Why Open Source Drives PCI Nuts
Written by Frank HayesJune 10th, 2010
The big advantage to open-source software is that anyone can change it. And the big disadvantage to open source? Anyone can change it. Case in point: osCommerce, one of the applications on the PCI "Bad Apps" list. It's not a surprise that this open-source app hasn't passed PCI's validation. Considering that it can be changed so easily, would you really want it to?
Most of the software packages on the Bad Apps list come from conventional commercial software vendors. If there's a problem with their applications--specifically, if those apps keep sensitive authentication data after a transaction has been authorized--the vendors are usually quick to create a new version or a patch that solves the problem. Result: Only older versions of the software contain the security problem that makes PCI unhappy. And next to the bad version of the app is a note listing the later versions that don't have the problem.
This Story Is Only Available For Premium Subscribers. Click Or Login In Below To Read The Rest Of This Story.
Already a Subscriber? Login Here
5 Comments | Read Why Open Source Drives PCI Nuts
Leave a Reply
Readers, specifically those who want to comment on a story:
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
-Christine
June 10th, 2010 at 8:04 am
Open Source and PCI can match well together: just to mention upcoming Magento PA-DSS compliance or CRESecure solution.
June 10th, 2010 at 9:50 pm
Hi everyone, I think that if an open source package is modified in any way, that software must be considered, automatically, a custom made application, and must comply with all requirement 6.
June 10th, 2010 at 9:58 pm
That’s the danger. With any kind of modification, the app vendor is no longer responsible and the duty falls directly on the merchant, just as it had been a fully homegrown app.
June 11th, 2010 at 4:42 am
Reminds me on a similar question on custom vendor ( again it was a customized oscommerce solution ). The vendor was asked on the PCI compliance and it was well put in that the bridge may not be established between PCI and software untill the software was finalized ( up and ready for the market ). I think that is the case with most open source software… after Os software is the clay and it can moulded anyway for that matter :).
June 17th, 2010 at 9:25 am
From a customization standpoint, open source software is great. But, paractically speaking, there is no way to audit the software for PA-DSS for that very same reason. We continue to preach ‘outsourcing’ payment acceptance to our open source merchants exclusively to one or more certified 3rd parties which effectively takes the software out of the scope of PCI and the categorization as a payment application. Level 4 merchants should research hosted payment pages, alternative payments, etc. and not rely solely on scans to claim that they are PCI compliant or rely on the shopping cart maker to PA DSS their software, which is clearly not in their basket of expertise.