Click here to receive your FREE subscription to Campus Technology
Online Security
Payment Standard for Web Apps Goes Live
7/3/2008
A new payment card industry (PCI) standard for Web application firewalls and source code went into effect July 1. PCI Industry Data Security standard 6.6 gives merchants a framework to ensure that the point-of-sale information uploaded into browser-based applications is sound from "top to bottom," the organization's literature said.
The standard can be used to help thwart common threats to cardholder data. It provides two options for retailers.
Option one includes periodic manual reviews of application source code to ensure the code is not tampered with in conjunction with an application.
The second option calls for cutting off hackers at the network level. It entails implementing what the PCI calls a "security policy enforcement point positioned between a web application and the client end point" while using a firewall. Tests of the firewall's functionality -- whether implemented through software or hardware -- need to be documented for compliance purposes. The standard recommends inspecting the "contents of the application layer of an IP packet, as well as the contents of any other layer that could be used to attack a web application."
But there is still no word on what the penalties for noncompliance to this new rule should be, which is up to the payment card companies to enforce.
"As for enforcement of the new requirement, that is up to the card payment brands as the Council is not responsible for compliance and/or enforcement," explained PCI Council spokesman Glenn Boyet in an e-mail.
"It's the classic Texas two-step," said National Retail Federation Chief Information Officer Dave Hogan. "Merchants are frustrated. I mean you go to the credit card companies for clarification of the rules and they say go to the council. You go to the council and they say that's up to the credit card companies."
The ambiguity puts retailers in limbo. Typically, they are afraid to speak ill of PCI standards for fear of reprisals from credit card giants such as Visa and Mastercard, according to the National Retail Association.
Hogan, a vocal critic of all of the current standards, would like to see retailers fully absolved of the responsibility of storing cardholder data on their systems, arguing that if retailers don't store it, hackers can't steal it.
To illustrate just how much the standards aren't working, Hogan pointed to the recent mass hack of grocery chain Hannaford Bros. in March.
"You look at Hannaford [hack] and they were compliant, so what does all this really mean," Hogan said. "There seems to be a clear inconsistency in the rules."
Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others. You can contact Jabulani at editor@entmag.com.
Cite this Site
copy text (above) for proper citation
Recommended Reading
- Tufts Grants Rights for Mileage-Increasing Transportation Technology to Electric Truck
Tufts University has optioned rights to a technology that can recharge the batteries of any hybrid electric and electric-powered vehicle while it is driven. The Tufts-developed technology could increase by 20 percent to 70 percent the miles per gallon or total driving range performance of vehicles like the Honda Civic, Ford Escape, and Toyota Prius hybrids and the Tesla Motors and Phoenix Motorcars electric vehicles.
- U Florida and Cyntellect Collaborate to Unlock Mysteries of Cancer Stem Cells
The University of Florida has entered into a research agreement with life sciences company Cyntellect. The university's Interdisciplinary Center for Biotechnology Research will work with the company to focus on a variety of research areas including the purification and analysis of cancer stem cells (CSCs), rare cells believed to be directly involved in propagating cancers.
- George Mason U Receives Grant To Deploy Intergraph Apps for Intelligence Curriculum
George Mason University (GMU) in Fairfax, VA has been awarded a grant from Intergraph to enable students enrolled in GMU's Geospatial Intelligence Graduate Certificate program to use the company's geospatial production and exploitation software as part of their core curriculum.
- Institute for Cyber Security at U Texas, San Antonio Opens Incubator
The University of Texas at San Antonio (UTSA) Institute for Cyber Security (ICS) has launched a new Internet security incubator. The incubator was developed to commercialize promising technologies that address major cyber security and privacy issues. The first companies to enter the incubator are Denim Labs and SafeMashups.
- ISO/IEC Publishes Office Open XML Standard
ISO/IEC has published the Office Open XML (OOXML) file format standard, formally known as ISO/IEC 29500:2008. It describes file formats originally designed by Microsoft for its Office 2007 productivity suite, which are used in presentation, spreadsheet and word processing applications.
- Dynamics NAV 2009 ERP Coming Next Month
Microsoft exec Kirill Tatarinov Wednesday described some new features to expect in the forthcoming Microsoft Dynamics NAV 2009 enterprise resource planning solution. He gave the keynote address at Microsoft's Convergence 2008 event in Copenhagen, Denmark.
