was able to detect and halt the breach, 45.6 records had been stolen.

Documents filed in court after the breach claimed that TJX had failed to comply with nine out of the twelve PCI DSS requirements. Factors contributing to the incident included an improperly configured wireless network, a failure to segment networks carrying cardholder data from the rest of TJX's network, and the storage of prohibited data. Two members of the PCI DSS Standards Council later pointed to PCI DSS compliance as the clearest way to protect data against a TJX-style breach.

PCI DSS Compliance Can be Tricky, We Get It.

No company embarks on an initiative to avoid PCI DSS compliance. You are trusted by your customers, partners and vendors to take the proper measures to secure and protect their sensitive payment data. It’s that trust that has kept your company successful for so many years!

We read about data breaches and attacks like these in the news on a regular basis, but we don’t pause often enough to audit our own data security practices. IT infrastructure in today’s enterprises is increasingly complex, especially for large companies with systems spread around the world like Home Depot. Add to that the fact that PCI DSS compliance has multiple, complex requirements, and it can be daunting for IT and security teams to implement a sustainable process that ensures ongoing compliance.

PCI DSS compliance can be greatly simplified by using software solutions with features designed to help you achieve security and compliance. This type of software addresses PCI DSS requirements, provides the information you need to satisfy an audit, and in some cases even helps you check whether you are meeting compliance standards.

PCI DSS Compliance with Secure Managed File Transfer

File transfers are an essential point of vulnerability to consider when developing your security strategy. The most common file transfer pitfall is relying on inadequate methods such as poor FTP implementation practices, file sharing apps, and unencrypted email attachments.

A secure managed file transfer (MFT) platform guards your sensitive data against attacks with robust security and encryption methods, all while streamlining the file transfer process and saving your team time and resources that can be used to tackle other potential security issues.  Furthermore, a good MFT solution will have features like detailed audit logging and compliance assessments to eliminate the headache involved with ensuring your file transfers are compliant.

To make protecting data transfers as easy as possible, make sure your managed file transfer platform provides:

• Secure connections for the transmission of sensitive data
• Integration with existing critical applications
• Role-based security and user authentication
• Strong encryption methods
• Detailed logs for audit reporting

Securely managing your data transfers is just one aspect of achieving PCI DSS compliance, but it is an essential step toward fully protecting your enterprise against security threats.

Interested in learning more about PCI DSS compliance? Explore our PCI DSS resource section for requirement details, industry whitepapers and recent articles.

Assess the PCI DSS compliance of your file transfers for free when you try GoAnywhere MFT for 30 days. Sign up for a trial here.

Complying with the Payment Card Industry’s Data Security Standard (PCI DSS) is mandatory for every organization around the world that processes credit or debit card information. GoAnywhere Managed File Transfer has several features, like detailed event logs and role-based security, to help users eliminate the security vulnerabilities that PCI DSS was designed to combat. For more information on how GoAnywhere makes PCI DSS compliance easy, instantly download the guide. 

But PCI DSS requirements are complicated, and making sure you have checked all the boxes is often a time-consuming process for IT teams. Failing a PCI DSS audit comes with hefty fines, so you don’t want to leave anything to chance. One important aspect of achieving compliance is securing your data transfers. GoAnywhere users have a quick and easy way to ensurethat their GoAnywhere implementation is compliant with PCI DSS requirements for protecting data transfers: the Security Settings Audit Report. Painlessly checking data transfers off the list makes achieving overall PCI DSS compliance much simpler. 

GoAnywhere Advanced Reporting Module

GoAnywhere helps you manage and monitor your system information and file transfer activity with a variety of detailed PDF reports. The Security Settings Audit Report is one of several reports that can be generated on-demand through the browser-based console or scheduled and distributed automatically.

The Security Settings Audit Report

For each of over 60 security settings, the report will indicate the status of your GoAnywhere installation. There are five possible outcomes for each setting tested:

• Pass: The setting meets the PCI DSS requirement.
• Fail: The setting does not meet the PCI DSS requirement. In this case, you will also be given a recommendation for remedying the problem.
• Warning: You will need to look into this issue further to determine if you are compliant. Recommended actions are provided.
• Not Applicable: A check on this setting is not required, typically due to GoAnywhere features that you are not licensed to use.
• Fatal: A configuration problem is preventing GoAnywhere from accessing the appropriate data.

In addition to the status check and recommended actions, the report lets you know which section of PCI DSS the setting applies to.

The enhanced Security Settings Audit Report released with GoAnywhere version 5.4 includes some new checks. The report now ensures that Gateway is being used for inbound connections, that Gateway's control channel is protected with SSL/TLS and a shared secret value, that Admin users are not allowed to view Resource passwords, and that Admin users follow password age and history restrictions.

