![]()
CHAPTER 1: WHAT IS THE PAYMENT CARD INDUSTRY DATA SECURITY STANDARD (PCI DSS)?
The Payment Card Industry Data Security Standard (PCI DSS) was developed by the five founding payment brands of the PCI Security Standards Council (PCI SSC, at www.pcisecuritystandards.org): American Express, Discover Financial Services, JCB International, Mastercard and Visa.
The PCI DSS consists of a standardised, industry-wide set of requirements and processes for security management, policies, procedures, network architecture, software design and critical protective measures.
The requirements of the PCI DSS must be met by all organisations (merchants and service providers) that transmit, process or store payment card data, or directly or indirectly affect the security of cardholder data. If an organisation uses a third party to manage cardholder data, it has a responsibility to ensure that the third party is compliant with the PCI DSS.
The PCI DSS (sometimes referred to as a compliance standard) is not a law. It is a contractual obligation applied and enforced – by means of fines or other restrictions – directly by the payment providers themselves.
The currently applicable version of the PCI DSS, since May 2018, is version 3.2.1; subject to licence, it can be freely downloaded.3 It is published and controlled by the PCI SSC on behalf of its five founding members.
In June 2015, the PCI SSC introduced the concept of ‘designated entities’. These are high-risk entities that can be prescribed a set of supplemental validation requirements to demonstrate ongoing security efforts to protect payments.
The SSC also defines qualifications for Qualified Security Assessors (QSAs), Internal Security Assessors (ISAs), PCI Forensic Investigators (PFIs), PCI Professionals (PCIPs), Qualified Integrators and Resellers (QIRs) and Approved Scanning Vendors (ASVs). It trains, tests, certifies and runs quality assurance programmes for these certifications.
The PCI DSS is a set of 12 requirements that are imposed on merchants and other related parties. These requirements are described later in this pocket guide.
Key definitions4 and acronyms in the PCI DSS
Acquirer – a bank that acquires merchants – i.e. the bank with which you have your e-commerce bank account.
Payment brand – Visa, Mastercard, American Express, Discover, JCB.
Merchant – sells products to cardholders.
Service provider – a business entity that is directly or indirectly involved in the processing, storage, transmission and switching of cardholder data. This includes companies that provide services to merchants, service providers, or members that control or could impact the security of cardholder data.
Service providers include:
•Third-party processors (TPPs), which process payment card transactions (including payment gateways); and
•Data storage entities (DSEs), which store or transmit payment card data.
Primary account number (PAN) – the up-to-19-digit payment card number.
Qualified Security Assessor (QSA) – someone who is trained and certified to carry out PCI DSS compliance assessments.
Internal Security Assessor (ISA) – someone who is trained and certified to conduct internal security assessments.
Approved Scanning Vendor (ASV) – an organisation that is approved as competent to carry out the security scans required by the PCI DSS.
PCI Forensic Investigator (PFI) – an individual trained and certified to investigate and contain information security breaches involving cardholder data.
3 www.pcisecuritystandards.org/document_library.
4 There is a formal English glossary available at www.pcisecuritystandards.org/document_library.
![]()
CHAPTER 2: RECENT CARDHOLDER BREACHES
E-commerce breaches
There have been a number of high-profile attacks by the threat group Magecart, including major breaches of British Airways and Ticketmaster UK. In both incidents, a script was used to intercept cardholders’ details as they entered them into a browser on the cardholders’ own machines.
•In the British Airways breach, Magecart managed to get a modified script onto the web server and application itself.
•In the case of Ticketmaster UK, Magecart managed to get a substitute script onto a service provider’s server. The malicious script was then called from the Ticketmaster website and captured card details.
In the case of British Airways, server and application access controls should have prevented the script from being modified, and change detection should have recognised that the script had been changed. Ticketmaster, meanwhile, should have ensured that the service provider was PCI DSS compliant, as the script was being called from the web page that hosted payment entry.
Hospitality industry
Criminal hackers have for several years targeted the point-of-sale (POS) equipment used to take payments in order to steal cardholder data, breaching numerous restaurant and hotel chains.
•Two million customer credit cards were stolen between May 2018 and March 2019 from more than 100 restaurants belonging to Earl Enterprises. The restaurants, which include Planet Hollywood, Buca di Beppo, and Earl of Sandwich, had their POS terminals infected with malware; the stolen credit card numbers were on sale less than a month later.
•Malware was found on payment processing servers used at restaurants and bars in the InterContinental Hotels Group in 2017. Stolen data included cardholder names, card numbers, expiration dates and internal verification codes.
•US coffee chain Caribou Coffee announced a security breach after it discovered unauthorised access to its POS systems between 28 August and 3 December 2018. 239 of its 603 stores were impacted – amounting to roughly 40% of its sites.
In these cases, and many more, isolating the cardholder data environment (CDE) from the rest of the organisation’s network and implementing strong access controls would have helped protect cardholder data.
![]()
CHAPTER 3: WHAT IS THE SCOPE OF THE PCI DSS?
The PCI DSS is applicable if you store, process or transmit cardholder data, or if you are responsible for third parties that store, process or transmit cardholder data. It also applies if you are involved with or can affect the security of the storage, processing or transmission of cardholder data. The cardholder data environment (CDE) is any network or environment that possesses cardholder data or sensitive authentication data. It does not apply to your organisation if primary account numbers (PANs) are not stored, processed or transmitted. The PCI DSS applies to any type of media on which card data may be held – this includes not only hard disk drives, floppy disks, magnetic tape and back-up media, but also printed or handwritten credit and debit card receipts where the full card number is printed. These receipts are sometimes held by merchants as a paper record of the transaction and may be used for voucher recovery purposes or as evidence of the transaction if the acquirer issues a request for information (RFI). If the card number is recorded in full, the record is subject to the same security requirements as electronic copies...
