+ Enlarge
	Chakri Devarakonda

• Requirement 1: Install and maintain a firewall configuration to protect cardholder data
  
  
• Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters
  
  
• Requirement 3: Protect stored cardholder data
  
  
• Requirement 4: Encrypt transmission of cardholder data across open, public networks
  
  
• Requirement 5: Use and regularly update anti-virus software
  
  
• Requirement 6: Develop and maintain secure systems and applications
  
  
• Requirement 7: Restrict access to cardholder data on a need-to-know basis
  
  
• Requirement 8: Assign a unique ID to each person with computer access
  
  
• Requirement 9: Restrict physical access to cardholder data
  
  
• Requirement 10: Track and monitor all access to network resources and cardholder data
  
  
• Requirement 11: Regularly test security systems and processes
  
  
• Requirement 12: Maintain a policy that addresses information security

• The merchant or service provider engages with an ASV to perform the PCI DSS scanning service;
  
  
• The merchant provides the ASV with information about their network perimeter. Any special requirements like exclusion or justification of specific services are taken into account as part of this step;
  
  
• The ASV scans the merchant’s network perimeter from a remote site using non-intrusive tests;
  
  
• The ASV determines compliance based on the vulnerabilities found during the assessment. This is benchmarked against the scoring matrix provided by PCI DSS;
  
  
• The ASV produces a report containing the PCI DSS status of each scanned network component with recommendations to address the vulnerabilities;
  
  
• The ASV and the merchant shall review the vulnerabilities together and apply suggested fixes to mitigate any perceived risk and maintain compliance to PCI DSS.

• By complying with PCI DSS, an organization has taken the appropriate steps to ensure that its customers and their data are secure;
  
  
• One of the benefits of PCI DSS compliance is that the organization will not face a severe penalty if their services are breached. If the analysis after a security incident shows that the company was still compliant at the time of the incident, this will result in lenient treatment by the authorities;
  
  
• More importantly, if your company is a Level 1 or Level 2 merchant, you may be eligible to receive part of the $20 million in financial incentives from Visa;
  
  
• By obtaining PCI DSS compliance status, an organization can attract discounts on transaction costs from the credit card companies.

Durga Prasad Adusumalli

About the Authors

Chakri Devarakonda works as an Associate Manager, Technical Services at AppLabs, a global IT services company. His responsibilities include handling Security Services, which offers web application penetration testing engagements, product security testing, and network security assessments.

Durga Prasad Adusumalli is a Team Leader, Security Services at AppLabs, a global IT services company. He has over four years experience in Layered Security and Network Assessments.

For more information about Applabs please email info@applabs.com or visit www.applabs.com.