Contact Us

Contact Us

Please get in touch using the form below

I prefer to be contacted by:
View our privacy policy
Book a CREST penetration test today. Get a quote.

Overview

What you need to know about payment security

PCI DSS 3.2 encompasses six key objectives. These objectives are split across a set of 12 requirements, each incorporating a range of preventative, detective and directive controls.

Objectives

PCI DSS objectives

Build and Maintain a Secure Network

1. Install and maintain a firewall configuration to protect cardholder data

2. Do not use vendor-supplied defaults for system passwords and other security parameters

Protect Cardholder Data

3. Protect stored cardholder data

4. Encrypt transmission of cardholder data across open, public networks

Maintain a Vulnerability Management Program

5. Use and regularly update anti-virus software or programs

6. Develop and maintain secure systems and applications

Implement Strong Access Control Measures

7. Restrict access to cardholder data by business need-to-know

8. Assign a unique ID to each person with computer access

9. Restrict physical access to cardholder data

Regularly Monitor and Test Networks

10. Track and monitor all access to network resources and cardholder data

11. Regularly test security systems and processes

Maintain an Information Security Policy

12. Maintain a policy that addresses information security for employees and contractors

Services

Our PCI DSS services

Redscan offers a range of specialist PCI DSS services, including:

PCI DSS log management and monitoring

ThreatDetect™, Redscan’s Managed Detection and Response service, help organisations track and monitor access to network resources and cardholder data in order to achieve compliance with PCI DSS 3.2 requirements 10 & 11.
ThreatDetect offers:

• Log management

• Asset discovery

• Intrusion detection

• File integrity monitoring

• Internal vulnerability scanning

PCI DSS Penetration testing

Requirement 11 of PCI DSS 3.2 outlines the need for organisations to perform internal and external penetration testing at least annually, or after any significant change to network infrastructure.

Managed vulnerability scanning

Internal quarterly vulnerability scanning by our cyber security experts helps to identify, classify and remediate common exposures such as weak user credentials and unpatched or out-of-date operating systems, applications and software. To comply with PCI requirement 11, vulnerability scans should be performed quarterly and after any significant network changes.

Virtual CISO

Call upon a highly-qualified and experienced security professional to support your PCI DSS requirements. By acting as an extension of in-house resources, a Redscan Virtual CISO can help to assess cyber-risk and develop and implement the policies, procedures and controls needed to achieve PCI compliance.

Discuss your PCI DSS requirements

Get in touch

Get in touch

Complete the form for a prompt response from our team.

I prefer to be contacted by:
View our privacy policy

Resources

Discover our latest content and resources

From the blog
From the blog Case studies Latest news
30th September 2020
Redscan named in Gartner MDR Market Guide
Redscan is one of only two UK-based providers recognised in Gartner’s 2020 Market Guide for Managed Detection and Response. Read more in our press release.
30th September 2020
A fifth of government and enterprise users have unnecessary privileged access
New research suggests that over a third of government and enterprise users in the UK and the US have privileged access despite not needing it. An access policy of “least privilege” is best practice in cyber security and reduces the risk of insider threats.
28th September 2020
Redscan services now available via G-Cloud 12
To help public sector organisations reduce cyber security risk, Redscan's MDR and penetration testing services are now available on G-Cloud 12, the latest iteration of the UK government's digital marketplace, which went live today.  Read more
25th September 2020
Zerologon now being exploited in the wild
Microsoft has warned that attackers are now actively exploiting ‘Zerologon’, a critical vulnerability in the Windows Server Netlogon authentication process. Read Redscan’s Security Advisory to learn how to protect your organisation.