{"id":735,"date":"2009-05-22T11:26:01","date_gmt":"2009-05-22T16:26:01","guid":{"rendered":"http:\/\/www.merchantaccountblog.com\/?p=735"},"modified":"2009-10-30T14:49:52","modified_gmt":"2009-10-30T19:49:52","slug":"pa-dss-and-you-thought-pci-was-a-mess","status":"publish","type":"post","link":"https:\/\/www.merchantequip.com\/merchant-account-blog\/735\/pa-dss-and-you-thought-pci-was-a-mess","title":{"rendered":"PA-DSS, and you thought PCI was a mess!"},"content":{"rendered":"

PA-DSS<\/a>, is a security standard set for payment application developers, outlining security and auditing procedures for electronic payment applications. Software that falls under the PA-DSS envelope could include anything from a POS system to online shopping cart software. PA-DSS requires that a program be audited by a 3rd party and pass a series of security test and adhere to best-practices before it can be distributed. If it is not audited or fails any part of the audit, it cannot be used as a payment application.<\/p>\n

Phase V – July 1, 2010<\/strong>
\nPhase V mandates the use of payment applications that support PCI OSS compliance, requiring acquirers, merchants and agents to use only those payment applications that can be validated as PA-DSS compliant.<\/p><\/blockquote>\n

If you process credit card online and this doesn’t scare you, it should!<\/strong><\/p>\n

\"storm\"
\n<\/center><\/p>\n

Put this into perspective. There are currently millions of websites using paid and open source software for their online stores. Software like Oscommerce, Zen Cart, Magento, and others have millions of users. There are only 2<\/a><\/strong>, online store software packages that are PA-DSS compliant. If there is not a mass-movement to get software PA-DSS compliant in the next year, almost every single online store will be out of compliance and subject to fines, or being shut down. This is only a small part of the problem. There’s still thousands of retail businesses using older payment software and the cost of upgrading would be in the millions, assuming it’s even possible.<\/p>\n

As written by Evan Schuman<\/a>
\n“Essentially, this standard could cause merchants of all sizes in all industries to have to switch payment application vendors.”<\/p><\/blockquote>\n

Where the real mess begins…<\/strong><\/p>\n

There are currently about 40 companies<\/a> certified to perform PA-DSS validation. The cost to certify a single payment application could be $100,000 or more if the application is extremely complicated. There is an additional “mandatory<\/strong>” yearly fee of $1250 just to be listed as a Validated Payment Application<\/a>. Based on cost, and complexity, there’s not many shopping cart software providers that can come close to getting PA-DSS certified in the next year. Even then, that still leaves the open source solutions, which the majority of all ecommerce sites are using.<\/p>\n

From Rick Wilson<\/a>
\n“What about home grown and open source shopping cart solutions? What happens to them on July 1st, 2010. I asked this question to our auditor and his answer was telling, he said that “essentially if an application can’t be PA-DSS certified because it’s not developed by a single entity for example, then the service provider of that entity will need to become PCI Level 1 certified in order to keep offering that and be in compliance”.<\/p><\/blockquote>\n

Level 1 certification is nearly as expensive as PA-DSS certification, so don’t expect any relief from if you’re using a custom or open source solution. They’ve truly left no way out this time…<\/p>\n

In conclusion…<\/strong><\/p>\n

We’re about to experience a payment industry nightmare potentially having the ability to halt commerce as we know it. If you thought that the $20 per month fee from your processor was bad, you’ll really hate the $50,000 bill when you go to get level 1 certified. If Visa takes the hard-line stance that merchants not using PA-DSS certified software get shut down, it’s going to get really ugly. The current focus of the processing industry is on PCI-DSS compliance and a slew of new fees and charges related to it. But, in about a year, we’re going to see the true fallout of implementing ineffective regulations without foresight into what it actually takes to adopt them, or whether they actually do anything. The only thing we got out of the congressional hearing on PCI<\/a> is that congress thinks it’s not enough, and merchants think it’s way too much.<\/p>\n

Houston, we’re about to have a problem!<\/p>\n

Related reading…<\/strong>
\nPA DSS in One Easy Lesson…Sort Of<\/a>
\nPA DSS Is Remarkably Misunderstood<\/a>
\nPA-DSS and Ecommerce Web Hosting<\/a><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

PA-DSS, is a security standard set for payment application developers, outlining security and auditing procedures for electronic payment applications. Software that falls under the PA-DSS envelope could include anything from a POS system to online shopping cart software. PA-DSS requires that a program be audited by a 3rd party and pass a series of security […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8,5,1,4],"tags":[],"class_list":["post-735","post","type-post","status-publish","format-standard","hentry","category-fraud","category-news","category-merchantaccounts","category-the-best-posts"],"_links":{"self":[{"href":"https:\/\/www.merchantequip.com\/merchant-account-blog\/wp-json\/wp\/v2\/posts\/735","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.merchantequip.com\/merchant-account-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.merchantequip.com\/merchant-account-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.merchantequip.com\/merchant-account-blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.merchantequip.com\/merchant-account-blog\/wp-json\/wp\/v2\/comments?post=735"}],"version-history":[{"count":28,"href":"https:\/\/www.merchantequip.com\/merchant-account-blog\/wp-json\/wp\/v2\/posts\/735\/revisions"}],"predecessor-version":[{"id":760,"href":"https:\/\/www.merchantequip.com\/merchant-account-blog\/wp-json\/wp\/v2\/posts\/735\/revisions\/760"}],"wp:attachment":[{"href":"https:\/\/www.merchantequip.com\/merchant-account-blog\/wp-json\/wp\/v2\/media?parent=735"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.merchantequip.com\/merchant-account-blog\/wp-json\/wp\/v2\/categories?post=735"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.merchantequip.com\/merchant-account-blog\/wp-json\/wp\/v2\/tags?post=735"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}