Visa's security best practices to become payment industry standard

The PCI Security Standards Council, the body managing the Payment Card Industry data security initiative, on Wednesday announced that it will anoint a set of best practices developed by Visa International as the new security standard for third-party application software in the payment industry.

The new standard is called the Payment Application Data Security Standard (PA-DSS) and is based on Visa???s Payment Application Best Practices (PABP).

Over the next few months, the PCI Security Standards Council, together with participating organizations, security auditors, and vulnerability scanning vendors, will offer their comments and suggestions relating to the PA-DSS.

The security council will then incorporate this feedback and publish a final version of the application security standards in the first quarter of 2008, said Bob Russo, general manager of the security standards council.

The application security standards are designed to address growing security concerns related to the third-party payment applications used by retailers and other companies accepting credit card transactions. Many of these applications are old and lack many of the security controls mandated by the credit card companies under PCI.

For instance, older payment application software products are designed to capture and store certain kinds of cardholder data by default, even though the practice is explicitly banned under PCI. Similarly, legacy payment applications seldom have the transaction logging capabilities that are required by PCI.

Visa, which has been by far the most aggressive among the credit card associations in pushing PCI, has for some time now tried to address such issues by leaning on software vendors to adopt its set of payment application best practices. Though Visa cannot contractually require the software vendors to adopt these best practices, it has been pressuring them into doing so anyway, by making it mandatory for merchants to use only PABP-compliant third-party payment software.

Just two weeks ago for instance, it announced formal schedules for companies to ensure that all their third-party payment applications are PABP-compliant.

With yesterday???s announcement, the PCI council has taken Visa???s requirements and forged it into a broader industry-wide mandate -- meaning that soon it won???t be just Visa that???s pressurizing payment software vendors to adopt security controls, but MasterCard, Discover, American Express and JCB as well.