PCI Compliant Hosting Requirements:
12-Point Checklist
PCI Compliance is all about protecting financial data, and specifically, the way that merchants process card payments, transmit payment data, and how they digitally store transaction records. The Payment Card Industry Security Standards Council is in charge of the standards required to meet this requirement. Its purpose is to create and maintain a security standard known as the PCI DSS (Data Security Standard) which each merchant must abide by.
PCI DSS is a global program that businesses and organizations around the world must uphold if they want to accept payment cards, such as credit cards or debit cards. PCI compliance is critical for many businesses, so we have created a list of the principal PCI-compliant requirements that every PCI DSS-compliant web host should meet.
If you are just starting your journey into PCI-Compliance, remember that Atlantic.Net is standing ready to help you achieve these goals. We have 25 years of experience and we specialize in compliance solutions.
How do I protect the network for PCI compliance?
Install and maintain a firewall configuration to protect cardholder data
The firewall is the front door to a network that must be adequately protected from internal or externally routed traffic over trusted and untrusted networks. All layers of the network are in scope, such as from the open internet, VPN connectivity, wireless networking, and corporate networks.
The network security design must be documented and amendments must be managed by change control in dev, test, and production configurations. Importantly, the flow of card data around the network must be known and documented.
Other key areas to consider are the roles and responsibilities must be defined in terms of who will manage the network (typically a network engineering team), all unused switch ports must be down and closed, all undefined traffic must be denied by default, and any discovered vulnerabilities in the network hardware must be patched.
How can Atlantic.Net help? We have several managed services available to help you secure your network. A managed firewall service will block all traffic as required by PCI-DSS, and our Network Consultancy services can help restrict internal and external network IP disclosure. Our intelligent Intrusion Prevention Service will scan packets and ensure that only permitted data traverses the payment network.
How do I change the default configurations to meet PCI-DSS standards?
Do not use vendor-supplied defaults for system passwords and other security parameters
It is very easy for a malicious user to compromise a system if the vendor passwords have not been amended from their defaults. Default passwords are documented all over the Internet, so it is recommended to disable the accounts and create unique accounts. Any wireless network must be protected with strong encryption (minimum WPA2) and complex passwords.
PCI-DSS also requires configuration standards being met for server builds to include security and server hardening to close off vulnerabilities, operating system patching, application updates, and more. You must also only have one primary function per server; a single server must not do every task required by the business. Often front-end, DMZ, mid-tier, and backend services are divided to create a secured hierarchy, and the technical teams must be aware of the security policies put in place to protect these systems.
How can Atlantic.Net help? All our systems are already hardened to provide the best level of security and compliance. If you use our Managed Services you will automatically inherit this best practice from our audited environment. Our support teams and consultancy services can advise on patching schedules, security best practices, and more.
How do I protect stored cardholder data?
Cardholder data should only be stored when necessary. If your organization does store permanent account numbers, or PANs (in this case payment card numbers), they should be encrypted. When displayed, the PAN should be masked and truncated; one-way hash functions based on strong cryptography can be used to render cardholder data unreadable.
The storage of full-track data, PINs and validation codes is prohibited, and there are strict rules on data retention - Remember, if you don't need it, don't store it!
How can Atlantic.Net help? Atlantic.Net systems use AES encryption as standard, and our teams are highly trained in security best practices when handling sensitive data. All employees are vetted before employment and we conduct regular training for the team. Ask about our SOC audits as well! They are a critical part of PCI-DSS.
How do I secure cardholder data transmission?
Encrypt transmission of cardholder data across open, public networks
Sensitive data must be encrypted during transmission over the Internet, WiFi, private networks, and site-to-site connections. All websites must be secured with TLS (HTTPS), and there are strict rules on how PAN data can be transmitted. Never transmit over email, SMS, or mobile apps, as this data is easily intercepted and should be routinely monitored.
How can Atlantic.Net help? We can provide secure point-to-point VPN connectivity into our data centers, and our managed services teams can assist with key management and website certificates.
How do I meet PCI-DSS vulnerability protection requirements?
Develop and maintain secure systems and applications
Vulnerability scanning will identify all the known vulnerabilities affecting the infrastructure. This landscape rapidly changes, and it is important to stay one step ahead. The majority of vulnerabilities have already been identified by the manufacturers and patches are available rapidly.
