Changes to the Visa Payment Card Industry Data Security Requirement could force credit card merchants to undertake quarterly network vulnerability scans with costs spiralling into millions of dollars.
Last month Visa made changes to the compliance requirements of "Level 4" merchants. Level 4 merchants typically process between one million and six million credit card transactions annually and since then they are now required to submit to quarterly network vulnerability scans, as well as filling out a 75-question self assessment form annually.
Although Visa Australia has confirmed the changes currently apply only to the US, the local security industry expects the changes to eventually reach Australian shores.
"At this point no other Visa region has aligned with them," a local Visa spokesperson said.
Drazen Drazic, general manager of security firm Security-Assessment.com, said organizations which are classified at the higher levels will need to start thinking seriously about the mandate and the ongoing costs.
He said penetration test costs vary depending on each organization, but can start at $17,000 for review of a small site.
The Security Audit Procedures state these security requirements apply to all system components, defined as any network component, server or application included in, or connected to, the cardholder environment.
"Network components include, but are not limited to, firewalls, switches, routers, wireless access points, network appliances and other security appliances. Servers include, but are not limited to, Web, database, authentication, DNS, mail, proxy and NTP. Applications include all purchased and custom applications, including both internal and external web applications," the document states.