Security Certificates and their Benefits
Security certificates are seen on websites offering internet financial transactions. A website with a security certificate means that the website complies with the Payment Card Industry (PCI) data security standard.
All credit card companies, including Visa, JBC, MasterCard, Discover, and American Express endorse the PCI standard. Merchants storing, processing and transmitting cardholder data are required to follow this standard. It is applicable to all kinds of payment channels used by all merchants. This includes retail, mail or telephone order, and online transactions. A failure to follow the standard may result in fines from banks and credit card companies. It may even result to the loss of rights to process credit cards.
In order for a merchant to earn a security certificate, it is required to submit, at minimum, one website for auditing. The merchant must then pass the required tests about compliance with the PCI data security standard. There are six categories that must be met for a merchant to be considered compliant.
First, the website should ensure a completely secure network. Hosting companies are expected to ensure that the payment card information is being sent to a web server that does not expose information to the public.
The second requirement is that the merchant must protect cardholder information. While the payment is being transmitted, the information must be encrypted with at least a 28-bit SSL certificate.
The third requirement is that the web server must have a vulnerability management program. This ensures that the website is safe from new threats. Threats exposing and taking advantage of newly discovered security vulnerabilities appear everyday. A vulnerability management program exists to make sure that existing security vulnerabilities are always patched to keep the website safe.
Fourth, the merchant must implement strong access control measures. This means limiting access or restricting physical access to cardholder information. The merchant should be responsible for assigning a unique identification to each person that needs access to cardholder information.
Fifth, the merchant must regularly monitor and check networks. Regular scans of security measures and processes, and monitoring network access to cardholder data are required to fulfill the standard.
The sixth and last requirement is that information security policy should be constantly implemented and maintained. Responsibilities and restrictions regarding user data should be made clear to the employees of the online business and all other people directly involved in it.
If the above standards are met, there should be no hassle in getting a Security Certificate that communicates to the users that the website is safe for online monetary transactions. A security certificate serves as proof that the customer’s sensitive information is protected from hackers, browser exploits, spammers, phishing attacks, and scammers.
Related posts:
Posted on Aug 26 2009 in Internet Business