PCI standards body moves ahead on payment-application cert

PCI formally launches its payment-application security program

The PCI Security Standards Council, which establishes requirements for the payment-card industry, Tuesday formally launched its payment-application security program.

The Council announced the Payment Application Data Security Standard (PA-DSS) as an effort distinct from its older Data Security Standard 1.1 (DSS 1.1).

DSS 1.1 comprises a list of 12 broad-based security requirements that the payment-card associations and banks, which enforce compliance mandates, ask any business handling credit or debit cards to follow or face consequences, which could include fines or higher fees.

In contrast, the PA-DSS program is intended to cover testing and certification requirements for payment applications sold, distributed or licensed to third parties and installed off-the-shelf without much customization. The Council has published a frequently-asked questions document emphasizing that payment applications developed in-house by merchants or service providers are not subject to the PA-DSS requirements.

PA-DSS entails the Council assuming responsibility for Visa's Payment Application Best Practices program, with the Council's payment-brand membership, American Express, Discover Financial Services, JCB International and MasterCard, backing what had been only a Visa requirement for vendor-developed payment applications.

But more is on tap from the PCI Security Standards Council, says Bob Russo, its general manager. "Later this year we'll be rolling out a new version of the DSS," says Russo, noting this is expected to be in the September timeframe, with a possible 2.0 version.

Russo points out that the revised DSS will basically seek to clarify the 12-point DSS guidelines to answer questions that have come up, which are impacting decisions that businesses are making to comply with DSS 1.1

And there are many.

One security manager for a large US-based bank, who asked he not be named, says it's not clear whether a requirement for "segmentation" of the network for purposes of protecting card data means you have to use a LAN.

In another instance, the DSS 1.1 requirement for firewalls is subject to question. The Jericho Forum, an international organization of about 60 large multi-national companies dedicated to finding innovative e-commerce security methods, believes network firewalls may not be the best approach in all situations involving online collaboration.

Russo says he would be happy to open a dialog on the question of firewalls in order to hear about what could be viable alternatives. He said the Council is receiving input now to grasp the major questions about DSS.

Another change already envisioned for DSS entails making the so-called "6.6 requirement" for application security, now a voluntary process that calls for either buying a Web application gateway or performing a code review, mandatory this June.

Russo said the Council will issue guidance on this in the form of a White Paper next month. It will cover the topics of requirement for application security and explain how "payment application qualified security assessors" (PAQSA) will be named through an accreditation process.

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Ellen Messmer

Network World
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill


I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?