In today’s digital age, the security of payment systems isn't just a feature—it's foundational to maintaining the integrity and trust in our financial ecosystem. As transactions increasingly move online, the potential for cyber threats grows, making robust payment system security paramount. Without stringent security measures in place, we risk exposing sensitive financial information, potentially eroding consumer confidence and destabilizing a critical component of our economy. Ensuring the security of these systems is not just about protecting individual transactions but safeguarding our collective trust in the financial infrastructure that powers our daily lives.

Brief History of PCI DSS

Before there were payment card processing security standards, consumers and merchants alike were plagued by many fragmented payment systems. It was a constant headache and source of risk – especially when one credit card company’s security policies violated another’s, mandated different security controls, or simply weren’t following guidelines as thoroughly as they should have been.

To improve the safety of consumer data and trust in the payment ecosystem, a minimum standard for data security was created. Visa, Mastercard, American Express, Discover, and JCB formed the Payment Card Industry Security Standards Council (PCI SSC). The PCI SSC created one standard policy, the PCI Data Security Standards (known as PCI DSS) to ensure a baseline level of protection for consumers and banks in the internet era. Now everyone in the payment processing ecosystem has a common baseline for protecting payment account data throughout the payment lifecycle while enabling more secure technology solutions. 

Image source: https://www.tripwire.com/state-of-security/explaining-pci-dss-evolution-transition-phase

The original PCI DSS v1.0 was released in 2004 and has seen several major overhauls, with v3.2.1 being the current active version. PCI DSS has been pivotal in safeguarding payment data, requiring adherence to comprehensive security measures by merchants, service providers, and financial institutions. Its foundation was aimed at protecting payment information against breaches, thereby ensuring consumer confidence and transaction security. As digital payments became more ingrained in everyday life, the significance of PCI DSS grew, continuously evolving to try and outpace cyber threats. Subsequent updates to DSS have not only aimed at data protection but also at cultivating a security-conscious culture throughout the payment processing ecosystem.

In 2022, nearly 20 years since the first release, v4.0 was published to keep pace with rapid advances in technology and dynamic changes to the security landscape. This latest iteration, PCI DSS 4.0, marks a significant milestone in the standard's evolution, introducing updates and new requirements designed to tackle the modern threat landscape head-on.

What’s new?

PCI DSS 4.0 aims to address evolving threats and technology in the payment industry while promoting continuous security processes. PCI’s intent with 4.0’s release is not just keep pace with technological advancements and emerging threats but to stay one step ahead, ensuring the security measures in place are as dynamic as the risks they aim to mitigate. The standard introduces a "customized approach," allowing organizations to tailor their compliance strategies to their unique environments and risks, emphasizing security as a continuous process rather than a one-time goal. Key updates include stricter multi-factor authentication (MFA) requirements, new guidelines for e-commerce and phishing, and a framework for more flexible and innovative security solutions.

Image source: https://blog.pcisecuritystandards.org/pci-dss-looking-ahead-to-version-4.0

Additionally, it features enhanced verification procedures and a focus on network security, malware protection, and secure configurations to protect against unauthorized access and data breaches. These changes reflect the PCI SSC’s commitment to keeping pace with advancements in technology and threat vectors, offering organizations the flexibility to implement the most effective security measures for their specific circumstances.

When does it go into effect?

With the March 31, 2024, deadline just around the corner, organizations are in the final stretch of transitioning from PCI DSS v3.2.1 to the more robust PCI DSS 4.0. This transition period has been critical for businesses to understand and integrate the updated requirements into their security practices.

^{Timeline taken from Countdown to PCI DSS v4.0 by Lauren Holloway}

From the end of this month until March 31, 2025, specific new requirements from PCI DSS 4.0 are considered best practices, providing organizations additional time to fully implement these changes. However, starting April 1, 2025, these requirements will become mandatory, making it essential for all organizations to complete their transition to ensure full compliance. During this crucial time, businesses are encouraged to assess their current security posture, develop and execute plans for implementing the necessary controls, and engage with qualified security assessors (QSA) to navigate this transition smoothly, thereby strengthening their defenses against potential cybersecurity threats.

