Author: admin

PCI mandates Open-Source hygiene as a key requirement

Posted on by admin

PCI Software Security Framework: The Beginning.

The Payment Card Industry Security Standards Council (PCI SSC) released a new security framework for software vendors that develop payment applications. This new framework will be replacing the current guidelines of the PCI Payment Application Data Security Standard (PCI PA-DSS) which will be retired in the coming years. The  PCI SSF  standards now cover two separate standards namely:

  1. PCI Secure Software Standard (PCI SSS)
  2. PCI Secure Software Lifecycle Standard (PCI Secure SLC).

PCI SSF and Open Source

Software products have been using open source components over a while now, in their development process. This practice has also paved a way for malicious players to hack their way into the systems in case the open source components aren’t secure enough. Hence, its necessary to maintain and manage to ensure the security of open source components as equal as that of the proprietary software

The new SLC guidelines emphasize on securing the integrity of the code and hence have included them in the requirements. Previously, the  PCI DSS guideline 6.1 – 6.5  focused more on responding to security vulnerabilities post their discoveries. The guidelines emphasize the responsibility to patch up the vulnerabilities within a month post discovery.

As per the  3.2b in the new PCI Secure SLC  document, the guideline states that :

Where open source software components are utilized as part of the software, the assessor shall examine vendor evidence, including process documentation and assessment results to confirm these components are managed as follows:

  • An inventory of open source components used in the software is maintained
  • A mature process exists to analyze and mitigate the use of open source components with known vulnerabilities.
  • The vendor monitors vulnerabilities in open source components throughout their use or inclusion in the vendor’s software to determine when new vulnerabilities are identified.
  • An appropriate patching strategy for the open source components is defined.

The new guideline under PCI Secure SLC encourages the vendors to track components they are using and block with the vulnerabilities from the product. The approach ensures that the risks are eliminated before vulnerabilities are shipped to the product.

The vendors would require to convert their open source usage management with Software Composition Analysis (SCA) solutions like Software Composition Analysis (SCA) that can integrate into the SDLC and automate open source components approval processes, initiate damage processes automatically, trigger real-time alerts, and generate on-demand reports along with other features.

Hence, including open source components will now require more stringent policies and security checks.

Will Compliance with the new PCI Software Security Standards be smooth in the future?

Measures have already been taken by the PCI SSC as getting compliance with the necessary regulations is a painful process. The PCI team has taken due effort in making the transition process smooth for vendors planning the implementation and timeline accordingly.

As a PCI QSA company, QRC would enable customers to map out the dependencies in their applications and highlight the current vulnerabilities and testing against a comprehensive vulnerability.

Web skimmer on the rise amidst the Covid-19 crisis

Posted on by admin

Consumers today have ramped up their online usage and with brick and mortar stores out of reach temporarily, ecommerce has become more of a lifeline. These shifts to digital platforms for payment have widened the playfield for cyber criminals and digital skimming of credit cards is on the rise.

In times of this pandemic, PCI SSC and the US Chamber of Commerce shared guidance and information on protection against digital skimmers. Understanding the evolved threatscape, PCI SSC council shared guidance and information for protecting against the rising online skimming attacks. The following segments outline the key points :

COVID-19 Crisis : Newly evolved threats online

We have seen a drastic rise in the online activity due to the lockdown. With people spending hours on social and ecommerce sites, it has provided widened access for cybercriminals.  There has been an increase in the number of online phishing and scamming incidents with evolved sophistication and volume.

What and Why’s of Digital Skimming

Digital skimmers are online threat players, involved in injecting malicious code (JS sniffers) into legitimate websites to grab payment data. Once the website is infected, the payment card information is skimmed during the transaction without the merchant or consumer being aware.

It is being counted as under the  Magecart  Umberlla, a term popular with cyber professionals and researchers to summarise all the threat groups responsible for online skimming.

“Ecommerce crime spikes whenever there is an event that forces or entices people to perform more online transactions,” Yonathan Klijnsma, Head of Threat Research, RiskIQ

How does Digital Skimming Attacks work ?

Hackers exploit the vulnerable plugins, credential stuffing and undertake phishing and other social engineering techniques to gain access to third party softwares libraries or ecommerce websites to inject the malicious code. Service providers are not aware of the risk they create if they don’t focus on the security and potential threats.

