7 ms·
Its quite important. Any business that processes or stores credit card transactions for AMEX, Visa and Discover cards automatically fall under the jurisdiction
by lambersley 12y ago
Its quite important. Any business that processes or stores credit card transactions for AMEX, Visa and Discover cards automatically fall under the jurisdiction of PCI, whether the business wants to or not. PCI has the authority to levy huge fine against businesses for failure to maintain its Data Security Standards. Small eComm businesses can easily falter at the financial pressures. I've seen major businesses elect to simply pay the fines as implementing PCI DSS can be quite costly in large, legacy environments.
- michaelmior 12y agoI don't think the OP was questioning the practical need to be PCI-compliant. I think the question was as to how useful PCI actually is at protecting users. (i.e. does it actually prescribe best practices or is it just smoke and mirrors)
- adrr 12y agoIts pretty decent. It has requirements on logging including kernel level logging. The ASV tests are pretty through in terms of testing for known vulnerabilities. I failed my first ASV test because my allowed ciphers where vulnerable to the BEAST attack.