PCI DDS Compliant & Plynt Certified

PCI Compliance

As of February 26, 2009, Shift4Shop has officially become PCI DDS compliant. In a growing effort to preserve the integrity of personal information, the PCI Security Standards Council has put forth a series of regulations online business must follow to ensure the security of online shopping. Shift4Shop has met and surpassed all standards outlined by the PCI Security Standards council with flying colors – not only did we invest in over $50,000 of state of the art network security software, but we have proven our security management, security policies, network architecture, and software design are protected and free of any vulnerabilities that may hinder your online business. In addition, all tests were conducted by two third party companies, SecurityMetrics and Plynt, which guarantees no shortcuts were taken in proving our compliancy.

PCI REPORT

Status: Compliant
Service Provider: Shift4Shop
Scan Type: Quarterly
Scanning Vendor: SecurityMetrics

See Visa's Official PCI Registry

What is PCI Compliance?

The PCI security standards are a blanket of regulations set in place to safeguard payment account data security. The council that develops and monitors these regulations are comprised of the leading providers in the payment industry: American Express, Discover Financial Services, JCB International, MasterCard Worldwide and Visa Inc. Inc. International. Essentially, they define the best practices for storing, transmitting, and handling of sensitive information over the internet.

How Did Shift4Shop Become PCI Compliant?

Shift4Shop has paired with SecurityMetrics to run through a series of rigorous tests to authenticate our company abides by all PCI data security standards:

Build and Maintain a Secure Network

First Requirement

Install and maintain a firewall configuration to protect cardholder data. Firewalls are computer devices that control computer traffic allowed into and out of a company’s network, as well as traffic into more sensitive areas within a company’s internal network. A firewall examines all network traffic and blocks those transmissions that do not meet the specified security criteria. All systems must be protected from unauthorized access from the Internet, whether entering the system as eCommerce, employees’ Internet-based access through desktop browsers, or their email access. Often, seemingly insignificant paths to and from the Internet can provide unprotected pathways into key systems. Firewalls are a key protection mechanism for any computer network.

Second Requirement

Do not use vendor-supplied defaults for system passwords and other security parameters. Hackers (external and internal to a company) often use vendor default passwords and other vendor default settings to compromise systems. These Passwords and settings are well known in hacker communities and easily determined via public information.

Protect Cardholder Data

Third Requirement: Protect stored cardholder data.

Encryption is a critical component of cardholder data protection. If an intruder circumvents other network security controls and gains access to encrypted data, without the proper cryptographic keys, the data is unreadable and unusable to that person. Other effective methods of protecting stored data should be considered as potential risk mitigation opportunities. For example, methods for minimizing risk include not storing cardholder data unless absolutely necessary, truncating cardholder data if full PAN is not needed and not sending PAN in unencrypted emails.

Fourth Requirement: Encrypt transmission of cardholder data across open, public networks.

When transmitting cardholder data over a wireless network, strong encryption for transmittion and authentication should be used. PANs should never be sent via end-user messaging, such as email or chat. Transmitting cardholder data over networks without encryption can lead to stolen information.

Maintain a Vulnerability Management Program

Fifth Requirement: Use and regularly update anti-virus software.

Many vulnerabilities and malicious viruses enter the network via employees’ email activities. Anti-virus software must be used on all systems commonly affected by viruses to protect systems from malicious software.

Sixth Requirement: Develop and maintain secure systems and applications.

Unscrupulous individuals use security vulnerabilities to gain privileged access to systems. Many of these vulnerabilities are fixed by vendor provided security patches. All systems must have the most recently released, appropriate software patches to protect against exploitation by employees, external hackers, and viruses.

Implement Strong Access Control Measures

Seventh Requirement: Restrict access to cardholder data by business need-to-know.

This requirement ensures critical data can only be accessed by authorized personnel.

Eigth Requirement: Assign a unique ID to each person with computer access.

Assigning a unique identification (ID) to each person with access ensures that actions taken on critical data and systems are performed by, and can be traced to, known and authorized users.

Ninth Requirement: Restrict physical access to cardholder data.

Any physical access to data or systems that house cardholder data provides the opportunity for individuals to access devices or data and to remove systems or hardcopies, and should be appropriately restricted.

Regularly Monitor and Test Networks

Tenth Requirement: Track and monitor all access to network resources and cardholder data.

Logging mechanisms and the ability to track user activities are critical. The presence of logs in all environments allows thorough tracking and analysis when something does go wrong. Determining the cause of a compromise is very difficult without system activity logs.

Eleventh Requirement: Regularly test security systems and processes.

Vulnerabilities are being discovered continually by hackers and researchers, and being introduced by new software. Systems, processes, and custom software should be tested frequently to ensure security is maintained over time and with any changes in software.

Maintain an Information Security Policy

Twelveth Requirement: Maintain a policy that addresses information security.

A strong security policy sets the security tone for the whole company and informs employees what is expected of them. All employees should be aware of the sensitivity of data and their responsibilities for protecting it.

Plynt Certified

Shift4Shop has gone above and beyond to ensure the safety of our application by hiring a third party company, Plynt, to deploy penetration and code testing on our software. Shift4Shop has met all 23 requirements defined by Plynt to assume Plynt certification. By becoming Plynt certified, Shift4Shop has affirmed our application is resilient to the most complex and logical security attacks known on the internet.

What Does This Mean for You?

Because Shift4Shop maintains a secure network for all of our customers, you, as a merchant, can feel safe with the Shift4Shop software. Furthermore, we will provide you with the tools you need to prove that your site is PCI Compliant as well. Essentially, if you want to process credit cards in your online store, you need to be PCI compliant, and Shift4Shop helps you get compliant.

We Are PCI Compliant