19473_Authority_Oct-opt

1 4 dŚĞ ƵƚŚŽƌŝƚLJ │ October looking at the whole cardholder data environment (CDE). This includes both the system components that process, store, and transmit sensitive data and those that may not but still connect to system components. It is important to work closely with your web host to ensure the security of your PCI senstive data. Many of the requirements to pass a PCI DSS scan are beyond the average person’s understanding. However, some of the principles are just good cybersecurity hygiene practices. • Build and Maintain a Secure Network and Systems – The server on which your website or payment gateway lives is likely out of your hands. You are at the mercy of your service providers to pass this portion of your PCI DSS scan. • Protect Account Data – The less data you have to store, the better. If you do have to collect and store sensitive data, make sure you employ good cybersecurity practices to ensure user privacy. • Maintain a Vulnerability Management Program - Find and fix known security weaknesses before they can be exploited. This task may be best suited for your IT team or web host since many of these items are technical in nature. • Implement Strong Access Control Measures – Create a cybersecurity policy with directives about who has access to what and stick to it. • Regularly Monitor and Test Networks – Testing and monitoring networks should be left to IT professionals. It is important to partner with someone you can trust. • Maintain an Information Security Policy – A security policy is a document often overlooked by smaller organizations, but it is an essential step in keeping sensitive data secure. It is important to note that a municipality or authority may store no cardholder data, process no cardholder data, and simply provide a link to a third-party payment processor and still be required to complete an SAQ, undergo quarterly ASV scans, and provide PCI validation documents. Requirements vary by payment processor, acquiring bank, and payment method, especially if the bank takes a conservative approach to payment data. Common reasons banks require scans even for municipalities that link out to a payment processor include: • A compromised website could alter payment links. • Malicious JavaScript could redirect users to a fraudulent payment page. • Users perceive the payment process as being associated with the municipality, regardless of where the transaction is ultimately completed. How does a PCI DSS scan work? PCI vulnerability scans are typically performed by an ASV using specialized security software that checks public-facing systems for known vulnerabilities, missing updates, insecure configurations, and other weaknesses that could expose payment card data. The ASV reviews the findings and provides a compliance report documenting whether the scanned systems meet PCI requirements. Organizations that are required to perform PCI vulnerability scanning typically undergo external scans at least quarterly and after significant changes to their payment environment. Scan results are reviewed to identify and remediate known vulnerabilities before compliance validation is completed. ASVs all operate under the same PCI SSC program requirements, but in practice, no two scanning tools interpret every finding identically. One ASV's scan engine may flag something another would not, or apply more or less leeway on borderline results. What if you do not pass a scan? Failing a PCI scan is common and frustrating, but not catastrophic. The ASV will send a report listing your specific violations or vulnerabilities. Your IT team or web host will address them. Then, you can request a rescan. This process repeats until you pass the scan. If your authority or IT support team believes the result is a false positive (the scan should have passed but has failed), there is a formal dispute process with the ASV. It helps to have a knowledgeable IT person in your corner to debate the ASV so that you are not stuck accepting everything they say at face value. Note: Should you fail a scan, you cannot switch ASVs to fish for a better outcome. You are locked into that specific ASV until you pass or drop it altogether. The system is built specifically so you cannot avoid failing results by finding a buddy who will pass you. Y OUR MUNICIPAL AUTHORITY SHOULD NOT BE DETERRED FROM ACCEPTING PAYMENTS ONLINE . R ATHER , YOU SHOULD TAKE STEPS TO ENSURE THE SECURITY OF YOUR CUSTOMERS ’ DATA THROUGH GOOD CYBERSECURITY . ŽŶƟŶƵĞĚ ŽŶ ƉĂŐĞ ϱϵ͘