How Join Digital Supports PCI Compliance

Join Digital provides an enterprise-grade, secure network and WiFi solution designed to assist businesses in achieving Payment Card Industry Data Security Standard (PCI DSS) compliance.

Overview

Join’s WiFi and Wired technology incorporates robust security measures that adhere to PCI DSS guidelines, ensuring safe transmission of cardholder data across Join’s networks.

Join’s network infrastructure is fully owned and managed by Join, ensuring that communication is restricted to Join’s network elements only. Access Points are authenticated before connecting to the network and communicating. Additionally, any access to the cardholder data environment or transmission of cardholder data does not pass through the Join Cloud, meaning Join’s Cloud services are outside the scope of your PCI audit.

Join is also in the process of obtaining SOC2 Type 2 certifications and has completed the PCI DSS 3.0 self-assessment questionnaire.

PCI DSS outlines specific requirements to protect cardholder data, including those focused on network security. Below is a summary of key network-related requirements and how Join’s solution addresses them.

Secure Network Configuration (PCI DSS Requirements 1 & 2)

  • Firewall Configuration: Join Digital implements robust firewalls to safeguard payment systems by controlling network traffic. Firewalls are maintained to protect sensitive data, particularly between the internet and internal networks, as well as between the wireless network and cardholder data environments (CDE).
  • Network Segmentation: Join isolates the CDE from guest and corporate networks, which helps reduce risk. While segmentation is not mandatory, it’s recommended as a strategy to reduce the scope of PCI DSS assessments. Join supports both physical and firewall-based segmentation to separate wireless networks from CDEs.
  • No Default Credentials: All network devices are configured with unique, strong credentials to eliminate risks associated with default settings.

Encryption & Secure Transmission (PCI DSS Requirements 3 & 4)

  • End-to-End Encryption: Join Digital ensures secure transmission by using WPA3-Enterprise encryption for WiFi authentication and TLS/SSL encryption for data transmission. 
  • Intrusion Detection & Prevention: Join monitors wireless traffic for anomalies and unauthorized access, employing advanced Intrusion Detection/Prevention Systems (IDS/IPS) to protect network integrity. Unused network ports are also locked down and continuously monitored.

Develop and Maintain Secure Systems and Applications (PCI DSS Requirement 6)

  • Regular Patching and Updates: Join Digital ensures that all systems are regularly patched and updated to protect against emerging vulnerabilities. This practice ensures that any known security flaws are promptly addressed to maintain the integrity of the network.
  • Secure Coding Practices: Join follows secure coding standards and best practices during the development of network management applications. This includes conducting code reviews and vulnerability assessments to prevent application-level vulnerabilities such as SQL injection or cross-site scripting (XSS), which could otherwise compromise security.

Access Control & Authentication (PCI DSS Requirements 7 & 8)

  • Role-Based Access Control (RBAC): Only authorized personnel have access to network management systems.
  • Multi-Factor Authentication (MFA): Strong authentication mechanisms ensure only authorized users can make changes to WiFi configurations.
  • Unique User IDs: Every network administrator and user is assigned a unique identifier to track and control access effectively.

Monitoring & Logging (PCI DSS Requirements 10 & 11)

  • Real-Time Monitoring: Join’s network monitoring platform tracks network activity continuously to ensure compliance with security standards.
  • Audit Logs & Retention: All access and network modifications are logged and retained for audit purposes in compliance with PCI DSS.
  • Vulnerability Scanning: Join regularly conducts scans to identify potential weaknesses in wireless security configurations.

Regular Testing & Risk Management (PCI DSS Requirement 12)

  • Penetration Testing: Join performs regular security assessments to identify and mitigate vulnerabilities.
  • Security Awareness Training: Employees are regularly trained on secure WiFi usage and PCI DSS compliance.
  • Incident Response Plan: Join has a comprehensive incident response framework to manage and address security breaches effectively.

 

Join Digital integrates security best practices with compliance frameworks to ensure that businesses can meet PCI DSS requirements. Our managed solutions provide secure connectivity, proactive threat detection, and continuous monitoring to protect cardholder data from evolving cyber threats.