Page 10 - EngineerIT AugustSeptember Issue 2026

FINTECH

OPINION PIECE

Payment security starts with

design, not the audit

hile many businesses still view the Payment architecture shapes risk
Payment Card Industry Data Security exposure
WStandard (PCI DSS) primarily as a The way payment environments
compliance obligation, the reality is that payment are designed determines where
security has a direct impact on operational stability, risk sits across each channel, and
customer trust and commercial resilience. The way different payment channels expose
payment architectures are designed ultimately businesses to different types of risk
determines risk exposure, and without clear depending on how cardholder data
scoping and strong controls, vulnerabilities can is captured and controlled. In-store
quickly emerge. With the guidance of a qualified environments, for example, are typically
PCI DSS expert, organisations can clearly define exposed to physical risks such as
their cardholder data environment, reduce device tampering, substitution and
unnecessary complexity and embed weaknesses in network segmentation
controls that support both security across distributed locations. Online
and performance. When approached payment systems, by contrast,
correctly, PCI DSS becomes a practical are more exposed to automated
framework for continuously managing attacks, including script injection and
risk, controls and monitoring across vulnerabilities introduced through
payment environments rather than third-party components, where a single
a periodic audit exercise. weakness can affect every transaction.

By Johannes Briel, Galix Group IS Manager / PCI DSS QSA

10 | EngineerIT August/September 2026