To get started with easy PCI DSS compliance using GoAnywhere MFT and the Security Settings Audit Report, download a free 30-day trial of GoAnywhere.

The Payment Card Industry’s Data Security Standard (PCI DSS) was created to increase controls over cardholder data and reduce fraud. It applies to every organization around the world that processes credit or debit card information. Unfortunately, it’s not always clear to businesses which steps need to be implemented to ensure PCI DSS compliance. Using the right software solutions can take a lot of the work out of your hands.

It’s essential to factor protection for your file transfers into your security and compliance plan. If you possess customer cardholder data, an unsecure transfer method leaves that data especially vulnerable to interception and theft. The most common file transfer pitfall is relying on inadequate methods such as free FTP tools, file sharing apps, and email attachments. Ideally, your file transfer solution will go beyond protecting your data with encryption and secure protocols and also help you to provide the information that an auditor needs through detailed reports and role-based access.

The penalties for failing a PCI DSS audit are severe and will likely negate the savings of your “inexpensive” transfer method. Of course, complying with PCI DSS is not just about avoiding fines. PCI DSS compliance should be seen as a set of core principles that will help you avoid a costly breach of your data—and having to tell your customers that you’ve allowed their credit card data to be stolen.

PCI DSS compliance is based on twelve main requirements. We’ve put together a guide that demonstrates how GoAnywhere Managed File Transfer addresses several of them. For example, GoAnywhere protects your files at rest (PCI DSS Requirement 2) using strong encryption methods like AES and OpenPGP. Its role-based accounts allow you to restrict access to cardholder data by business need-to-know (PCI DSS Requirement 7).

Instantly download the guide to see how GoAnywhere helps to make PCI DSS compliance easy.

For some organizations, the 36 month lifecycle of new Payment Card Industry Data Security Standards (PCI DSS) can be a grueling schedule to tackle. With the release of PCI DSS 3.2 just around the corner, many organizations are trying to estimate the effort required to remain compliant. Wouldn't it be nice if there was a way to predict what was on the minds of the folks on the PCI Security Standard Council before the new standards were released? Well, there just might be a way.

In June, 2015, the Council published a document called The PCI DSS DESV (Designated Entities Supplemental Validation). Inside that document are "extra requirements" which apply to entities requiring "additional validation". These could be organizations that deal with Payment Card Data in large volume, serve as an aggregation point for cardholder data, or suffered significant or repeated breaches.

As folks in the world of security know, defense in depth is a rule we all live by. Extraordinary soon becomes ordinary. Exceptional soon becomes standard. Supplemental soon becomes required.

Through the DESV, it's possible to glimpse the future of PCI DSS.  By implementing these controls and processes, your organization gains even more protection than what is currently and commonly required. By doing so, you can prepare - to some extent - for the surprises lurking down the road. At the very least, your processes will be better defined and your controls will be more secure. Implementing best practices early could give you the competitive edge you need to respond quickly when those practices become required.

This idea is based on more than just speculation. In a Council blog, "Preparing for PCI DSS 3.2: What to Expect in 2016", posted on February 17, 2016, chief technology officer Troy Leach eluded to some updates in the standard they were considering, which included the following:

• Multi-factor authentication for administrators
• Incorporating some of the DESV criteria for service providers
• Clarifying masking criteria for primary account numbers when displayed
• Updating migration dates for SSL/early TLS that were published in December 2015

As a developer of enterprise managed file transfer and encryption solutions, Linoma Software remains vigilant in keeping up with the latest PCI DSS standards so we can help organizations to protect their most sensitive data assets and meet compliance requirements.

As thousands of harried spouses and romantically entangled Americans scramble to find the right Valentine's Day gifts this week, many are pulling out the credit cards and ordering online or over the phone or waiting in line to swipe their debit cards at the florist or candy store.  That's a lot of personal data zooming through cyberspace, which can make the perfect gift for hackers.

One of the compliance regulations that controls how merchants and others handle credit card data is PCI DSS, established to prevent, detect and react to unauthorized access to personal payment information.  The standards are strict and penalties can be stiff.

The challenge comes when retailers, overwhelmed with busy shopping seasons and lines of customers, have so many things to manage that their vigilance protecting customer data can lose priority.  And yet, it just takes one misstep to open the doors to a data breach.

That's why it's critical that retailers and other organizations who handle credit card information regularly assess their data protection policies and processes, and implement effective encryption and data transfer tools that can automate the process of keeping data secure so they can focus on keeping their customers happy.

For more information about how Linoma Software can help keep your data safe at rest and in motion, email linoma.solutions@helpsystems.com.