PCI compliance, and cPanel/WHM
Early last week, I presented at cPanel’s Automation Bootcamp 2011. The title of my talk was ‘PCI Compliance: It’s about to get real.” Since neither cPanel nor I recorded the presentation (and the EiC over at the Whir mentioned having a hard time trying to keep up), I figured I’d recap it here. If you just want the slides from the presentation, you can get those here.
PCI (DSS) Compliance for e-Commerce Sites
As much as people love to hate PCI Compliance (or more specifically, the scanners), it is a necessary evil. In an industry-wide race to the bottom, the Payment Card Industry Security Standards Council (PCI-SSC) had to implement a standard to which they could hold everyone accountable, and by which they would judge the security of consumer data, in all payment card transactions.
In 2006, the PCI-SSC got together and composed a standard that everyone in the Payment Card Industry (everyone who accepts payment cards, from brick and mortar stores to e-commerce), which they called the Data Security Standard. They wanted to help streamline an increasingly complex process (getting approved to process credit cards through your own in-house-developed payment application), but without compromising the security of consumer data. While the importance and relevance of PCI DSS can be overinflated, it is just as necessary as any other standard. Treat it like a list of regulations to follow, use common sense, and you should be fine.
To help you along, I have outlined much of what’s included in the PCI-DSS, and what you can do to help secure your server, and help your server pass its scan.




Flickr
Twitter
Last.fm