pci compliance protecting consumer data
DESCRIPTION
PCI Compliance Protecting Consumer Data. Fast Transact, Inc. is a registered ISO/MSP for Bank of America, N.A. Charlotte, N.C. and Wells Fargo Bank, N.A. Walnut Creek, C.A. Fast Transact, Inc | 2590 Willamette Dr NE, 2nd Floor | Lacey WA 98516 | 800.687.8505 / fax 360.357.1425. - PowerPoint PPT PresentationTRANSCRIPT
KioskCom 2008KioskCom 2008Fast Transact, Inc | 2590 Willamette Dr NE, 2nd Floor | Lacey WA 98516 | 800.687.8505 / fax 360.357.1425
Fast Transact, Inc. is a registered ISO/MSP for Bank of America, N.A. Charlotte, N.C. and Wells Fargo Bank, N.A. Walnut Creek, C.A.
PCI CompliancePCI ComplianceProtecting Consumer DataProtecting Consumer Data
KioskCom 2008KioskCom 2008
A Brief HistoryA Brief History
PCI CompliancePCI Compliance
KioskCom 2008KioskCom 2008
PCI = The Payment Card IndustryPCI = The Payment Card Industry
Comprised of the 5 major payment-card brands:
Visa International
MasterCard Worldwide
American Express
Discover Financial Services
JBC
KioskCom 2008KioskCom 2008
In 2005, they formed the PCI Security Standards CouncilIn 2005, they formed the PCI Security Standards Council
Main Objectives:
Creation, ownership, and management of the PCI DSS (Data Security Standard)
Classify audit requirements to certify compliance
Provide a certification process for compliance assessors and network scanning vendors
KioskCom 2008KioskCom 2008
The PCI DSS comprises a common set of industry tools and measurements designed to ensure the safe handling of sensitive consumer information.
In January of 2007, Visa introduced its Payment Application Best Practices (Visa PABP).
This broadened the scope of PCI DSS compliance to include any third-party payment application.
Third-party payment applications include payment gateways and ANY third-party software that store, processes or transmits credit/debit card data.
KioskCom 2008KioskCom 2008
According to an October 23, 2007 Visa Bulletin, the PCI Security Standards Council has adopted Visa’s PABP program and will be releasing the standard as the Payment Application Data Security Standard during 2008.
KioskCom 2008KioskCom 2008
Q: Where does my company fit into the PCI DSS?
Unlike other regulatory programs, compliance with the PCI DSS relies on the merchant to perform a self-assessment to determine if they are compliant.
MerchantLevel Description
1
Any merchant – regardless of acceptance channel – processing over 6,000,000 Visa transactions per year.
Any merchant that Visa, at it sole discretion, determines should meet the Level 1 merchant requirements to minimize risk to the Visa system.
2Any merchant – regardless of acceptance channel – processing 1,000,000 to 6,000,000 Visa transactions per year.
3Any merchant processing 20,000 to 1,000,000 Visa e-commerce transactions per year.
4
Any merchant processing fewer than 20,000 Visa e-commerce transactions per year, and all other merchants – regardless of acceptance channel – processing up to 1,000,000 Visa transactions per year.
KioskCom 2008KioskCom 2008
Compliance Requirements by Merchant Level
LevelValidation
Action Description
1
Annual On-site PCI Data Security Assessment
Quarterly Network Scan
Qualified Security Assessor or Internal Audit if signed by Officer of the company
Approved Scanning Vendor
2 Annual PCI Self-Assessment Questionnaire
Quarterly Network Scan
Merchant
Approved Scanning Vendor
3 Same as Level 2 Same as Level 2
4
Annual PCI Self-Assessment Questionnaire
Quarterly Network Scan
Merchant
Approved Scanning Vendor
KioskCom 2008KioskCom 2008
Compliance Time LineCompliance Time Line
PCI DSS 1.1 sets an enforcement date for acquirers to validate PCI compliance for Level 1 and Level 2 merchants.
The enforcement dates are as follows:
LEVEL 1 MERCHANTS: September 30, 2007
New LEVEL 1 MERCHANTS: 1 year after identification as Level 1
LEVEL 2 MERCHANTS: December 31, 2007
New LEVEL 2 MERCHANTS: September 20, 2007
LEVEL 1 and LEVEL 2 MERCHANTS: Prohibited Data Retention Attestation form, or Confirmation of Report Accuracy to acquirer by March 31, 2007
LEVEL 3 MERCHANTS: contact acquirer
LEVEL 4 MERCHANTS: Must have compliance plan submitted, via acquirer, to Visa by July 30, 2007
KioskCom 2008KioskCom 2008
Q: I use third-party software that has transaction processing imbedded. How do I ensure my software is compliant with the most up-to-date PABP and PA DSS requirements?
