{"id":678,"date":"2011-07-20T14:17:16","date_gmt":"2011-07-20T19:17:16","guid":{"rendered":"http:\/\/deliawilsondesign.com\/blog\/?p=678"},"modified":"2012-09-30T07:37:41","modified_gmt":"2012-09-30T12:37:41","slug":"pci-compliance-is-driving-me-crazy","status":"publish","type":"post","link":"https:\/\/wiztech4zc.com\/blog\/pci-compliance-is-driving-me-crazy\/","title":{"rendered":"PCI Compliance is driving me crazy!"},"content":{"rendered":"

Well, not me, really, but the customers who want it.\u00a0 And why wouldn’t they want it?\u00a0 Well….<\/strong><\/p>\n

PCI compliance is a complicated subject<\/strong> that credit card companies are presently using to charge most small online\u00a0 merchants more money.<\/p>\n

What is PCI compliance?<\/h3>\n

Basically, PCI compliance is all about standards of protecting the credit card holder’s information. The major credit card companies created those standards and made them into hurdles.\u00a0 They aren’t simple even though most small businesses only do things in a very simple manner.<\/p>\n

For instance, most brick and mortar stores use a credit card machine which handles the transaction and prints a receipt that no longer has the credit card number on it. (finally!).\u00a0 Then the retailer puts that receipt into a folder somewhere and holds onto it as long as they are required to.\u00a0 The day’s batch is processed through that terminal. End of story.<\/p>\n

The rules \/ standards cover all sorts of situations that the small merchant does not encounter or practice.\u00a0<\/strong> The biggest thing is about keeping the customer’s data somewhere so that it could be used later.\u00a0 That’s the no-no.\u00a0 It’s never a good idea to do that even if your customer insists you keep it for more charges down the line.<\/p>\n

If you do keep it, then there are all sorts of rules\/ recommendations about how it’s kept. If you’ve ever taken that online test for pci compliance, you’ve weeded your way through that stuff before.\u00a0 Of course, you probably didn’t understand any of it!<\/p>\n

They don’t make those tests for small merchants – it’s a generic one test fits all problem.\u00a0 Good grief!<\/p>\n

So start the test, answer the questions, fix the ones they don’t like the answers to and then you pass.\u00a0 There’s no checking – it’s the honor system.<\/p>\n

So a brick and mortar store can pass<\/strong> that test no matter what their practices are and never pay an extra cent.<\/p>\n

How does PCI compliance work for online merchants?<\/h3>\n

Now if you have an online shop in addition or instead, there is another test you have to pass.\u00a0 Actually, it has nothing to do with you – only with your hosting company and the scripting on your website.<\/p>\n

Zen Cart is PCI compliant.<\/strong> If you have it installed with no mods or changes to the code, the scripting will pass.\u00a0 That’s the easy part.<\/p>\n

The second part is your hosting company<\/strong> and the server your website resides on. The folks that your credit card company has contracted with does a real time, automated scan of your server. And then you fail.<\/p>\n

You read the report and can’t make heads or tails out of it.\u00a0 You ask your web hosting company about it and either they didn’t answer or swore off any responsibility for the problems.\u00a0 You panic.<\/p>\n

Stop right there.<\/strong><\/p>\n

If you don’t pass the test, small merchants may pay an extra $20 a month in processing fees.\u00a0 That’s the penalty.\u00a0 Nobody yells at you or threatens your ability to take credit card payments. It costs extra.<\/p>\n

That’s no reason to panic.\u00a0 If $20 a month extra in fees is not within your ability to pay, you really don’t have a business.<\/p>\n

The Technicalities<\/h3>\n

The scan looks at your server for what someone has decreed are vulnerabilities. It looks at the versions of the server software. It looks at what ports are open on the server and so on.\u00a0 The results can vary between the scan providers because I assume each create their own code\/robots for doing that.<\/p>\n

There’s a list of the approved companies on\u00a0 the PCI Standards Council website<\/a>. But I was’t able to find a definitive list of the requirements to become an approved vendor.<\/p>\n

Since I have my own dedicated server, I get to see the scan results from the different companies. I get to see sites that pass and sites that don’t.\u00a0 In the end it has more to do with the vendor doing the scan than it does the server.\u00a0 The company that my credit card processor uses can’t seem to able to scan my server and, therefore, fails. Don’t know why that’s so since other companies can manage it.<\/p>\n

My alternative is to pay for a scan from another company.\u00a0 Uh, who?\u00a0 How much?\u00a0 Gosh darn, that’s hard. I started checking and the first company doesn’t post that info. The one that is presently doing my scans is $249 a year. Divide that by 20 = $22.50 a month. Another prices it at $699 a year. Cheaper to go without compliance!<\/p>\n

PCI Compliant Webhosts<\/h3>\n

Okay, now we are talking about something else entirely.\u00a0 There may be PCI compliant servers out there but the hosting companies can’t (or aren’t supposed to) advertise themselves as PCI compliant unless their servers have passed the certification for physical PCI compliance. In other words, if the data center the servers rest in are PCI compliant.<\/p>\n

There definitely are some and I have no experience with any of them.<\/strong><\/p>\n

The companies I recommend folks to for Zen Cart hosting that are PCI compliant or help to manage PCI compliancy are Geekhost<\/a> (certified Zen Cart hosting) and Glowhost<\/a> who manages my server. Glowhost has a dedicated PCI compliant server program – not shared hosting. Geekhost is a Canadian company with servers “up there” and Glowhost utilizes a datacenter in Atlanta.<\/p>\n

The point is though in the end you pay more money for pci compliant servers.\u00a0 Geekhost is a minimum $20 a month for hosting, probably twice as much as shared hosting can be. Their dedicated server rates are better than Glowhost’s though.<\/p>\n

Confused? Crazy yet?<\/h3>\n

Ha, join a very large club.<\/p>\n

My recommendation is simple.<\/strong> Don’t worry about it until the credit card companies jack that monthly cost up ridiculously high or threaten to cut you off. Yeah, right, and cut their own throats!<\/p>\n

Don’t let PCI compliance drive you crazy!<\/p>\n

 <\/p>\n

 <\/p>\n

Author: Delia Wilson Lunsford, Founder & CEO, WizTech, Inc. <\/em><\/div>\n","protected":false},"excerpt":{"rendered":"

Well, not me, really, but the customers who want it.\u00a0 And why wouldn’t they want it?\u00a0 Well…. PCI compliance is a complicated subject that credit card companies are presently using to charge most small online\u00a0 merchants more money. What is PCI compliance? Basically, PCI compliance is all about standards of protecting the credit card holder’s […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-678","post","type-post","status-publish","format-standard","hentry","category-e-commerce"],"_links":{"self":[{"href":"https:\/\/wiztech4zc.com\/blog\/wp-json\/wp\/v2\/posts\/678","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wiztech4zc.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wiztech4zc.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wiztech4zc.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/wiztech4zc.com\/blog\/wp-json\/wp\/v2\/comments?post=678"}],"version-history":[{"count":9,"href":"https:\/\/wiztech4zc.com\/blog\/wp-json\/wp\/v2\/posts\/678\/revisions"}],"predecessor-version":[{"id":796,"href":"https:\/\/wiztech4zc.com\/blog\/wp-json\/wp\/v2\/posts\/678\/revisions\/796"}],"wp:attachment":[{"href":"https:\/\/wiztech4zc.com\/blog\/wp-json\/wp\/v2\/media?parent=678"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wiztech4zc.com\/blog\/wp-json\/wp\/v2\/categories?post=678"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wiztech4zc.com\/blog\/wp-json\/wp\/v2\/tags?post=678"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}