Maintaining PCI Compliance Through Innovation

February 2018 Maintaining PCI Compliance Through Innovation An article by Angela K. Hipsher-Williams, CISA, QSA, and Jonathan J. Sharpe, CISA, QSA Audit / Tax / Advisory / Risk / Performance Smart decisions. Lasting value.™ Maintaining PCI Compliance Through Innovation The ascendance of online retailers and mobile ordering has created a hypercompetitive environment for purveyors of consumer products and services. Customers today expect a frictionless, “endless aisle” ordering experience, where any item they can think of is instantly orderable, if not instantly accessible. Customers’ demand for instant gratification PCI Compliance is not limited to the online environment. Traditional retailers and restaurants are Stricter Than Ever thus being forced to innovate in a variety While new payment solutions offer flexibility of ways to try to replicate the online and convenience for patrons, these customer experience. Particularly ripe innovations have security and compliance for innovation is the process of ordering implications for merchants and customers and paying for goods and services, alike. Recent large-scale payment card but payment innovations come with breaches have laid bare some of the a number of pitfalls when it comes to risks, and in response, PCI compliance payment card industry (PCI) compliance. requirements have become stricter than ever. Organizations must fully evaluate the implications of implementing new payment technologies, weighing convenience against cybersecurity risk. Devoting adequate resources to data security and protecting the confidentiality of customer payment card numbers are essential. 2 February 2018 Changing the Scope of PCI Compliance Review With a traditional point-of-sale (POS) • How do the benefits to customer transaction – in which a customer swipes or experience weigh against the impact on manually enters card information into a POS security of the larger payment process, device or card reader – the card number and do the benefits justify the risks? goes through an organization’s network • Does the organization have dedicated as an unencrypted, 16-digit number. All internal resources who understand locations and flows of cardholder data on the different payment methods and an organization’s network are considered options for addressing security threats “in scope” for PCI compliance review and inherent in each? must be reviewed against PCI requirements. • What is the data flow of card information over the internal network and how is it A number of emerging payment methods transmitted over the internet? either expand or reduce the scope of PCI • Is the development of the application compliance. For retailers and restaurants, any happening in-house or through an time payment information is accepted in a new external vendor, and what are the PCI way, changes in scope must be assessed. implications of each? Organizations implementing a new payment • What are the broader PCI implications of method should consider these questions: scope and applicable requirements of the new payment method? crowe.com 3 Maintaining PCI Compliance Through Innovation Emerging Payment Methods Point-to-Point Encryption Readers to the keys to encrypting and decrypting Among the payment methods discussed data, and because of that, the PCI council in this article, the one with the clearest views the path it takes on an organization’s security and compliance benefits is point- network after encryption as out of scope. to-point encryption (P2PE). P2PE relates By reducing the contact the retailer or to card-present transactions and can restaurant has with card information, P2PE shrink the scope of PCI compliance review, solutions reduce the number of systems reducing review time and overhead of the that need to be reviewed for compliance, annual assessments. and also greatly reduce applicable With P2PE readers, payment card PCI requirements from more than 300 information is encrypted the moment it is subrequirements down to just 24. This can received from the customer’s swipe (of cards save organizations time and money on using a magnetic stripe) or dip (chip cards), their overall compliance efforts while also meaning card numbers are immediately improving customer data security. converted into an indecipherable code. The Retailers using P2PE cannot be complacent, code is then sent to the payment processor, however, and must remain vigilant about where it is decrypted and then sent on to the PCI compliance. Many P2PE products and issuing bank. Merchants do not have access solutions are PCI compliant, but they can be implemented in a noncompliant fashion. For example, retailers can inadvertently bypass the benefits of the P2PE technology if they do not control the payment application they’re using to make sure every transaction is entered properly (e.g., card information entered into the text field in the app instead of through the PIN pad will not be properly encrypted). To Reduce Risk: Retailers should follow vendor P2PE implementation guidelines explicitly to make sure they can reap the benefits of the product. Additionally, retailers and restaurants should ensure their business processes include cardholder data only being entered into the card reader itself for P2PE solutions. 4 February 2018 Mobile Point of Sale Pay-Ahead and Mobile Ordering Mobile POS technology unshackles the point With pay-ahead and mobile ordering, of sale from the old-school, fixed register at customers can order something before the front of the store. For larger merchants, they go to a store or restaurant and pick it this allows sales associates to sell products up without having to wait while the order is or research inventory from anywhere in the fulfilled and processed. store. Merchants also can use mobile POS devices to collect payments from customers – As these advance transactions all are done a common application for smaller merchants. on the internet, merchants and restaurants need to understand the technology and, Any hardware used for a mobile POS in particular, the sequencing of customer transaction must meet PCI compliance data ownership – namely, understanding requirements. Merchants need to consider who has responsibility for customers’ a range of security issues, from how sensitive personal information, which can the device is connecting to the internet, help organizations evaluate where the to who has access to the device and security implications lie. the information it holds, to inventory management of the physical device itself. An additional pitfall for merchants with pay-ahead and mobile ordering is If the device is connected to a wireless signal the false assumption that any outside in the store, someone who compromises vendors managing a part of the process the network potentially could capture the have security covered. The following POS traffic. In addition, stores should section addresses risks associated with consider access restrictions – or the lack third-party vendors. thereof – in place for associates. Associates with unneeded access levels to the payment To Reduce Risk: application or operating system may have Merchants need to be sure they understand the ability to capture card data from the if and at which points they are storing or store’s mobile device and exfiltrate it via transmitting card information in their own email or USB drive. environment as opposed to in that of an outside vendor. To Reduce Risk: Merchants need to consider whether anyone in the store conceivably could compromise the mobile POS technology, as well as what capability malicious actors would have to make unauthorized use of card data. Merchants should then make sure that access rights are restricted appropriately across the organization at both the application and operating system level. crowe.com 5 Maintaining PCI Compliance Through Innovation Outsourced E-Commerce were directed to enter their payment card for Payments information. Not understanding how an outsourced e-commerce data flow works In the case of outsourced e-commerce, can have major security implications, and merchants or restaurants hire an outside merchants often are held accountable for vendor to manage their e-commerce such instances of fraud or noncompliance transactions. Too often, from a security by acquirers/processors and customers. and PCI compliance perspective, an IT department thinks that if e-commerce has been outsourced, there is no risk To Reduce Risk: to its own organization. For example, a Merchants must thoroughly vet outside common arrangement is for a merchant vendors that are managing parts of the to host the marketing side of its website payment process. They also should but redirect customers to a third-party maintain internal staff who thoroughly vendor for actual purchases. In this understand the technology and where case, the customer is entering payment security and PCI compliance accountability card information through the third-party lies throughout the payment process data vendor’s site, and the merchant may thus flow. This commonly is overlooked when falsely presume the security and PCI an organization’s website redirects from its compliance responsibilities of that card page to a third-party vendor payment page number are not its responsibility. at the time of checkout. In these scenarios, the merchant still is responsible for security There have been attacks, however, in and applicable PCI compliance; it must which hijackers have redirected customers ensure it is validating the PCI compliance from the shopping cart on the merchant’s

Load more