Six Goals of PCI-DSS [Overview for PCI Compliant Hosting]

When working with credit cards and payment information, one has to be sure that all customer data is safe and secure.

PCI Compliance enforces proper security rules for any business that handles sensitive credit card online.

According to a Pew Internet study, 79% of Internet users worry about how their personal information is being used online by companies, and a full 59% have little to no understanding about what may happen after their data is collected.”

One way to protect your customers’ sensitive data is through PCI Compliance.

What is PCI Compliance?

PCI Compliant web hosting helps protect you and your customers from the hazards of working with sensitive data online. PCI Compliance enforces strict guidelines to make sure all credit card data is protected securely and properly.

This limits the need to worry about a 3rd party intercepting data directly from your network, because you are following a well-thought-out compliance ruleset, and leaves you to work on other security implementations for your organization.

While PCI Compliance doesn’t protect you from all security woes, by having to legally abide by the rules set out by the PCI Standards Council, you are able to make sure the most vital items are checked off your list when handling sensitive credit card data.

What is PCI Compliant Web Hosting?

When hosting websites or servers that take or process credit card transactions, there are certain server-level requirements that must be adhered to. The PCI Data Security Standard (DSS) was created to set the requirements needed of a web-server and it’s network or hosting provider.

This standard requires that a secure network must be built and maintained, with proper firewalls and no default passwords. Anti-virus must be installed an up-to-date, payment transactions are encrypted, and network resources must be regularly tested and monitored for compliance and security issues.

While part of PCI Compliance will be your responsibility or the responsibility of your organization, if you are not actually serving web content and are using a service or hosting provider such as Liquid Web, there are certain security implementations that can only be implemented on the network end of the web server, such as hardening routers and updating web server operating systems.

Six Primary Goals in the PCI-DSS

There are 6 primary goals of the PCI Data Security Standard, broken down into 12 sub-groups that are required for compliance.

These requirements are as follows:

Build and Maintain a Secure Network

1. Install and maintain a firewall configuration to protect cardholder data
2. Do not use vendor-supplied defaults for system passwords and other security parameters

Protect Cardholder Data

3. Protect stored cardholder data
4. Encrypt transmission of cardholder data across open, public networks

Maintain a Vulnerability Management Program

5. Use and regularly update anti-virus software or programs
6. Develop and maintain secure systems and applications

Implement Strong Access Control Measures

7. Restrict access to cardholder data by business need to know
8. Assign a unique ID to each person with computer access
9. Restrict physical access to cardholder data

Regularly Monitor and Test Networks

10. Track and monitor all access to network resources and cardholder data
11. Regularly test security systems and processes

Maintain an Information Security Policy

12. Maintain a policy that addresses information security for all personnel

Not all hosting is or can be PCI Compliant. Ask your web host for more information on their compliance!

When Don’t I Need PCI Compliance?

Your site may offer eCommerce shopping or take payments for services, but if you are using a 3rd party form to submit transactions, you may not be responsible for all facets of compliance.

Payment processors like Paypal or Escrow.com handle PCI Compliance on their end. Because you are using their secured forms, your site does not actually process card information and does not require additional security implementations, specifically.

However, it is important to note that every online business does need to be PCI compliant, and just because a third-party is handling some aspect of the compliance, this doesn’t mean there is nothing for you to do.

Remember, all credit card transactions will be PCI Compliant, you just may not have to do it yourself.”

Be careful though, you don’t want to be in a position where you think you are secure but do not actually follow compliance. It is always recommended to go through the steps to be sure you are offering a secure platform for your users and customers.

How Does Liquid Web Help Me with PCI Compliance?

Websites that request and store sensitive information from their customers are required to take certain precautions to protect data by following the PCI Data Security Standard for infrastructure and server configuration.

While many of the requirements are wholly your responsibility (assigning unique ID’s to each person with computer access, for instance), Liquid Web assists in many ways, such as installing a firewall and providing an SSL Certificate.

Additionally, Liquid Web can assist the customer in other requirements like suggesting strong password policies and anti-virus software to be installed.”

The required Self-Assessment Questionnaire (SAQ) will help you to ensure that all of the above requirements have been met. You must also complete an Attestation of Compliance.

Liquid Web helps you throughout this process and can show you what needs to be answered or how it needs to be addressed. See our Knowledge Base for more information on the SAQ and Attestation of Compliance forms.

While Liquid Web cannot complete these documents for you, we will assist in any way we are able. In addition, because PCI compliance is an ongoing process, our PCI Compliance scans are performed regularly to ensure that the services are kept up-to-date and any new security vulnerabilities are resolved immediately.

It is recommended to consult with a certified Auditor in order to ensure your application will be compliant. Our fully managed scanning service verifies your compliance with the Payment Card Industry Data Security Standard (PCI DSS) Council. See our Knowledge Base for more explicit information on how to ensure your electronic payments are PCI DSS compliant.

PCI Compliance, a Vital Standard in Today’s Tech-Driven World

The importance of PCI Compliance cannot be understated, especially with a growing number of consumers raising concerns about the safety of their data online.

If your website stores, processes or transmits any sensitive customer data, protecting it from security vulnerabilities is of the utmost importance. With this in mind, Liquid Web’s security team is prepared to help your business become compliant with PCI security standards.

Every day we see more and more server hacks in the news. If your business were to be compromised, having strong security in place can help reduce the potential of loss to your business and to your clients.

PCI Compliance will help your customer’s sensitive data stay safe amidst a breach or an attack on your internal network.

Ready to Get Started?

Our Helpful Humans are ready to get you and your business up to code and handle payments from around the world. If you’d like to learn more about our Scanning Service for PCI Compliance and how your website can better protect your customers’ sensitive data, call our team at 1-800-580-4985.