Online businesses face credit card security deadline

The deadline is fast approaching for companies that conduct business online to have to comply with a common set of security requirements outlined last year by major credit card companies.

In an effort to combat fraud, identity theft and other security issues, American Express, Discover, MasterCard, Visa and others created the Payment Card Industry (PCI) data security standard. PCI, which goes into effect June 30, consists of 12 technology requirements for securing networks and applications, protecting cardholder data, maintaining a vulnerability management program, and regularly validating compliance via a third-party assessment.

For e-commerce merchants, including retailers, payment processors and financial institutions, the standard could make life easier by consolidating what in the past have been a bunch of different security guidelines from credit card companies. However some merchants are ill-prepared to meet the compliance deadline, experts say.

The PCI rules apply to retailers, payment processors and financial institutions - essentially any business that stores, processes or transmits cardholder data. The card associations have laid out varying enforcement policies and penalties for non-compliance, depending on the volume of transactions a merchant or service provider processes. The largest players could face up to $500,000 in fines per incident if cardholder data is compromised and the merchant or service provider is not PCI-compliant. In addition, the card associations can cut off non-complying companies' credit card processing privileges.

The June 30 deadline came as something of a surprise for Jelly Belly Candy Company, admits Gary Praegitzer, network administrator and security specialist at the Fairfield, Calif., candy maker. But the company is in good shape to comply. Over the last few months it has used security scanning services from Qualys to find and fix a few encryption-related vulnerabilities - such as making a minor server configuration adjustment to disallow low-level encryption settings. But Jelly Belly has not had to make any expensive IT investments to comply with the PCI standard, Praegitzer says.

Jelly Belly is fortunate. For many online businesses, coming into compliance could be costly, depending on the conditions of their existing systems. David Glaser, director of professional services at electronic payment and risk management vendor CyberSource, estimates that as of April or so, the majority of U.S. merchants were only about 30% prepared for a PCI compliance audit. "There can be a lot of work to do," Glaser says.

Particularly for smaller merchants, PCI compliance might require purchasing security products, such as encryption, access control, and activity monitoring and logging devices. There are also procedural mandates - such as the need to implement formal security policies and vulnerability management programs - that will require IT resources.

Once the security systems and policies are in place, companies will need to submit to annual or quarterly audits by a PCI-certified assessor to validate compliance.