The Payment Card Industry (PCI) Security Standards Council has released a new version, v3.1 and it is mandatory that you verify your systems’ compliance by June 30th 2016 to avoid service interruptions.
Why are we telling you this?
PCI v3.1 will affect all of us and there are steps that we each must take in order assure our information is secure in the coming year. Beginning June 30th 2016, any SSL version (including SSLv3) as well as TLS 1.0 will no longer meet security standards due to vulnerabilities that cannot be amended. Most merchant gateways along with other service providers will soon start disabling SSLv3 and TLS v1.0 connectivity on their servers.
How does this affect my business?
Servers use SSL libraries to connect to merchant gateways and certain other service providers. If the target server disabled an outdated security protocol following PCI requirements, and your server’s SSL library cannot support a newer protocol version, the connectivity may be affected.
What to do?
The first step should be to ensure your server SSL libraries support TLS 1.1 or 1.2. We also encourage you to contact your merchant gateways to determine if their servers will be affected by the upcoming changes published by PCI.
The PCI Security Standards council and ODITech suggest making sure all applications and system patches are up to date.
What happens if I do nothing?
If you are running older OS versions and/or SSL libraries, you may start experiencing failures to connect to your merchant gateway and/or other TLS-enabled service providers. This may result in inability to process credit cards as well as other issues.
What we are doing to help?
In the coming months ODITech will be contacting our dedicated server clients to help facilitate an update or migration of existing servers.
For additional information we recommend the following sources: