For credit card handlers, cloud computing guidelines just got clearer
The Payment Card Industry Security Standards Council has just issued guidance that anyone processing credit cards in the cloud will want to review
Computerworld - The fact that regulations evolve at a much slower pace than cloud computing technologies can lead to confusion regarding how to meet regulatory requirements in the cloud. If a client moves a regulated function to the cloud and later falls out of compliance due to a shortcoming on the cloud vendor's part, the client remains accountable. So it's essential to have as much clarity on these issues as possible. Recognizing this challenge with regards to the handling of credit card data, the Payment Card Industry (PCI) Security Standards Council has recently issued guidance on how to apply PCI Data Security Standards (PCI DSS) in the cloud.
PCI DSS applies to all organizations that hold, process or exchange credit card information. It was created to help ensure that consumers are not exposed to potential financial or identity fraud and theft. To accomplish this, PCI DSS provides a payment card data security framework that organizations deploy to prevent, detect and respond to security incidents. PCI DSS is not a law, and the PCI Security Standards Council doesn't directly impose any consequences for non-compliance, but the negative repercussions of non-compliance can include lawsuits, insurance claims, canceled accounts, payment card issuer fines and government fines. To ensure none of this happens to you when processing credit cards in the cloud, it's important to understand this new PCI DSS guidance.
PCI DSS was initially released on Dec. 15, 2004. To put this in perspective, that was over a year before Amazon Web Services initially began offering IT infrastructure services to businesses. The current version of PCI DSS, 2.0, was released on Oct. 26, 2010, but it wasn't until Feb. 5 of this year that the Cloud Special Interest Group of the PCI Security Standards Council released the PCI DSS Cloud Computing Guidelines to provide specific guidance on the use of cloud computing and maintaining PCI controls in cloud environments.
The guidelines are intended for use by organizations investigating, adopting or using cloud computing services as part of a cardholder data environment. Many elements of the guidelines align with issues addressed in my past columns, but they are worth reinforcing here within the PCI context. Some key concepts contained in the guidelines include:
- It is crucial that an organization clearly understands its own needs before transitioning payment card operations to the cloud. To achieve this, you should build a team of key stakeholders to define needs and determine the degree to which available cloud services meet those needs.
- While responsibility for security of cardholder data in a cloud environment is shared between the customer and cloud vendor, the customer remains accountable for ensuring that its cardholder data is properly secured according to applicable PCI DSS requirements.
- Accountability and responsibility for managing the various PCI DSS controls need to be clearly understood and agreed upon by both the customer and the cloud vendor. Specific roles may differ on a case-by-case basis depending upon a number of variables, including:
- The cloud service models (IaaS, PaaS, SaaS) and deployment models (public, private, community, hybrid) selected by the customer
- The reason the customer is using the cloud vendor and the range of PCI DSS requirements it is deploying in the cloud
- The services and system components that the cloud vendor has validated within its own operations.
- When payment card data is stored, processed or transmitted in the cloud, PCI DSS compliance will include validation of both the cloud vendor's infrastructure and the customer's use of it.
- Before adopting a cloud service, customers should first verify that the cloud vendor has validated PCI DSS compliance, by asking questions such as:
- When was the cloud vendor first validated for compliance? When was its most recent validation?
- Which specific services provided by the cloud vendor were included in the validation, and which were not?
- Which specific elements (facilities, components) of the cloud service were included in the validation, and which were not?
- How does the cloud vendor ensure that customers cannot introduce non-compliant elements or bypass existing controls?
- A cloud vendor claiming to have completed an independent PCI DSS assessment should be able to provide a customer an Attestation of Compliance and Report on Compliance that should include details regarding the specific services, components and facilities included in the assessment.
- Just because the cloud service is PCI DSS-compliant doesn't automatically mean that the customer is compliant. The customer must still ensure that it's using the service in a compliant manner.
Other columns by Thomas Trappler
- NASA's cloud audit holds value for all
- Who can pry into your cloud-based data?
- Does your cloud vendor protect your rights?
- Software licensing in the cloud
- For credit card handlers, cloud computing guidelines just got clearer
- Regulations and the cloud: HIPAA modification provides clarity
- Certification programs are making it easier to know all about a cloud vendor
- The do's and don'ts of safeguarding cloud-based data with encryption
- For a good cloud contract, start with an RFP
- It takes a team to create a good cloud contract
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- ESG: The IBM FlashSystem 840: Technical Evolution to Deliver Business Value In this whitepaper, you will learn how this high-speed storage technology has tremendous potential to support I/O-intensive and/or latency-sensitive applications.
- Choosing an MDM Platform: Where to Start the Conversation If you're in the early stages of choosing an MDM solution, or you're considering switching vendors, here are seven critical questions to ask...
- Axeda Platform Technical Overview This paper summarizes the major features of an IoT platform and explains how they simplify and speed the process of developing and deploying...
- Stock Shock: The effect of project and portfolio management on share price In this independent report, you'll see the intrinsic connection between long-term capital investment and short term market performance -- and how this can...
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well...
- Cloud Knowledge Vault Learn how your organization can benefit from the scalability, flexibility, and performance that the cloud offers through the short videos and other resources... All Cloud Computing White Papers | Webcasts