Standards body to certify PCI end-user experts

The alphabet soup of security certifications is expected to grow this year when professionals get the chance to show off their expertise in the Payment Card Industry Data Security Standard (PCI DSS).

The PCI Security Standards Council, which manages and drives adoption of the standard, is planning to launch a certification that attests to one being qualified in preparing an organisation for a PCI assessment.

Security practitioners had expressed interest in obtaining such a credential, Bob Russo, general manager of the council, said. Part of the reason was for vanity, he said.

"A lot of people want to have a certification at the end of their business card," he said.

But the council is viewing the certification as a way for pros to express that they understand the intricacies of the 12-step standard for protecting credit card information, and what the ramifications are for not being compliant.

"They've been asking about it for a long time," Michael Mitchell, vice president of global network operations at American Express and the current chairman of the PCI Council, told SCMagazine.com.

The certification can be achieved by passing an online exam, and the council likely will offer a boot camp-style training course for those wanting a refresher, Russo said. The certification has not yet been named.

Also this year, the council plans to begin training assessors on how to validate point-to-point encryption products. The ones that pass will be listed on the council's website, in the same format as PCI-approved payment applications and point-of-sale devices.

The PCI requirements do not mandate the use of point-to-point encryption, which cloaks card numbers from swipe to the payment processor or card brand hand-off. But, the council has released guidance on how to best implement the technology.

"The specter of scope reduction is what's driving the merchants and government to buy these solutions, " Russo said.

This article originally appeared at scmagazineus.com