PCI-DSS is gaining momentum – Ejiofor

The recently introduced Payment Card Industry Data Security Standard (PCI DSS), is gaining momentum within the nation’s electronic and data security sub-sector, especially for companies that refuse credit cards.

Chief Executive Officer, Priceworth Business Connections Ltd, Mr. Peter Ejiofor, made this observation at the weekend in Lagos, describing PCI DSS as primarily a contractual agreement between the major credit card companies and enterprises that accept and process credit cards.

The standard, he said, is defined by the Payment Card Industry Security Standards Council, was put in place as a means of ensuring that personally identifiable information (PII) is protected.

Today, he said, there is a veritable data security standards to which companies could adhere to, but because of its prescriptive nature, PCI DSS seems to be catching on as a viable option for companies that do not take credit cards.

He cited an example, saying that rather than simply stating that a firewall for web applications needs to be in place, PCI DSS describes in detail exactly what is required and how to configure it.

He also said that for many companies that process credit card data, the requirements of the Payment Card Industry Data Security Standard (PCI DSS) are all too familiar.

“But should companies that do not process credit cards implement the same data security restrictions,” he asked?

Ejiofor noted that some experts had argued that PCI should be adopted as a best practice by those not required to comply with the standard, stressing that PCI DSS requires firms to continue to monitor their network not as a project with a start and end date.

“Unlike other standards mandating technology usage – such as ISO 27001, which oftentimes uses vague language, such as ‘appropriate’ PCI DSS is far more specific and not open to user interpretation,” he said, adding that even small or midsized companies do not process credit cards should consider implementing PCI DSS, because even small companies have PII.

He prescribed two ways to ensuring compliance with the standard including that a qualified security assessor (QSA), who has been certified by the PCI Council as being qualified to assess compliance to PCI DSS, could inspect a company and either certify or deny it.

For smaller companies, he said, self-certification is an option, but for this, a checklist is used to ensure that all of the key components of the standard have been implemented.

He pointed out that before now, experts have cautioned that a self-analysis is sometimes inadequate, checklist-based analysis of security is not appropriate for an ongoing process, such as protecting corporate data.

“A checklist might provide basic information, but it does not take into consideration wider-ranging issues about protecting data, including ensuring that the auditing of the security system is done separately from the team that is responsible for the data security itself,” he said.

Maintaining that the checklist mentality treats a business like a board game, but steps must be taken to ensure data is protected by every organization handling personally identifiable information.

Remmy Nweke
ITREALMS Online ... delivering news for ICT4D