Visa Security Mandates Not Applicable in Australia—Yet

Changes to the Visa payment card industry data security requirement could force credit card merchants to undertake quarterly network vulnerability scans with costs spiraling into millions of dollars.

Last month, Visa made changes to the compliance requirements of “Level 4” merchants. Level 4 merchants typically process between 1 million and 6 million credit card transactions annually. They are now required to submit to quarterly network vulnerability scans, as well as filling out a 75-question self-assessment form annually.

Although Visa Australia has confirmed the changes currently apply only to the United States, the local security industry expects the changes to eventually reach Australian shores.

“At this point, no other Visa region has aligned with them,” a local Visa spokesperson said.

Drazen Drazic, general manager of security firm Security-Assessment.com, said organizations that are classified at the higher levels will need to start thinking seriously about the mandate and the ongoing costs.

He said penetration test costs vary depending on each organization, but can start at 17,000 Australian dollars (US$13,000) for review of a small site.

The security audit procedures state these security requirements apply to all system components, defined as any network component, server or application included in, or connected to, the cardholder environment.

“Network components include, but are not limited to, firewalls, switches, routers, wireless access points, network appliances and other security appliances. Servers include, but are not limited to, Web, database, authentication, DNS, mail, proxy and NTP. Applications include all purchased and custom applications, including both internal and external Web applications,” the document states.

By Michael Crawford, Computerworld Australia

Keep checking in at our Security Feed for updated news coverage.