Secure Computing -- PCI

Working for a financial services client where sensitive information is exchanged, I have learned that it is important to understand the new rules of secure computing.  It is becoming very important to understand the Payment Card Industry Data Security Standards (PCI DSS).  Even if your company or your client is not seeking a PCI certification, following these standards will help to reduce your vulnerability to a breach of sensitive data into the public domain.

Here are a few quick rules to follow that will get you started:

• Try to avoid exchanging personal account numbers (PAN).
• If you must exchange PAN data, do not let the data remain unprotected at rest.  Encrypt the data in transit and keep it encrypted whenever the data comes to rest.
• Remove PAN data exchange from your business processes.  Never let a credit card number out in an email or be saved in an insecure location.
• Limit access to your applications and secure web sites.
• Limit access to your network.
• Code defensively.  Use the tools and guidelines from a security organization like OWASP.

Like all security measures, there's no quick fix.  Protecting your systems and data is an ongoing task.  You will need to build this into your company's culture and continuously enforce your standards.  This is one of those ongoing battles where a victory means that you have no excitement to deal with -- which allows you many clear nights to spend thinking about cool stuff.