Any custom applications must be built to PCI-DSS standards regarding access to and encryption of source code. Never hardcode security information into source code, and never publish to public repos like GitHub. Databases require special attention to prevent Buffer Overflow and SQL injection weaknesses.
How can Atlantic.Net help? We already invest heavily in threat reduction and are continuously monitoring our platforms for weaknesses. Our teams manage the security of the Cloud Infrastructure and our managed services teams are available to advise on patching schedules and system maintenance.
Should access to cardholder data be restricted?
Restrict access to cardholder data by business need-to-know
Employee roles and business need-to-know should guide the development of access controls so that unauthorized use does not occur. The basic idea of need-to-know is that you only give the extent of privileges and amount of data to a user that is necessary to conduct their tasks. Zero Trust should be integrated into your access control system, as indicated by the PCI Council’s instructions to “‘deny all’ unless specifically allowed.”
How can Atlantic.Net help? Our consultancy team can help assign the least privileges to employees and introduce technical safeguards to restrict access to cardholder data. All Atlantic.Net employees that have access to these systems are trained on the security requirements of PCI-DSS.
How can I know who is accessing my systems?
Identify and authenticate access to system components
To meet PCI compliance standards, you need to know who is doing what within the system and you want all activities to be easily trackable so that you can monitor and verify. Do not give anyone access to critical systems or data unless you have first given them a unique user ID. A password, passphrase, or multi-factor authentication (MFA) should be standard. MFA should be used for remote access. Virtual private networks, tokenization, or authentication, and dial-in should be implemented for remote use.
How can Atlantic.Net help? Our managed services teams can process and create users and computers to meet the required security parameters and enforce the correct password policy and key rotation requirements. We can configure automated alerts to identify when user accounts are not used on X days. We also offer a managed Multi-Factor Authentication service.
How secure are the Atlantic.Net data centers?
Restrict physical access to cardholder data
Data is, of course, stored on real systems, and any access to physical systems presents the opportunity for theft. To achieve PCI-compliant hosting requirements, the provider’s data center should restrict physical access. Facility entry controls should be used. Before any outsider enters a space in which cardholder data is present or is being processed, they should receive a physical token that they give back before departure.
How can Atlantic.Net help? In our multiple data center locations, security is paramount. We employ a permanent security presence, and our buildings are protected by CCTV, door access controls, and access control lists. Only authorized users are allowed in the data center and all cabinets are locked. All unused network ports are closed throughout the data center and strict visitor controls are in place.
Is it possible to monitor all activity for PCI-DSS?
Track and monitor all access to network resources and cardholder data
Being able to track exactly what a given user is doing by logging all steps they take allows you to perform vulnerability management and forensics in an organized fashion. Logs allow you to analyze something much more specifically and efficiently so that if any issues arise, you can understand how hacking or other improper use occurs. You want automated audit trails in place so that you can review any activities.
How can Atlantic.Net help? Atlantic.Net maintains detailed audit logs of all access on our systems. We use machine learning to predict unexpected access, and alerts are automatically generated to our support personnel.
Who is responsible for pen-testing?
Regularly test security systems and processes
Security gaps are often revealed through hacking. Testing security protocols, hardware, and software will keep you secure long-term. Check to see what wireless devices are being used with a wireless analyzer at least quarterly. Alternatively, use a wireless intrusion prevention service (IPS). Network vulnerability scans should be performed once each quarter and also following major adjustments within the network. Perform penetration testing annually at a minimum.
How can Atlantic.Net help? We perform quarterly vulnerability scanning for our compliancy hosting customers, and identified threats are responded to quickly and under change control. Annual penetration tests are conducted to test our infrastructure is in the best shape possible for our clients.
Who needs to understand the rules of PCI compliance?
Maintain a policy that addresses information security for all personnel
Beyond PCI-compliant server requirements, you also need personnel interacting with the systems to be well-equipped. Everyone on staff should know their PCI compliance responsibilities for safeguarding sensitive data. Create, update, and distribute a PCI compliance information security policy that lets your employees know about PCI DSS rules. For internal environments, create usage policies to shape expectations for employees and contractors.
How can Atlantic.Net help? All Atlantic.Net employees are trained to PCI-DSS standards for a hosting provider. We maintain multiple processes to provide the best protection, such as a risk assessment, monitoring user access to Payment Data
