2 Nigerian firms achieve PCIDSS compliance with Trustwave

Only two Nigerian electronic payment and transaction companies are Payment Card Industry Data Security Standard (PCIDSS) compliant.

PCIDSS is a worldwide information security standard assembled by the Payment Card Industry Security Standards Council (PCI SSC).

The Regional Sales Manager, Trustwave, Mr. Andrew Kirkland made this disclosure in a chat with newsmen in Lagos, saying that only Interswitch and Value Card are compliant with the directive which the Central Bank of Nigeria (CBN) gave recently for the banking and electronic card payment sectors for all players along the electronic card payment value chain to be PCIDSS compliant.

Additionally, the CBN had prescribed various applicable consequences to non-compliant organisations.

According to Mr. Kirkland, the duo of Interswitch and ValueCard achieved this PCIDSS compliant through the deployment of Trustwave product.

“In Nigeria, only InterSwitch and Value Card are the only compliant companies. They achieved this using TrustWave,” he said.

He, however, lamented the fact that there is no bank yet on the compliant list as at the time of filing this report.

Online crime compromise, Kirkland said, ranges between $2 and $10 million per organisations, stressing that manner of storage of information could contribute immensely.

He also warned against the idea of sharing identity for data retrievals, noting that PCIDSS is attainable but lots of work needed to be done, just as he advised that CBN take a positive approach, especially in recognizing the fact that PCIDSS is important.

Further, Kirkland said that acceptance of credit cards for payment gave rise to small businesses across, especially in developing countries like Nigeria, saying they should be aware of the risk for theft and fraud, and take action to combat this by certifying with the industry standard for handling credit card data, called the Payment Card Industry Data Security Standard (PCI-DSS).

“The PCI DSS is required for all businesses accepting credit cards,” he explained, noting that the five major card networks, namely American Express, Discover Financial Services, JCB, MasterCard Worldwide, and Visa Inc. established the PCI DSS as a set of requirements for business of all types to use when configuring their Information Technology (IT) and payment-processing environments.

As said by him, understanding the requirements is the first step, hence, some businesses will need IT support to ensure all of the requirements are met prior to taking action to certify compliance.

Kirkland, however, outlined some 12 requirements toward achieving the PCIDSS compliance to include installing and maintaining a firewall configuration to protect data; avoidance of vendor-supplied defaults for system passwords and other security parameters; protect stored data; encrypt transmission of cardholders data sensitive information across public networks; use and regularly update anti-virus software and develop and maintain secure systems and applications.

Other, he said, are the need to restrict access to data by business need-to-know; assign a unique ID to each person with computer access; restrict physical access to cardholder data; track and monitor all access to network resources and cardholder data and regularly test security systems and processes as well as maintain a policy that addresses information security.

Equally speaking, at a one-day session organized by PBCL in Lagos, the country agent of Trustwave, the Managing Director of PBCL, Mr. Peter Ejiofor noted that though CBN has asked every bank to comply by February 2011, there is need to examine the knowledge base.

Apart from the knowledge base required as bulk of what is expected in being compliant, there must be budget and management buy-in.

Further, Kirkland said that acceptance of credit cards for payment gave rise to small businesses across, especially in developing countries like Nigeria, saying they should be aware of the risk for theft and fraud, and take action to combat this by certifying with the industry standard for handling credit card data, called the Payment Card Industry Data Security Standard (PCI-DSS).

“The PCI DSS is required for all businesses accepting credit cards,” he explained, noting that the five major card networks, namely American Express, Discover Financial Services, JCB, MasterCard Worldwide, and Visa Inc. established the PCI DSS as a set of requirements for business of all types to use when configuring their Information Technology (IT) and payment-processing environments.


Remmy Nweke
ITREALMS Online ... delivering news for ICT4D