Third party applications and services that are used involve : Live chat function, advertising scripts, customer rating features etc. Since third party functions are more widely used by ecommerce websites, exploit of one function opens doors for multiple websites through mass distribution of malicious Javascript.

Code is executed when a victim submits his payment details during checkout. Cybercriminals involved gather different details as per their target like billing address, names, email, phone number, credit card details, username and password.  The code running logs the data either locally or remotely to a computer controlled by the threat agent.

How severely does this affect small merchants and business ?

Small merchants and service providers do not have sufficient security controls in place and hence at the most risk of these attaches. In times of these crises, small businesses have hassly moved online to remain operational relying on attimes unevaluated technologies. With reduced staff at work and unavailability of large IT infrastructure, they are more susceptible to suck attacks.

It’s evident  from previous Data breach reports that small businesses are  a major chunk of organizations affected by cyber attacks, In the dire time of this pandemic, the sales of COVID-19 domains have increased dramatically which are also used as platforms to launch phishing campaigns and spread malware.

Digital Skimming : Who’s most vulnerable ?

Any e commerce service provider or implementation that doesn’t have sufficient controls in place, provides their platforms as a playfield for digital skimmers. The insecure third party service providers,  and API developers to be used with the website are at a major risk. The hackers keep evolving their attacks and customize their code based on the susceptibility of their target.

The security checks and controls needs to be persistent as the threats are. The Magecard infected stores have been reported to be re-infected in a short while after being assessed. Hence, it is essential that the systems are cleaned and the vulnerabilities are patched or mitigated.

Best practices : How can we remain secure ?

Detection and prevention of these threats are the only ways to remain secure . Few detection methods are as listed below :

Prevention of Digital Skimming :

  • Implement malware protection and keep up to date
  • Restrict access to payment data and supporting environments to only what is necessary and deny all other access by default
  • Ensure responsibilities with third-parties are well understood
  • Use strong authentication for all access to system components

POS Device Security and the Cleanliness

Posted on by admin

POS devices and their usage have become an integral part of every customer facing business. While they provide an ease of making transaction payments, maintaining a hygiene around these crucial devices is also necessary. With  COVID-19  crisis around the clock, the risk of getting affected has quadrupled and with masses inkling more towards the user of cashless mediums to make payment, merchants are facing an increasing challenge in protecting the safety of their customers. These uncertain times requires an increased awareness about the potential risk associated with the touching the payment terminals.

The PCI SSC Council recently shared an article addressing the needs to maintain the POS hygiene and listed down some considerations to be undertaken by the merchants to maintain the security and cleanliness of the POS devices.

Prioritizing Internal Security for Hygiene

While POS devices are more customers facing, the employees handling the devices are prone as well to exposure. In such situations, access to POS devices can be reduced to specific individuals rather than the entire on-shift employees. POS vendors provide internal security feature to segment the managing staff based on multiple criteria.

Promoting Contactless Transactions

Contactless cards prove to a safe payment method for transaction, since they don’t require any physical interaction between the customer and the POS device. Owing to these many countries across the world have increased the maximum value for transactions by contactless or non-PIN means. These methods greatly reduce any physical interaction required for payment. Merchants are encouraged to contact their processor or acquirer to investigate the use of these techniques.

Hygiene of Payment Terminals

POS systems are quite an investment. The increasing pandemic further adds to the need of them to be regularly sanitized. However, many merchants use the same old methods of cleaning the devices by means of spraying disinfectants directly on the keyboard before wiping it. These leads to reduced lifespan of the electronic device.

The vendor’s instruction can come in handy at times like this since the device making varies from one vendor to another. Also, many keypads are not designed to be watertight and hence disinfectants sprayed on can damage the sensitive hardware. Keypads should be wiped gently, also in times like these, customers should be provided with a wipe and sanitizer.

POS Overlays:Precautions and Hazards

Use of Overlays has been seen as means to protect the POS devices from the spray and disinfectants. However plastic wrapping adds an additional layer of risk to the PCI PTS approved devices.

Overlays can be used to capture the card and PIN data from the ATMs and POS devices. By placing an overlay containing an illegal card reader or wires over a card, the customer data can be recorded, along with skimming or hiding of tamper evidence. Only a small degree of opaqueness is sufficient enough to slip or conceal any wire or sensor with malicious intent.

