Verifone download needed no go variable
Verifone: “EMV Is No Cure-All”
Payment Card Industry Data Security Standard (PCI DSS 3.0) was put in place to take things up a notch in the pursuit of safeguarding and improving the security of card transactions.But that’s not enough, says Joe Majka, VP and Chief Security Officer of Verifone, who spoke with PYMNTS last week.Security officers at firms large and small should go over and above what is codified to help make sure payment card data is as secure as possible, and should not let EMV lull them into a false sense of security.PCI DSS 3.0 traces its genesis to late 2017, when the standards were first published and then took effect in January of 2014. Among the standards first issued, several were tagged with the designation as “best practices, ” and beginning this summer — 2015 — those best practices have now become requirements for merchants and providers across the payments landscape.“Each of these new requirements is important to ensuring a more secure environment for handling payment card data, ” notes Majka. “However, it’s just as important to realize that PCI DSS itself is merely one very important aspect of a multi-layered approach [to security].”First, players in the payments arena should be aware of, and embrace, what may be viewed as among the more pressing mandates. Included in that group, maintains Majka, are the following:
- Section 6.5.10, which requires implementation of software development policies and procedures to verify that broken authentication and session management are addressed with appropriate coding techniques.
- Section 8.5.1, mandating that service providers with remote access to customer premises must “use and verify” that different authentication credentials are used for each and every customer.
- Section 9.9, stipulating corporate policies ensure protection of card-reading devices that capture payment card data used in card-present transactions.
- Section 11.3, tied to “penetration testing” from both inside and outside the network and validation of any segmentation and scope-reduction controls.
