{"id":3539,"date":"2018-01-18T01:09:00","date_gmt":"2018-01-18T09:09:00","guid":{"rendered":"https:\/\/cheapsslsecurity.com\/blog\/?p=3539"},"modified":"2021-01-26T12:02:20","modified_gmt":"2021-01-26T20:02:20","slug":"is-your-business-pci-dss-compliant-youre-digging-your-own-grave-if-not","status":"publish","type":"post","link":"https:\/\/cheapsslsecurity.com\/blog\/is-your-business-pci-dss-compliant-youre-digging-your-own-grave-if-not\/","title":{"rendered":"Is Your Business PCI DSS Compliant? You\u2019re Digging Your Own Grave if Not"},"content":{"rendered":"\n

The latest report by Verizon shows that online businesses are less likely to be breached if they\u2019re PCI compliant<\/h2>\n\n\n\n

The Payment Card Industry Data Security Standard (PCI DSS), is a set of security guidelines applicable to all organizations that accept, store, and process credit card information. The PCI DSS is comprised of 12 key requirements that any website dealing with payment cards must adhere to. The Verizon 2017 Payment Security Report clearly outlines the relation between PCI DSS compliance and data breaches. Interestingly, almost all the victimized companies that Verizon analyzed between 2010 and 2016 were found have violated the PCI DSS at the time of their breach. Even more interestingly, the report indicates that 55.4% remain fully PCI compliant one year after their preliminary assessment. These two are the key findings of the 60-page long Verizon 2017 Payment Security Report \u2013 the \u2018highlights’ if you may.<\/p>\n\n\n\n

\"pci<\/figure><\/div>\n\n\n\n

However, there\u2019s no need to get overly pessimistic by these numbers. There is some good news, too. So, which one would you like to hear first — good news or bad news? Okay, let\u2019s go through some good news first.<\/p>\n\n\n\n

The Good News<\/h4>\n\n\n\n

Compliance on the rise<\/h3>\n\n\n\n

The report states that 55.4% of companies in 2016 remained fully PCI compliant one year after their preliminary assessment. This number may sound a little on the downside, but it\u2019s not. 55.4% is a massive improvement over the 48.4% recorded in 2015.<\/p>\n\n\n\n

Default credentials are a thing of the past<\/h3>\n\n\n\n

One of the 12 PCI DSS requirements is NOT TO use default vendor-supplied credentials. Going by Verizon\u2019s report, 81.3% of organizations heed this requirement \u2013 an encouraging sign indeed.<\/p>\n\n\n\n

Finance sector leading by example<\/h3>\n\n\n\n

If there is any sector that needs to comply with the PCI DSS more than others, it\u2019s the finance sector. Almost 60%<\/strong> of financial services organizations fall within the boundaries of PCI DSS.<\/p>\n\n\n\n

Customers getting savvier<\/h3>\n\n\n\n

Another key finding of the report was the rise in customer awareness. The report states \u201c66%<\/em> say they would be unlikely to do business with an organization that experienced a breach where their financial and sensitive information was stolen.<\/p>\n\n\n\n

Now let\u2019s get to the bad news. The part you should have a close look at.<\/p>\n\n\n\n

The Bad News<\/h4>\n\n\n\n

The love-hate relationship between data breaches and PCI compliance<\/h3>\n\n\n\n

The report demonstrates a clear link between PCI DSS compliance and data breaches. The organizations that are fully PCI compliant have very low chances of being the victim of a data breach. Speaking of which Rodolphe Simonetti, Verizon\u2019s global managing director for security consulting said, \u201cThere is a clear link between PCI DSS compliance and an organization\u2019s ability to defend itself against cyberattacks, [While] it is good to see PCI compliance increasing, the fact remains that over 40 percent of the global organizations we assessed \u2013 large and small \u2013 are still not meeting PCI DSS compliance standards. Of those that pass validation, nearly half fall out of compliance within a year \u2014 and many much sooner<\/em>.\u201d<\/p>\n\n\n\n

Security testing: Needs improvement<\/h3>\n\n\n\n

An important part of the 12 requirements is the \u2018Security Testing.\u2019 This requires the organizations to test their security systems and processes under some specific guidelines. Unfortunately, only 71.9% of organizations are compliant with this requirement.<\/p>\n\n\n\n

Tracking and Monitoring: A bluntly ignored requirement<\/h3>\n\n\n\n

To protect your online business against potential data breaches, you need to constantly track and monitor access \u2013 that\u2019s actually rule 10 of the PCI DSS. 91.9%<\/strong> of the companies assessed after a data breach were found to be disregarding this requirement.<\/p>\n\n\n\n

Now that you know the significance that PCI DSS requirements hold, we hope that you will comply with (or at least think about) the requirements. Let’s have a look at the 12 requirements in brief, to give you an idea or two. Here they are:<\/p>\n\n\n\n