Owing to these, the use of overlays poses a securityrisk to both the merchants and consumers. The use of these on the operations device may also affect the PCI device approval. Its advisable that merchants should consult the acquirer regarding the used of overlays during these crises.

QRC’s Awareness Program

QRC has been creating awareness among the Payment Card Professionals regarding forming and putting down the best practices in use in their daily operations regularly. Being awareness of the various possible threatscape can prove to be vital for any organization is safeguarding any losses due to data breach that might lead to loss of reputation and resources.

Corona Crisis : PCI SS paves way with Remote Assessment

Posted on by admin

The recent outbreak of Corona virus has hampered the operations across the globe affecting all economies and nations alike. The lockdown has bought few industries to a standstill while others are still managing to continue their day to operations via virtual means.

But even in uncertain times like these, PCI DSS compliance is a requirement that can’t be dropped. PCI SSC council has recognized these unusual circumstances and understands situation where onsite assessments won’t be possible owing to restricted travel entry. In lieu of the individual health and safety, PCI SSC has emphasized on  remote assessments providing guidance to the assessor community

Troy Leach, Sr VP, Engagement Officer PCI SSC discussed the necessary guidelines to be followed by assessor at these times.

Remote Assessments

Since, assessors may not be able to travel to an onsite location for assessment, they are advised to conduct remote assessments that ensures any validations being performed remotely are under necessary level of assurances of implementation and that all the requirements are met before signing off their ‘in place’ clause in the report of compliance

Maintaining the Integrity of Assessment

Necessary measures are recommended to be taken by the assessor to ensure that integrity of the assessment is maintained even in remote scenarios, ascertaining that personnel and system components under examine are same as in onsite assessment.

Report on Compliance must include the mode of assessment conducted and how an equivalent level of assurance was attained during the assessment, retaining all the relevant evidence as a part of assessment paperwork.

Local Qualified Assessor resources can be engaged for assistance, in case the primary QSA is unable to travel onsite. An approved subcontractor can be engaged in accordance to the QSA program requirements. And all the measures should be taken to ensure that the results of the assessment are in line with the onsite assessment, even though certain tests are meant to be done only in person and delay in such scenarios is unavoidable.

All the necessary queries about the assessment completion and how it may impact the compliance should be addresses to the acquirer of the applicable payment brands. The general guidance for the QSAs around online and remote assessments are available in FAQ 1455. Check it out  here.

QRC requests all our community members to stay safe, we put our clients in the centre of every key decision that is made. And assure in doing our best in implementing all business continuity measures until the pandemic is contained in scale and scope.

ATM Switch Application Provider with Cybersecurity

Posted on by admin

Over the past years, India’s economy is exponentially growing giving rise to unceasing advancement in the banking industry. Various aspects of banking as such Checking accounts, Savings accounts, Debit and credit cards, Merchant services (credit card processing, reconciliation and reporting, check collection), Treasury services, loans etc are diversifying in a multitude manner. Also, forease of customers and to avoid overcrowding at the banks, there is an outrageous increase in number of ATM’s. According to RBI’s report of September 2019 there are 206,589 ATM’s in all over India including on site and off site as well.

Without any doubt the ATM’s do serve the purpose of enhancing the customer experience but also give rise to complications as such card skimming, ATM jack potting, black box ATM attacks and so on.This brings us to the rising issue of ATM frauds that are being reported consecutively across the country. A recent Economic Times news report stated that as many as 61 ATM frauds have been reported, mostly from Jadavpur area of Kolkata, where fraudsters used two ATM machines of Punjab National Bank to dupe customers. Fraudsters have withdrawn nearly Rs 14 lakh in several transactions made between November 28 and December 4.

Another event to highlight would be selling of payment card data on Joker’s Stash. Over 1.3 million payment card details – 98% of them being Indian banks’ cards were put up for sale. Out of which 550,000 of these cards belonged to one single Indian bank. The data was being sold at $100 per card, and was likely obtained by using skimming devices installed on ATMs and Point of Sales systems.