Who needs to comply?

PCI DSS 4.0 impacts a wide range of organizations, from small merchants to large financial institutions, all of whom process, store, or transmit cardholder data. This includes merchants, payment processors, financial institutions, and service providers within the payment ecosystem. The updated standard reflects the need for robust security measures to protect cardholder information against the backdrop of evolving digital threats and technological advancements, including those utilizing cloud services or outsourcing payment processing.

Version 4.0 covers a wide range of cloud security topics, including cloud security architecture, cloud security operations, and cloud security monitoring. It requires organizations to implement a few security controls, such as encryption, authentication, and access control. To ensure that cloud security meets the requirements organizations need to have a comprehensive incident response plan in place.

Why compliance is important

Maintaining PCI DSS compliance is crucial for organizations dealing with cardholder data, ensuring data security, preserving customer trust, and avoiding financial and reputational damage. Compliance mitigates the risk of unauthorized data breaches, fulfills legal obligations, and ensures business continuity. Moreover, it signals a strong commitment to data security to partners and customers.

Image source: https://www.memcyco.com/home/pci-dss-compliance-checklist-for-2024/

Non-compliance with PCI DSS 4.0 can lead to significant penalties or fees for businesses. These penalties are not directly imposed by the PCI SSC but by payment brands or acquirers. They can vary widely depending on the specific circumstances of the non-compliance, such as the duration and severity of the breach of standards. Penalties can range from financial fines to increased transaction fees, or even the termination of the ability to process payment cards. These measures aim to encourage compliance and ensure the security of payment card data.

The 2017 Equifax breach, with its $425 million fine, starkly illustrates the risks of PCI non-compliance, emphasizing the importance of meeting PCI standards to safeguard customer data and evade severe penalties.

I do want to emphasize that achieving PCI DSS compliance alone doesn't necessarily protect against breaches. Organizations need to implement risk-based security measures that exceed baseline compliance standards. That’s honestly one of the reasons why the “customized approach” was introduced. It gives organizations an opportunity to implement even more robust security controls to mitigate threats.

How OpenText Cybersecurity supports PCI DSS 4.0

Historically, Voltage SecureData, has helped organizations protect PAN data and reduce PCI scope and this is expected to continue with the introduction of PCI DSS 4.0. Some Voltage case studies related to payment security and PCI DSS include:

• Large Technology Provider
• Epicor
• Leading Services and Facilities Management Company
• BELBiM
• Allegiant Travel Company
• Major Financial Services Institution

However, PCI DSS 4.0 introduces a stronger emphasis on application security, a shift from its predecessors, reflecting the evolving threats in digital payment systems and a great opportunity for OpenText Application Security solutions.

Enhanced Application Security in PCI DSS 4.0

PCI DSS 4.0 introduces crucial updates and new requirements to bolster application and API security, demanding a strategic shift in how organizations protect cardholder data.

Specifically, the standard requires more testing of public-facing applications related to payment

processing or other activities considered "in scope" for compliance. Generally, any system that touches payment-card data is in scope for PCI DSS compliance, whether or not the system or function is public-facing. Most of the requirements governing application security fall into Section 6 of PCI DSS 4.0, and some of the key AppSec requirements that Fortify can address well include:

