{"id":11390,"date":"2019-08-15T17:34:53","date_gmt":"2019-08-15T21:34:53","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=11390"},"modified":"2023-04-07T13:01:18","modified_gmt":"2023-04-07T17:01:18","slug":"demystifying-pci-dss-compliance","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/demystifying-pci-dss-compliance\/","title":{"rendered":"Demystifying PCI DSS Compliance"},"content":{"rendered":"\n

As far as compliance goes, PCI DSS isn\u2019t as onerous as it seems<\/h2>\n\n\n\n

Compliance is, without a doubt<\/a>, the biggest concern for most organizations when they\u2019re handling their certificate and key management duties<\/a>. Whether it\u2019s PCI DSS compliance, GDPR, HIPAA or any other regulatory framework, non-compliance is anathema to most companies, it can result in lost trust and massive financial penalties. <\/p>\n\n\n\n

And frankly, if I had to guess I\u2019d say that\u2019s why compliance\nranks so highly amongst enterprise concerns. Other ramifications of poor security\nor certificate\/key management don\u2019t have as obvious an effect. A data breach or\na compromised key can cause a ton of damage, but that damage is harder to\nquantify in real time. Compliance penalties are known quantities, \u201cif we don\u2019t\ndo X, we get fined Y.\u201d <\/p>\n\n\n\n

That\u2019s easy to understand, and it\u2019s easy to explain to the C-suite and upper management. If I come into your office and try to explain what could happen if a certificate expires<\/a> it requires a much longer explanation \u2013 and more attention from the person you\u2019re explaining it to \u2013 than simply stating we\u2019ll get fined $10,000 for not doing something.<\/p>\n\n\n\n

Anyway, today we\u2019re going to talk about Payment Card Industry Data Security Standards (PCI DSS) and try to demystify it a little bit. As far as compliance goes, PCI DSS compliance really isn\u2019t all that onerous. In fact, it\u2019s actually pretty straightforward. So let\u2019s talk about PCI DSS, how you can make compliance with PCI DSS easy and what happens if you decide it\u2019s too much trouble.<\/p>\n\n\n\n

Let\u2019s hash it out.<\/span><\/p>\n\n\n<\/span><\/span>\n\n\n

PCI DSS: Protecting Payment Card Information<\/h2>\n\n\n\n

When we talk about sensitive data, payment card information is among the most valuable<\/a>. That\u2019s for pretty obvious reasons. So, it makes a lot of sense that the payment card industry would want to put certain requirements in place to safeguard it. We\u2019ve seen what can happen when payment card info gets compromised thanks to breaches like Equifax\u2019s<\/a>. <\/p>\n\n\n\n

The Payment Card Industry\u2019s Security Standards Council is comprised of all the biggest creditors in the world:<\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n
    \n
  • Visa<\/li>\n\n\n\n
  • American Express<\/li>\n\n\n\n
  • Mastercard<\/li>\n\n\n\n
  • Discover<\/li>\n\n\n\n
  • JCB International<\/li>\n<\/ul>\n\n\n\n

    Basically all the major credit card companies. It\u2019s the PCI SSC that determines the PCI DSS compliance requirements (today we dine on acronym soup). And that\u2019s what makes these rules binding, if you want to accept payment cards from these companies you\u2019ll need to follow their rules. They\u2019ve all incorporated PCI DSS into the technical requirements for each of their respective compliance programs and expect any company that accepts payment through their cards to follow them.<\/p>\n\n\n\n

    \n