These concerning issues and the risks associated along with it led RBI to take a counter-active action. The Reserve Bank of India (RBI) on 5 Dec,2019announced that all RBI-regulated entities entering into a contract with third-party automated teller machine (ATM) switch application service providers (ASPs) need to comply with cybersecurity controls prescribed by the central bank.

Since these service providers also have exposure to the payment system landscape and are, therefore, exposed to the associated cyber threats, the RBI decided that certain baseline cybersecurity controls shall be mandated by the regulated entities in their contractual agreements with these service providers.

In view of this, the RBI regulated entities shall make sure that the contract agreement signed between them and third party ATM switch application service provider shall necessarily mandate the third party ATM switch ASP to comply with cybersecurity controls and also provide access to RBI for onsite/off site supervision. A considerable thing to keep in mind would be that the RBI-regulated entities have to amend their contracts at the earliest or at the time of renewal, in any case not later than March 31, 2020.

‘Defence in Depth’ Demystified -Measures & Security Controls

Posted on by admin

Defence in Depth  (DiD) is a layering ploy, initiated by the  National Security Agency  (NSA) for facilitating an additional layer of information security. In these multiple layers of security measures are implemented within an IT infra with the ideology that if one layer of protection is in exploitation, then the additional layers would mitigate the breach risk. It is a broadened approach that is a unique combination of physical, technical, and administrative controls for security measures. It can be integrated with multiple security measures as it is a multidirectional approach and is not bound to any particular rules or regulations.

Defence in Depth is a magnified approach to set up security and privacy policies against diversified attack vectors.

Counteractive Measures of Defence in Depth :

Security Policies and Procedures- The primary outcome of setting up policies and procedures for an organization is the conservancy of confidentiality, integrity, and availability of systems and information used by organization members

  • Confidentiality involves safeguarding the assets from unauthorized individuals.
  • Integrity provides the modification of assets so that the organization is in a specified and authorized manner.
  • Availability is a state of the system in which authorized users have persistent access to specified assets.

Physical Security – A strategic approach to control physical access to the availability of sensitive information is inclusive in physical controls. Generic measures explored within this control are implementing security personnel such as guards and receptionists, installation of CCTV, automatic door access, and many more.

Perimeter Defences – It’s traditional approach for controlling traffic flowing in and out of the data centre network. Generic measures within this area are the installation of an application firewall, server firewall, and network-level firewall. Additionally, set up Intrusion Prevention System, which controls the network traffic and Intrusion Detection System for monitoring the network traffic.

Network Security – It’s an activity assigned to cushion the usability and integrity of your network(LAN, Optical Fibre, wires, WI-FI). The elemental measures within this area are as following secure your network, audit network regularly, keep O/S Patches up to date, keep Antivirus, and Malware Definitions Current, and establish Policy for Mobile and Wireless Devices.

Logging and Monitoring of Events – Logging is a standardized procedure for making a detailed set of events that occur within the application. Monitoring is analyzing the logged events to check whether the application is working in a prescribed manner. Together logging and monitoring can help you to have clarity of how your applications are working on various infrastructure components.

Logical Controls – Also termed as technical controls, they set up security measures for the software and hardware of the organization. A robust technical control measure would focus on means to identify, authenticate, authorize, or limit the authenticated user to restricted actions.

Workstation Defences – The most basic security measure is the implementation of an updated antivirus system. Other measures to go with would be keeping the application and operating system patched up and updated, assuring the workstation run in limited and administrative mode. Also, assuring that the software updates installed are from verified and genuine source.

Asset Management – Asset management permits an organization to keep a record of the asset, be it tangible or intangible in nature. In an information security environment, an asset is any data, devices, or other components that support information-related activities. Asset management helps you out to assimilate your asset inventory, asset classification, patch classification status, software package version and updates and many more.

Host Security – In layman terms, the host is a computer or any computer device which connects with the network. The purpose of host security is to prevent the host operating system, file system, and it’s resources from unauthorized access. Installation of a host-based firewall is one of the necessary preventive measures.

Session Security – Session security is a branch of information security which restraints the exposure of network when a user leaves the system neglected while still logged in. It also involves establishing several session controls to control session behavior. The standard measures within this area are standardizing default session timeout, control inactive session expiry, and sending a prompt message when the session timeout is reaching out.

