AIS - will Actinic comply??

[janep]

I have just been reading about the AIS (Account Information Security) program between VISA, Mastercard and the other big credit card companies.

See BBC website: http://news.bbc.co.uk/1/hi/technology/4449759.stm

And Visa website: http://www.visaeurope.com/acceptingv...programme.html

for more information.

There are a dozen requirements which are listed below:

Build and Maintain a Secure Network
Requirement 1: Install and maintain a firewall configuration to protect data.
Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters.

Protect Cardholder Data
Requirement 3: Protect stored data.
Requirement 4: Encrypt transmission of cardholder data and sensitive information across public networks.

Maintain a Vulnerability Management Program
Requirement 5: Use and regularly update anti-virus software.
Requirement 6: Develop and maintain secure systems and applications.

Implement Strong Access Control Measures
Requirement 7: Restrict access to data by business need-to-know.
Requirement 8: Assign a unique ID to each person with computer access.
Requirement 9: Restrict physical access to cardholder data.

Regularly Monitor and Test Networks
Requirement 10: Track and monitor all access to network resources and cardholder data.
Requirement 11: Regularly test security systems and processes.

Maintain an Information Security Policy
Requirement 12: Maintain a policy that addresses information security.



How will this affect Actinic and will there be any upgrades with regard to this

They are suggesting all webshops will be audited quarterly and certified annually with those failing being banned from accepting credit card payments!


I look forward to some feedback on this

Thanks

Jane

[Mike Hughes]

I read about this too (although as it applies to websites doing more than 20,000 transactions per year it'll be a while before I need to worry about it).

Actinic itself is only part of the equation, but from what I understand the key issues are really for them are really:

1. encrypting CC details in the database so others can't access them.

2. Restricting access to actinic based on user rights or username/password.

Both these issues have already been discussed on the forum so hopefully Actinic are already working on the solution.

Mike

[cdicken]

1. encrypting CC details in the database so others can't access them.

And this is only an issue if you are capturing CC details yourself - it is not an issue if you are using a PSP.

[Mike Hughes]

It can be an issue, even when using a Payment Service provider.

As PSPs have a habit of being unavailable sometimes (and at other times firewalls seem to get in the way sometimes) then some of us use Actinics built in CC capture as a fallback solution. This would then leave CC details open to all users until they're used and deleted/overwritten.

Mike