PCI clarifies procedures to secure Wi-Fi

Share this article:
The group charged with administering the Payment Card Industry Data Security Standard (PCI DSS) has begun issuing guidance documents that merchants can use to help them better understand and adhere to payment security standards.

On Thursday, the PCI Security Standards Council published its first installment: a 33-page paper for clarifying how retailers should secure their wireless internet environment.

“The guidelines are not there to add any new control objectives to the DSS requirements," Doug Manchester director of product security for payment technology vendor VeriFone Holdings, told SCMagazineUS.com on Thursday. "It's more intended to help explain what's required."

Manchester chaired the special interest group responsible for the document.

Among its goals, the document is intended to remove any confusion or ambiguity as to what is required so that qualified security assessors (QSAs), responsible for assessing merchant compliance with the PCI DSS, and retailers have a common understanding, Manchester said. All retailers that are using Wi-Fi in their business – even those that do not transmit payment card information over the wireless network -- should read the document, Troy Leach, technical director for the PCI Security Standards Council, told SCMagazineUS.com Thursday.

Retailers that use Wi-Fi  but do not use it to transmit payment card data, must ensure -- and be able to demonstrate -- that their wireless network is fully segmented from the sensitive cardholder data, Manchester said.

“We have seen in the past that that's a common weak point of an organization's security system and a primary target,” Manchester said. “Even if it's not transmitting cardholder data, you still need to protect it, and make sure that network doesn't bleed into the cardholder data environment.”

Retailers using their Wi-Fi network to transmit payment card data must ensure that the appropriate level of encryption is used, Manchester said. The guidelines recommend retailers enable WPA or WPA2 encryption, which has replaced the weaker Wired Equivalent Privacy (WEP) standard. Also, retailers must maintain the physical integrity of the devices and have logging capabilities and intrusion prevention features.

Other PCI special interest groups are working to provide clarity about other parts of the DSS that were deemed challenging to retailers -- areas such as scoping, virtualization and pre-authorization.
Share this article:
You must be a registered member of SC Magazine to post a comment.

Next Article in News

Sign up to our newsletters

More in News

Beazley: employee errors root of most data breaches, but malware incidents cost ...

Insurance firm Beazley analyzed more than 1,500 data breaches it serviced between 2013 and 2014.

Apple issues seven updates, fixes more than 40 vulnerabilities in iOS 8, OS 10.9.5

Apple issues seven updates, fixes more than 40 ...

In one of its infrequent "Update Surprisedays," Apple plugged holes, boosted security and added features.

Canadian telecom co. Telus unveils first transparency report

The company received more than 100,000 government requests for customer data last year.