Hi, All!
I just noticed this thread, and thought I'd put in my 2 cents. I designed an osCommerce catalogue this past spring for my existing business, and found that I had to become PCI compliant in order to hook it up with my payment processor, Moneris.
My site is hosted, with SSL, on a shared server with Bell Hosting.
I was worried about the PCI system scan, but my setup passed, and I got hooked up with Moneris's eSelect system, and everything proceeded well.
If you would like more details, I posted them here:
PCI Compliance Inspection - Anyone gone through it?
My only concern now is that stricter PCI regulations apparently came into effect on July 1, and since then, I have not been passing the monthly scans. This has not affected my operations, as Moneris does not require frequent proof of compliance (perhaps eventually they will request a current certificate?). But in the mean time, I'd like to get up to snuff again.
My PCI-certifier is Trustwave (Trustkeeper). They provide a gratifyingly detailed report about their scans, which identified the areas of vulnerability. I forwarded the results to Bell Hosting. They replied that their servers were indeed compliant, and explained that Trustkeeper's protocols included tests that were irrelevant to my particular site.
If I wished to pursue this (as I would be obliged to if Moneris required it), I could get involved with Trustkeeper's appeals process, where they examine the results on a case-by-case basis. I may end up doing this in future. Or, Bell Hosting may tighten up its security to the point that it passes all scans, irrelevant or not.
I'm sure the hosting folks out there are feeling most frustrated. PCI-certification scans are not standardized, and some companies are much more conservative than others. Then again, some hosting companies are much more lax than others. This leaves folks like us merchants smack dab in the middle.
I guess it's all part of the process of using newish technology to perform somehat risky business. Maybe it will be easier for our children and grandchildren.
Happy to say I'm still enjoying doing business!
~Wendy
Edited by WoodsWalker, 13 August 2008, 15:18.
0
