IT Security in E-Commerce

Do you REALLY know where you stand with compliance and security?

Are you faced with the dilemma of digging more deeply into your IT security and compliance posture or simply assuming it's handled because your providers say they're PCI compliant?

Many online retailers really don't understand exactly where a provider's coverage stops and where theirs starts…and how to truly increase the security of their e-commerce business.

Many e-retailers think that as long as they don't "store" credit card data, then they avoid PCI compliance requirements altogether. That's not true. If your application even briefly handles a credit card number, then it is likely an "in-scope" environment as far as the payment card industry is concerned. And while your overall volume of card transactions may be low, you are still responsible for understanding requirements under the PCI DSS.

Cost-effectively meet compliance requirements and security.

You don't have to be "big" to afford IT security or to cost-effectively meet stringent compliance requirements. There are some key steps that smaller retailers can take to ensure that they meet compliance requirements and properly secure their environments.

Consider leveraging security and compliance building blocks such as the following in your e-commerce environment:

• Hardened servers with regular scanning and patching taking place
• Multi-factor login for both admin and direct server access
• Host-based security, including IDS/IPS, anti-malware and file integrity monitoring
• Log file collection, event correlation and anomaly detection for the environment
• Web application firewalls, to quickly address web-facing vulnerabilities
• Hosted payment service integration, to eliminate ever "touching" a credit card number
• Application/data encryption used throughout the environment

What does it really take to be secure? Find the right security partner.

While implementing and managing the above might sound like an expensive, complex endeavor, that’s not necessarily the case.

The right partner with the right focus for your business can help guide you through the right steps. This can even include the partner managing security and compliance on your behalf.