Application Security – Calibration of application with certain features and functionalities to the software to prevent threats. Various application parameters must be logged and monitored periodically, encrypt the cookies and set an expiration date. While building the software the organisations should be diligent about software tampering, session tampering and cryptography.

Data Protection – Data protection approach comprises of Data lifecycle management and information life cycle management. Data lifecycle management consists of securing online and offline data storage. Information lifecycle management is a comprehensive strategy for valuing, cataloguing, and protecting information assets from application and user errors, malware, and virus attacks.

After the overall understanding of the security controls, as mentioned earlier, we can break down the formation of a secure information environment by the following described steps.

  1. Establish an Information security policy.
  2. Define and classify assets, business core components, and infrastructure.
  3. Defend at the network edge – Firewall, IDS, IPS, and Antivirus.
  4. Defend within the network edge – secure demilitarized zone, encrypt channels between each communicating devices and establish VPN connection.
  5. Defend the Internal network – implement access control measures.
  6. Defend individual system components.
  7. Train user and impart awareness among the professionals regarding best practices.
  8. Frequently test the infrastructure defences to ensure rigid security posture.
  9. Review plan and improve strategy periodically.

Why Businesses Should Get Compliant With PCI DSS?

Posted on by admin

Over the last few years, ‘data breach’ has been one of the most fearful phrases in the payment industry. We have seen the effect of data breaches time and again over the years, and how it can bring a company down to its knees. In fact, Target’s 2013 data breach is still whispered with fear thanks to contact details of over 70 million customers being hacked. As it was back then and now, the simple question remains – why did it happen and what can be done to ensure it does not happen again?

In the simplest sense, the lack of security or compliance of required security says it all. Over time, experts too have pointed out that a stringent compliance has to be in place when it comes to data security. The answer is PCI DSS. These security standards helps facilitate consistent and remarkable security.

How does PCI DSS compliance help?

Quite simply, having a compliance like payment card industry data security standard will ensure that you have improved controls to reduce payment method frauds. The compliance levels stems right from the storage and the encryption of the credit cardholder, irrespective of the transaction size. How does this help? Well, it protects your company from a breach of data. A  PCI DSS Compliance India  would help your company rise up to the next level because –

A confident customer is a customer forever : Giving your customer the confidence that their data is completely safe on your platform is going to be the foundation for years to come. It is essential to keep your business running and to keep the transactional model flowing.

Keeping your data secure : Information of your company employees, clients and business payment methods, is undoubtedly the most important asset to any organisation. The risk of malpractice can be devastating – so can unauthorized access or hacking. When you have a  PCI DSS consultant  in your team, you can protect this data from any form of access. Not only does that become the strength of your business, but it also protects the value of transaction.

Keeping ahead of the game : Having a standard of this kind implemented in your business keeps you way ahead of the possible threats ahead. It is not only the payment methods or data that you are keeping safe, but you are looking ahead of further possible threats that may be in the way for your business. It gives you that additional push to focus on everything else your business needs to thrive on and will be the driving force to your higher growth. Plus, such a compliance is tailor made for your business as it cannot be implemented with one business model in mind – the specific rules that apply to your industry and business model are unique a massive advantage in today’s game.

2019 What’s In Store For The Payment And Security

Posted on by admin

As we close out the year of 2018, we have to recognise the year gone by as one that brought us closer to existing threats and using technology to counter them. Many industry experts look at many of the fin-tech companies to evolve and reshape the payments landscape in 2019. Rightly so too, keeping these points to expect –

Cyber security is more important than ever

It has been professed that the next World War would be battled out in Cyber space and it seems to be a safe statement to go by. There have been several major leaks of biometric-based data around the world over the last year. Thus, creating a calling for more secure methods of identification and authentication across financial institutions. Access to biometric data could expose pass-codes, touch ID and facial recognitions. Stronger encryption of this data across payment methods are expected to be the biggest change in 2019. In fact, many  payment security specialists  see it as the largest kill upgrade to make.

Faster payment methods

Many expect the following year to bring about faster or real-time payment techniques, with organizations like QRC supporting secure implementations. Of course, these would come by the bigger players in the market since it would require significant investments too improve capabilities in every function department.

Raising the skill- bar

Upscaling in very department would be a mandate. More professionals in the industry would have to acquire deep understanding skills of transactional security – very similar to the  PCI certification  requirements that are expected.

