Skip Links

Network World

  • Social Web 
  • Email 
  • Close

Online businesses face credit card security deadline

By Ann Bednarz , Network World , 06/13/2005

The deadline is fast approaching for companies that conduct business online to have to comply with a common set of security requirements outlined last year by major credit card companies.

In an effort to combat fraud, identity theft and other security issues, American Express, Discover, MasterCard, Visa and others created the Payment Card Industry (PCI) data security standard. PCI, which goes into effect June 30, consists of 12 technology requirements for securing networks and applications, protecting cardholder data, maintaining a vulnerability management program, and regularly validating compliance via a third-party assessment.

For e-commerce merchants, including retailers, payment processors and financial institutions, the standard could make life easier by consolidating what in the past have been a bunch of different security guidelines from credit card companies. However some merchants are ill-prepared to meet the compliance deadline, experts say.

The PCI rules apply to retailers, payment processors and financial institutions - essentially any business that stores, processes or transmits cardholder data. The card associations have laid out varying enforcement policies and penalties for non-compliance, depending on the volume of transactions a merchant or service provider processes. The largest players could face up to $500,000 in fines per incident if cardholder data is compromised and the merchant or service provider is not PCI-compliant. In addition, the card associations can cut off non-complying companies' credit card processing privileges.

The June 30 deadline came as something of a surprise for Jelly Belly Candy Company, admits Gary Praegitzer, network administrator and security specialist at the Fairfield, Calif., candy maker. But the company is in good shape to comply. Over the last few months it has used security scanning services from Qualys to find and fix a few encryption-related vulnerabilities - such as making a minor server configuration adjustment to disallow low-level encryption settings. But Jelly Belly has not had to make any expensive IT investments to comply with the PCI standard, Praegitzer says.

Jelly Belly is fortunate. For many online businesses, coming into compliance could be costly, depending on the conditions of their existing systems. David Glaser, director of professional services at electronic payment and risk management vendor CyberSource, estimates that as of April or so, the majority of U.S. merchants were only about 30% prepared for a PCI compliance audit. "There can be a lot of work to do," Glaser says.

Partner Content

Brilliantly simple security and control solutions for email, web and endpoint

www.sophos.com

Stopping data leakage

Learn how to exploit your current security investment to control the information that flows into, through and out of your network.

Download the white paper.

Why detection rates aren't enough

Evaluating endpoint security products is a time-consuming and daunting task. Learn the six critical questions you need to ask prospective vendors to get the right endpoint solution.

Download the white paper.

Applications: taking back control

Employees installing unauthorized applications is a growing threat to business security and productivity. Cost-effectively reduce this threat by integrating control into your malware protection.

Learn more today.

Comments (1)
Login
Forgot your account info?

Re: Online businesses face credit card security deadlineBy Anonymous on July 2, 2007, 4:07 amDo hosting companies already supporting the new credit card standard? Jim http://www.credit-card-faq.com

Reply | Read entire comment

View all comments

Add comment
Anonymous comments subject to approval. Register here for member benefits.
Have a NetworkWorld account? Log in here. Register now for a free account.

Videos

rssRss Feed

Whitepapers

Magic Quadrant for Application Delivery Controllers

Gartner summarizes its view on Application Delivery Controllers, evaluates strengths and weaknesses...

Vulnerability Management For Dummies

Download this concise book "Vulnerability Management for Dummies," to learn about the simple steps...

The ROI and TCO Benefits of Data Deduplication for Data Protection in the Enterprise

This paper examines and quantifies the costs and benefits of backup with deduplication storage as...

Webcasts

Transforming the Enterprise WAN Edge: Video from Cisco

Life on the edge of your WAN has changed dramatically. With the need to deliver advanced services,...

PoE Plus: Impact on the PoE Market

The standard for Power over Ethernet (PoE), IEEE Std. 802.3af(tm)-2003, advanced networking,...

Harnessing the power of communications to increase workplace performance

Due to the convergence of IT and telecommunications technologies, the business workplace has been...

Special Reports

The Evolution of Network Security

We have so many holes punched in our firewalls today that many industry insiders question the value...

The self-managed network

We aren't there yet, but advances in network and systems management tools are making it possible to...

Get instant email notification when white papers, webcasts, executive guides are added to our library. Stay informed and up-to-date with the latest on IT Technologies with Network World's Resource Alerts.