When you develop websites that collect credit card payments, part of your responsibility is to establish and maintain the sites' PCI compliance.
If followed properly, the Payment Card Industry Data Security Standard (PCI DSS) does an effective job of providing a safe shopping experience for customers. However, achieving compliance is easier said than done, especially for startups and small online retailers.
After reviewing the 200-plus policies, procedures, activities, and technical nuances that make up PCI DSS, most small and startup ecommerce companies will likely choose to outsource portions of their credit-card-payment collection needs. However, each ecommerce company is still responsible for maintaining control over its compliance. Those companies shouldn’t fall into the trap of assuming that someone else is handling their compliance needs.
Important Steps For Ecommerce Developers
Ecommerce developers should learn their responsibilities for PCI compliance matters. To do this, I suggest:
Become educated about the payment card industry mandates, and keep learning as you go.
Identify which portions of the PCI DSS you directly control and which items will be outsourced to third parties. A Qualified Security Assessor can help with this step.
Select service partners that have expertise in protecting personally identifiable information.
Review each service partner's "report on compliance" to make sure there are no unfulfilled requirements or pending remediation for critical items.
Merchants Are Responsible
The ecommerce retailer is the first and most pivotal piece of the PCI compliance pie because the company is legally liable for breaches.
In fact, PCI DSS requirement 12.8 states that if cardholder data is shared with service providers, the retailer must maintain and implement policies and procedures to manage service providers. This includes:
12.8.1 Maintain a list of service providers.
12.8.2 Maintain a written agreement that includes an acknowledgement that the service providers are responsible for the security of cardholder data the service providers possess.
12.8.3 Ensure there is an established process for engaging service providers including proper due diligence prior to engagement.
12.8.4 Maintain a program to monitor service providers’ PCI DSS compliance status.
Remember that a merchant's security foundation is only as strong as the weakest link in its PCI compliance checklist, regardless of whether the link resides within its control or in the hands of a service provider it has chosen.
Limit System Access: Who Is Responsible for What
Requirement 7.1 states there should be limited access to system components and cardholder data. Only those individuals whose job requires such access should have it. Access limitations must include the following:
7.1.1 Restriction of access rights to privileged user IDs to the least privileges necessary to perform job responsibilities
7.1.2 Assignment of privileges is based on individual personnel’s job classification and function
7.1.3 Requirement for an authorization form signed by management that specifies required privileges
7.1.4 Implementation of an automated access control system
Implementing Requirement 7.1
Requirement 7.1 has several implications. They are:
The ecommerce retailer should oversee:
Granting privileges for acceptance (and procedures for disposal) of credit card information received via phone, fax, or email.
Granting permission for service reps to retrieve and input payment card information into the point of sale system if/when a “glitch” with the web application occurs.
Ecommerce application developers are responsible for developing and maintaining the web–to–database “tunnel” through which credit card information flows. Therefore, the web developer’s piece of the pie includes:
Granting privileges for developers to create, test, and troubleshoot data provider connections that feed credit card information from the web application to the database (and potentially API connections that feed credit card information into a payment processing gateway).
Granting privileges for managing encryption keys, and encryption key creation and retirement.
Assigning emergency response chain of command and establishing who should and can access the systems if and when a malfunction occurs.
Assigning encryption key holder responsibilities.
The hosting provider definitely has access to the cardholder data. Therefore, requirement 7.1 applies to hosting providers as well. In this case, the hosting provider owns:
Granting privileges for physical access to data storage devices containing cardholder data, but also restricting specific access points to be only accessible to the tenant.
Assigning an emergency response chain of command that is an extension of both other parties’ emergency response chains to authenticate and respond to requests originating from other parties’ policies and procedures.
Restricting all access to key containers, repositories or other encryption key storage devices to the tenant to whom the keys belong.
Summary
Fortunately, ecommerce developers are not alone in deciphering the PCI compliance rules. Understanding which party owns what piece of this compliance pie is a something that takes time and know-how..
Once you become familiar with the standard, it will be easier to define which of the PCI compliance standards fall within your area of responsibility and which should be shared among the various parties responsible for providing the safest online shopping experience.