Focusing on service

The past couple of years was heavily driven by the force of Cryptocurrencies and transactions at the point of sale. 2019 is going to be driven harder on tokenisation and with the intent to make transaction safer and easier. The goal would be to expand the payment options at hand for the consumer and the merchants along with reducing processing fees. This would impact on higher revenue and therefore bring a need for better experiences and services – closing this gap is going to be of utmost importance for many companies in the fintech space.

Read more about this: Cybersecurity Compliance and e-Rupee: Need for Strong Measures

The rise of the file-less malware

Everyone has been harping on this for the last few years and we see it to be a differentiator this year too. There has been a consistent rise with file-less malware and many organisations are not equipped to deal with such risks. With this compromise, it is even harder to defend your organisation from such an attack. The rush to prevent may prove to be a first-mover advantage.

AI could go rogue

We all saw the Will Smith starrer ‘A.I’ and never believed it could happen. Well, hold that thought. There’s an obvious threat coming from malicious chat bots that can push you to clicking links or even sharing personal information. Of course, we have seen huge steps of growth in machine learning techniques over the years and even though chat bots do provide to be a helpful layer in customer experience, it can also lead to be an easy way for hackers to hijack the entire system. In the simplest example, imagine a fake chat bot app on your banking website – all hell could break loose. 2019 is going to be the year to block this divide and ensure a safer transactional experience.

PCI SSF: Council’s New Standards for Software Security

Posted on by admin

Over the years, the payment card industry has seen an outburst of incidents in card data theft and security incidents. Reporting as such have become so common, that it has ceded to come as a surprise to the masses. While innovations in the payment solutions have grown rapidly in the recent years, concerns about the same have seen a similar fate. Adhering to this need, back in 2014, the PCI Council released a guidance document titled “Information Supplement: Best Practices for Maintaining PCI DSS Compliance”, that outlined guidance for preserving the PCI DSS Compliance.

PCI SSF: New Standards for Software Security

With growing software innovations and the growing software security incidents, the PCI Security council, adhering to this need, decided to form a framework defining guidance and regulations for secure software payment process (PCI SS) and secure software lifecycle development (PCI SLC) that catered to securing the entire software development lifecycle process

Earlier this year, the PCI Software Security Council, published two stated standards i.e.  PCI SSS  and  PCI SLC  as a part of new  PCI Software Security Framework (PCI SSF).  The new framework takes into account the multiple aspects of software development phases required for developing and maintenance of advanced paymentapplications.

The major components are stated as below, each of the components stands as a separate standard with two approach to software security:

i.  PCI Secure Software Standard v1.0  that defines the multiple security requirements and assessment procedures to ensure the integrity and confidentiality of payment transactions and data.

ii. PCI Secure SLC Standard (Secure SLC) v1.0that defines the security and assessment requirements for the software vendors to be followed and validated through the entire process of creating a payment software through its complete development life-cycle. This ensure that best practices in place in the development of the application.

A third component of the new standards, i.e. the  Validation Framework  is expected to be released in the mid-2019, and is speculated to include details for validation program for software vendors and qualification program for assessors.

Though the program for validation framework is optional, it will be highly encouraged as it puts the software vendor on the PCIL SSC’s list of SSLC Qualified Payment Software Vendors., The vendors qualified under this program can self-attest and perform delta assessments, reducing the QSAinvolvement.

Use of applications validated under PCI SSF standards, will not make an entity PCI DSS compliant or qualifies for compliance under any other PCI standard. Upon successful completion of validation under  PCI SLC,  the software vendors will be added to the List of SSLC-Qualified Payment Software Vendors on the PCI SSC website.­­­

When PA-DSS was developed, software development process followed a very traditional approach, this approach for the software development has significantly changed over the years due to availabilityof multiple development platforms and methodologies. Hence, it is vital to the development of payment solutions to follow a secure methodology and procedure to avoid any security fallout.

New PCI SSF standards, address to this need, by specifying secure key requirement of both the payment procedures as well as the entire application development lifecycle of the solution maintaining software resiliency, addressing robust security design and development practices.

Transition from PA-DSS to PCI SSF

The council had stated that all the materials related to PCI SSF standards i.e. the program guide, the assessor qualification, reporting templates are scheduled to mid-2019.

