Unless
you have been living under a rock, you have probably heard about it in
the news... Heartland Payment Systems had somewhere around 130 MILLION
credit card number stolen from their network systems.
(For more details, you can read
THIS
article).
This should be yet another wake-up call for any customer that has been
putting off PCI Certification, or has simply dismissed it as "not
pertaining to them".
With Heartland's hack leaving a VERY LARGE black eye on the credit card
processesing world, the credit card providers of the world are
ratcheting down ever more tightly in the universe. It's
becoming more and more obvious to us that the credit
card world is
becoming less and less tolerant of bad security practices, and
is taking more steps to shine some light into crevices that previously
went unchecked in terms of credit card processesing and storage.
Translation:
it's only a matter of time before that spotlight
shines on your operation.
From DataWedge's standpoint, as a software vendor and services supplier
to our BUSINESSES that also process credit cards, our security criteria
is a HUGE expense of time and energy. To certifiy our
software and processes takes not only continual changes to our software
development policy, but also AUDITS of our source code and software
development life cycles, as well as VISITS and INSPECTIONS to
our data centers and credit card storage locations.
What originally we planned as taking our company a few short months to
complete has taken us the bulk of a year, as well as several
operational overhauls and data-center changes. By the end of
2009, we believe we will have finally completed the process of
PCI LEVEL 1 and
PA-DSS
certifications in regards to our processing environment and data
center hosting.
The cost of our PCI and PA-DSS certifications are going to cost our
company
tens-of-thousands
of dollars over the next few years... all because we DEAL
WITH CREDIT CARDS.
If this is intended to scare you a bit, then that's good... because
shortly after the spotlight is done being shined on OUR level of the
industry (Levels 1,2 and 3), it will start shining on YOUR level of
the industry (Level 4 and below).
As a software vendor, we are forced to certify to a higher standard
than our customers. (Consider it the "trickle-down" theory of
credit card processesing).
But our certification levels have next to ZERO OVERLAP with your
business or operation as far as PCI compliance is concerned.
Just because you are running software that is "PCI Compliant" doesn't
mean anything if your company has also not certified.
It's also important to remember that PCI-Certification has MUCH LESS to
do
with the software you use, and MUCH MORE to do with your network
operating environment and operational security. (As an
example: running PCI complaint sofware does you no good if
your SQL Server with all of your credit card data is located in the
middle of a room where anyone could simply walk out the door with the
machine).
The due date for PCI Complaince for ALL LEVELS is July of 2010.
At this point, all merchants that fall into ALL categories of
processesing must demonstrate PCI Complaince for their processesing
level.
If
you have NOT paid attention to PCI Complaince, NOW IS THE TIME.
Visit our discussion forums at:
http://forums.datawedge.com,
and go through the PCI Compliance section... in there you will find
where we have "translated" many of the questions into a much-more
readable form of text...
FIND AN NETWORK/IT PERSON... one of the misconceptions is that
"DataWedge can
just 'do this for you'". Remember that only a SMALL part of
PCI-Compliance has to do with software. The remainder has to
do with you NETWORK, your OPERATIONAL SECURITY, your INFRASTRUCTURE...
all of these items are things that are well-outside anything that
DataWedge has any local knowledge of in reference to your office and
policies.
DataWedge Sample Site.
