Tag Archive | "pci dss"

Franchise models, responsibilities, and the Impact on PCI Compliance


An interesting post from blog.elementps.com on the difficulties of franschise models and their impact on the paths of responsibility for PCI DSS compliance.

From a branding standpoint, franchisors have a lot to lose if one of their franchisees falls victim to a breach.  Depending on the level of media attention the breach garners, one for a store in downtown Philadelphia has the potential to negatively affect the brand – and, arguably, sales— across the state, regionally or even nationally.

The interesting thing with franchising and PCI DSS is that while franchisees may have individual merchant accounts with the bank (and therefore be responsible for their own reporting) the impact of a breach on the franchisers compliance may come up for question if a breach was to occur, as well as the inevitable brand reputation loss…

I’d be interested to here any feedback from the field on the topic.

Reblog this post [with Zemanta]

Posted in UncategorizedComments (0)

Visa Releases Global Data Encryption Best Practices


Visa Debit logo
Image via Wikipedia

Here’s an excerpt of the release from Visa

The marketplace has expressed a growing interest in pursuing data field encryption (also known as end-to-end encryption) of card data. Data field encryption protects card information from the swipe to the acquirer processor with no need for the merchant to process or transmit card data in the “clear.” Importantly, data field encryption renders cardholder data useless to criminals in the event of a merchant data breach.

The full clarification can be downloaded here, and a “softer” version with sum executive summary style information here.

Kudos to Visa for seeking to clear this issue up a bit.

Reblog this post [with Zemanta]

Posted in EncryptionComments (0)

Pentesting vs Vulnerability Assessment – A Simple Definition


Found a very neat and succinct way of defining the difference between VA and Pentesting.


During a vulnerability assessment an environment is assessed to determine if known vulnerabilities can be identified. Penetration testing goes a step further by attempting to exploit these identified vulnerabilities.

The difference between the two, in terms of identifying a need within an organization, is that vulnerability assessment can be achieved using automated tools, whereas penetration testing generally can not.

Why this is important is that vulnerability assessment and penetration testing are addressed as separate requirements of the PCI DSS… Doing a VA will not address the pentesting requirement, and vice versa.

Reblog this post [with Zemanta]

Posted in DefinitionsComments (2)