In my original comment I referred to the need to only allow access to necessary services. No forums, email gateways, IRC, etc. Just whitelisted domains and IPs:

In my original comment I referred to the need to only allow access to necessary services. No forums, email gateways, IRC, etc. Just whitelisted domains and IPs:ports (if dedicated hosting) of the services required to handle the payments aspect of a business. An attacker would have to break into the sites I whitelisted— in which case the liability falls on the site for not maintaining adequate security. It doesn’t alleviate the need for the merchant to have good security themselves.