• Comprehensive Application Testing: The standard mandates extensive testing for public-facing applications involved in payment processing. This includes systems interacting with payment card data, emphasizing rigorous evaluation to ensure they're secure against potential threats. . To prevent vulnerabilities and other errors from being deployed, developers will have to continually test in-scope applications during the SDLC using static and dynamic application security testing tools. That's implied in Requirement 6.2.1, which mandates that "bespoke and custom software are developed securely" and "incorporat[e] consideration of information security issues during each stage of the software development lifecycle." However, it's explicit in requirement 6.2.3, which clearly states that code reviews must be carried out on "bespoke or custom" software "prior to being released into production or to customers."
  • With its ability to perform both static and dynamic analyses, Fortify can uncover potential threats in software code and running applications, ensuring that apps interacting with payment card data are thoroughly tested and secured against vulnerabilities. We also have a PCI DSS 4.0 report to support compliance reporting.
• Inventory Management: A notable addition is Requirement 6.3.2, which necessitates maintaining an inventory of bespoke, custom software, and third-party components within such software, akin to a Software Bill of Materials (SBOM). This facilitates effective patching and vulnerability management, ensuring a clear understanding of all elements that comprise the application environment.
  • Fortify Software Composition Analysis (SCA) powered by Debricked (in FoD) and standalone and Sonatype (off cloud) can enables organizations to generate SBOMs) for open source software, meeting a critical subset of this requirement.
• Vulnerability Remediation: The standards specify that vulnerabilities identified must be remediated promptly, followed by verification to ensure their effective resolution. PCI DSS 4.0 doesn’t specify specific timeframes for remediating vulnerabilities. The timing depends on factors like risk assessment, security policies, and industry best practices. High-risk vulnerabilities should be addressed with higher priority, but the organization’s approach to low and medium vulnerabilities may vary based on its specific circumstances. This underscores the importance of a robust testing framework to identify and rectify security weaknesses.
  • Fortify's integration with Mobb introduces an automated approach for swift vulnerability remediation within the SAST environment, significantly enhancing the efficiency and effectiveness of security fixes. This integration markedly advances vulnerability management, minimizing disruptions and enabling developers to uphold stringent security standards without sacrificing productivity.
• APIs in the Spotlight: Given the pivotal role of APIs in payment processing, PCI DSS 4.0 requires that they undergo thorough vulnerability scanning and penetration testing. Specific requirements emphasize the need for organizations to maintain robust security measures around APIs involved in payment processing. This includes conducting detailed assessments to identify and rectify vulnerabilities, ensuring APIs are safeguarded against unauthorized access. This reflects an understanding of APIs as critical pathways that must be secured against unauthorized access.
  • Fortify offers capabilities to automatically discover API endpoints and scan for API-specific vulnerabilities. For more, see Developer Guide to the 2023 OWASP Top 10 for API Security issues white paper.
• Developer Scrutiny and Training: Developers are subject to increased scrutiny, with requirements for annual secure coding training and verification that training has been received. This highlights the role of developers in building secure applications from the ground up.
  • The integration Fortify has with Secure Code Warrior provides real-time access to targeted interactive application security training within Fortify Software Security Center and Fortify on Demand.

There are other AppSec related requirements around preventative measures, scripts, and a few others. Note, the "customized approach" option in version 4.0 allows merchants and other entities to come up with their own ways to comply with application security requirements.

Conclusion

The journey toward PCI DSS 4.0 compliance marks a significant step in the evolution of payment security, reflecting the need for ongoing adaptation and enhancement in cybersecurity practices. As technology and cyber threats evolve, the role of continuous improvement and innovation becomes crucial for maintaining robust security measures. Embracing a proactive approach to compliance and security, rather than a reactive one, is essential. This mindset encourages organizations to stay ahead of potential threats, ensuring that their security measures and compliance practices not only meet current standards but are also prepared for future challenges. This forward-thinking approach is vital for safeguarding the integrity of payment systems.

OpenText Cybersecurity is ready to help with your PCI DSS 4.0 compliance journey. Learn more:

• White paper: Data Protection and PCI Scope Reduction for Today’s Business
• Data Sheet: Voltage SecureData Web
• Flyer: Tokens and Tokenization
• Flashpoint Paper: PCI DSS Compliance across Retail and Financial Services
• Podcast: Navigating PCI DSS 4.0 and How does payment security work?