News

Payment Standard for Web Apps Going Live

A new payment card industry (PCI) standard for Web application firewalls and source code goes into effect on Tuesday morning at midnight, the PCI Security Standards Council said on Monday. PCI Industry Data Security standard 6.6 gives merchants a framework to ensure that the point-of-sale information uploaded into browser-based applications is sound from "top to bottom," the organization's literature said.

The standard can be used to help thwart common threats to cardholder data. It provides two options for retailers.

Option one includes periodic manual reviews of application source code to ensure the code is not tampered with in conjunction with an application.

The second option calls for cutting off hackers at the network level. It entails implementing what the PCI calls a "security policy enforcement point positioned between a web application and the client end point" while using a firewall. Tests of the firewall's functionality -- whether implemented through software or hardware -- need to be documented for compliance purposes. The standard recommends inspecting the "contents of the application layer of an IP packet, as well as the contents of any other layer that could be used to attack a web application."

But there is still no word on what the penalties for noncompliance to this new rule should be, which is up to the payment card companies to enforce.

"As for enforcement of the new requirement, that is up to the card payment brands as the Council is not responsible for compliance and/or enforcement," explained PCI Council spokesman Glenn Boyet in an e-mail.

"It's the classic Texas two-step," said National Retail Federation Chief Information Officer Dave Hogan. "Merchants are frustrated. I mean you go to the credit card companies for clarification of the rules and they say go to the council. You go to the council and they say that's up to the credit card companies."

The ambiguity puts retailers in limbo. Typically, they are afraid to speak ill of PCI standards for fear of reprisals from credit card giants such as Visa and Mastercard, according to the National Retail Association.

Hogan, a vocal critic of all of the current standards, would like to see retailers fully absolved of the responsibility of storing cardholder data on their systems, arguing that if retailers don't store it, hackers can't steal it.

To illustrate just how much the standards aren't working, Hogan pointed to the recent mass hack of grocery chain Hannaford Bros. in March.

"You look at Hannaford [hack] and they were compliant, so what does all this really mean," Hogan said. "There seems to be a clear inconsistency in the rules."

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.

Featured

  • Closeup of the new Copilot keyboard key

    Microsoft Updates Copilot To Add Context-Sensitive Agents to Teams, SharePoint

    Microsoft has rolled out a new public preview for collaborative "always on" agents in Microsoft 365 Copilot, bringing enhanced, context-aware tools into Teams channels, meetings, SharePoint sites, Planner workstreams and Viva Engage communities.

  • Windows 365 Cloud Apps Now Available for Public Preview

    Microsoft announced this week that Windows 365 Cloud Apps are now available for public preview. This aims to allow IT administrators to stream individual Windows applications from the cloud, removing the need to assign Cloud PCs to every user.

  • Report: Security Initiatives Can't Keep Pace with Cloud, AI Boom

    The increasingly fast adoption of hybrid, multicloud, and AI systems is easily outgrowing existing security measures, according to a recent global survey by the Cloud Security Alliance (CSA) and exposure management firm Tenable.

  • World Map Image

    Microsoft Taps Nebius in $17B AI Infrastructure Deal To Alleviate Cloud Strain

    Microsoft has signed a five-year, $17.4 billion agreement with Amsterdam-based Nebius Group to expand its AI computing capabilities through third-party GPU infrastructure.