A three-year adaptation period has been specified as per the validation program, and all the applications will continue to be governed under PA-DSS until its expiration in 2022. At the end of the expiration period, all the PA-DSS applications will be moved to a Pre-Existing Deployments list., and any further updates will need to be assessed under the PCI SSF framework.

Should Vendors Continue with PA-DSS or wait until PCI-SSF
Assessments under PCI SSF will only be initiated until mid-2019, hence application vendors are encouraged to continue to submit changes to currently validated applications via the PA-DSS program.  In case, vendors have already initiated assignments under PA DSS, the council encourages them to complete it under the same.

PCI SSF that will begin in Q3 2019 will have a three-year validation period, thus bringing up the expiry of PA-DSS almost the same time. Components of PA-DSS will then be adapted into PCI SSF in future development and updates in the standard.

Why should Vendor consider getting PA-DSS

Posted on by admin

In today’s modernized world, every aspect of our life is caressed by state-of-the-art technology and its wonders. Likewise, we have also boosted ourselves in the way we handle our money and process our transactions. From a single penny, we have made an astonishing journey to digital money. We are handling all kinds of payments by a single click via payment applications. It’s truly magnificent and a marvellous example of how we have grown.

The payment application we use does render us a flawless payment platform without letting us withstand the hustle we have to pass through traditional banking procedures. Even though the payment application is effortless in their style of work, it gives rise to a hesitation whether our card and personnel data are secure or not. How do these payment applications make sure that our hard-earned money is protected from unethical hackers?

These questions were also the primary concern of all the major card brands such as  VISA, MASTERCARD, AMERICAN EXPRESS, JCB INTERNATIONAL, and  DISCOVER FINANCIAL SERVICES. With the sole purpose of protecting their crucial customer data, these major brands collectively formed a global organization which was termed as PCI SSC (Payment Card Industry Standard Security council). For ensuring secure transaction on payment applications, PCI SSC published a global standard termed as PA DSS (Payment Application Data Security Standard)

What is PA – DSS?

PA DSS is a global security standard which sets requirements and policies intended to establish impregnably sound payment applications and assure user data security.

The standard came into existence on April 15, 2008, and was termed as PA DSS Version 1.1. Since its inception, it has gone through various updations and over the years, Version 1.2, 2.0, 3.0, 3.1, and V 3.2, were introduced. The latest version v3.2 was released on May 2016. In conventional terms, PA DSS is certification affiliated to organizations which adhere to PCI SSC council terms with an assurance that the payment application remains protected.

PADSS standard is formulated to help software vendors develop secure payment applications that process the user data securely. The vendors should conserve critical data as such full magnetic stripe, CVV2, or PIN data etc, and they also need to ensure their payment applications support compliance with the PCI DSS (Payment Card Industry Data Security Standards).

PA DSS makes sure that application must have secure password features, detailed activity logs, additional security for wireless transmissions.  The security controls in place keep a check on multiple aspects of the infrastructure.

PA DSS certification has a validation of three year. After completion of one year, the respective organization has to carry out the revalidation procedure to ensure that it stays compliant and is incorporated as a secure payment platform.

To whom PA DSS is applicable?

For PA-DSS, a payment application eligiblefor review and listing by the PCI SSC is defined as an application that:

a) stores, processes, or transmits cardholder data as part of authorization or settlement and
b) is sold, distributed, or licensed to third parties

How to be PA DSS compliant?

Any organization who wishes to be PA DSS compliant has to choose a PA QSA (Payment Application Qualified Security Assessor). PA QSA is an organization level certification accredited by the PCI SSC. They have the license to perform PA DSS assessment of an organization and implement the standards, requirements, and policies mentioned in PA DSS standard to achieve the same.

Please refer the below link to check the qualified payment application assessor:

https://www.pcisecuritystandards.org/assessors_and_solutions/payment_application_assessors

How will QRC help you achieve PA DSS?

Being a Payment Application Qualified Security Assessor (PA QSA) Company, QRC aims to provide additional pioneering, hassle-free, and cost-effective services for PA DSS Certification. Since its establishment, QRC has served more than 100 plus clients globally in the information security domain. As your PA DSS compliance partner, QRC will assist and assess you at each step right from defining the scope until facing the compliance audit.