Comments on: PA-DSS, and you thought PCI was a mess!

By: DSSReader

DSSReader — Wed, 02 Dec 2009 18:05:22 +0000

See pg11 of the PCI DSS (v1.2.1)document. It clearly states it is *NOT* a PCI-DSS requirement to use PA-DSS validated applications. The sky is really not falling.

By: Dave

Dave — Fri, 23 Oct 2009 06:03:33 +0000

It seems that somebody wants to earn more money on this situation.

It is nightmare for ecommerce.

By: Dave

Dave — Fri, 23 Oct 2009 06:01:52 +0000

> Are they trying to shut down the Internet or what?

I agree.

It seems that somebody wants to earn more money.

By: Mike

Mike — Fri, 04 Sep 2009 21:01:40 +0000

Can this really be true? This would essentially kill ecommerce! Think of how many people use ZenCart, OSCommerce, Virtuemart. And even several of the commercial carts that would never be able to afford a 100k validation procedure. Are they trying to shut down the Internet or what?

By: jestep

jestep — Fri, 07 Aug 2009 22:51:53 +0000

This is half the problem…

Acquirers have no idea how to, nor the means to police the situation. This is exactly why we’ve all seen the emergence of the PCI compliance fee, that most level 4 merchants are now subject to. Even FDR added a PCI fee for non-compliant level 4 merchants. Many ISO’s charge an additional fee if their customer’s don’t use their prefered PCI scanning vendor…

I’ve worked with about 8 ISO’s related to the PCI mess, and none of them have any real idea on what PCI is, or who it actually applies to, or why we have it, or what it actually is.

They simply add a PCI compliance fee to their customer’s accounts because it somehow removes their liability from a data breach.

And Visa… Visa is so far removed from the situation that they have no idea what is actually happening on the merchants level. The whole situation is out of control…

By: A Mous

A Mous — Fri, 07 Aug 2009 18:08:40 +0000

What you wrote here is not exactly true. People need to have a better understanding of the things they chooose to write about.
“If there is not a mass-movement to get software PA-DSS compliant in the next year, almost every single online store will be out of compliance and subject to fines, or being shut down. This is only a small part of the problem. There’s still thousands of retail businesses using older payment software and the cost of upgrading would be in the millions, assuming it’s even possible.” This is according to Visa: “Payment Application Security Mandates
On January 1, 2008, Visa implemented a series of mandates to eliminate the use of vulnerable payment applications from the Visa payment system. These mandates require acquirers to ensure that their merchants and agents do not use payment applications known to retain sensitive cardholder data (i.e. full magnetic stripe data, CVV2 or PIN data) and require the use of payment applications that are compliant to the PA-DSS.

While the use of PA-DSS validated payment applications is recommended, a payment application need not be included on Visa’s list of PABP validated payment applications or PCI SSC’s list of PA-DSS validated payment applications in order to comply with Phase 2, Phase 3 and Phase 5 requirements for use of PA-DSS compliant applications. Acquirers may determine the PA-DSS compliancy of a payment application through alternate validation processes, which should confirm that payment applications meet PA-DSS requirements and should facilitate compliance with the PCI DSS.”

By: Robert Jackson

Robert Jackson — Tue, 14 Jul 2009 11:32:56 +0000

Merchants processing payment transactions must be PCI DSS compliant. However, they are NOT required to use PA-DSS compliant applications.

If they do not then they must demonstrate that the payment applications they use are compliant with the PCI DSS which won’t need to do if the apps are PA-DSS certified.

Having said this, a merchant cannot use an application that would fail the PA-DSS (eg if it stored CVV2 permanently or stored CHD unencrypted) without compensating controls.

The long and the short of it is that PA-DSS is not mandatory but not having it is a major drawback for payment application vendors.

By: Al

Al — Tue, 23 Jun 2009 07:38:30 +0000

So if we all comply and get a PA-DSS audit complete at great expense and in three years time fraud is still on the rise can we fine MasterCard & Visa?

By: VISA PA DSS - The fall of small to medium ecommerce businesses? | Global Hosting Talk

Fri, 19 Jun 2009 20:39:57 +0000

[...] http://www.merchantaccountblog.com/7…pci-was-a-mess [...]

By: Ber2

Ber2 — Fri, 19 Jun 2009 11:15:39 +0000

I agree with you. It will lead to a big mesh.