KioskCom 2008KioskCom 2008
The full list of PABP validated payment applications can be found at:
Visa.com – PABA Validated List
An annual validation is required for those payment applications with major upgrade or product version changes.
If there are no changes to the product, Visa will require a letter signed by an Officer of the software company indicating no changes to the payment application and continued adherence to the Payment Application Best Practices.
KioskCom 2008KioskCom 2008
Not only have the PCI DSS deadlines come and gone, new mandates have gone into effect to enforce payment applications to adhere to the PABP.
As of January 1, 2008, acquirers must not board new merchants that use known vulnerable payment applications. By October 1, 2008 ALL merchant levels MUST be PCI DSS compliant OR use a PABP-compliant application.
KioskCom 2008KioskCom 2008
The ImpactThe Impact of of
Non-complianceNon-compliance
KioskCom 2008KioskCom 2008
Q: “I am non-compliant . . . so what! What can happen to me?”
Level 1 and 2 merchant can be charged $5k to $25k PER MONTH of non-compliance status.
If a security breach is not reported to Visa in a timely manner, a $100k – 500k fine can be levied.
If a full card number is stored OR provided on a customer receipt the merchant can be fined $100 - $1,000 PER TRANSACTION.
KioskCom 2008KioskCom 2008
It’s generally believed that these fines are never imposed, that they exist to “scare” merchants.
In 2006, Visa levied $4.6 million in fines, up from a 2005 total of $3.4 million, to its acquirers.
$$$ WRONG $$$$$$ WRONG $$$
KioskCom 2008KioskCom 2008
Have you ever heard of TJ Maxx or Marshalls?
December 2007, TJX (parent company of TJ Maxx, Marshall’s and other discount retailers) alerted Law Enforcement that more than 45 million consumer records were stolen by data thieves.
Since then, they have spent more than $20m on investigation, consumer notification, and an expert legal team to protect them against the multitude of lawsuits the breach generated.
KioskCom 2008KioskCom 2008
March 27, 2008:
The FTC ruled that TJX was in violation of the “FTC Act of 1914,” by failing to employ reasonable measures to protect the sensitive consumer information on its networks.
The March 2008 ruling will help acquirers and other transaction processors become less liable for breaches caused by poor security on the part of their merchant or sales organization.
KioskCom 2008KioskCom 2008
As reported by InformationWeek.com, in-store computer kiosks are partly to blame.
The kiosks allowed individuals to apply for jobs electronically; however, the kiosks were not protected by a firewall and therefore acted as a gateway into the company’s IT systems.
Even though the kiosks were NOT performing transactions, they provided a way for data thieves to get to credit card information through unsecured USB ports.
KioskCom 2008KioskCom 2008
Historically, acquirers are responsible for any fines incurred due to non-PCI DSS compliant merchants.
August 1, 2008: The Plastic Card Security Act of Minnesota takes effect.
This legislation marks the first time that the cost associated with data breaches has shifted from the financial institutions to the retailers that mishandle consumer financial data.
KioskCom 2008KioskCom 2008
PCI “Lessons”PCI “Lessons”
KioskCom 2008KioskCom 2008
Important lessons regarding PCI DSS and PABP:
Look for weak links within your organization’s network. If you don’t find them someone else will.
Fines are real. They can and will be levied against those not complying with the PCI Security Standards.
and most importantly . . . customer data cannot be stolen if merchants are not retaining it!
KioskCom 2008KioskCom 2008
FTI PROGRAM CONTACTS:FTI PROGRAM CONTACTS:
Terry Roberts Adriane Armbruster
Director of Software Integration Senior Account Executive
800-687-8505 ext. 126 800-687-8505 ext. 106
FTI POST-SALE CONTACTS:FTI POST-SALE CONTACTS:
Fast Transact, Inc2590 Willamette Dr NE,2nd FloorLacey WA 98516Phone: 360.357.1400Toll Free: 800.687.8505Fax: [email protected]
Customer ServiceMonday - Friday 6 am - 11 pm (PST)Phone: 360.357.1400Toll Free: [email protected]
Technical SupportMonday - Friday 6 am - 11pm (PST)Phone: 360.357.1400Toll Free: 800.687.8505 [email protected]
Contact List
KioskCom 2008KioskCom 2008
Bibliography
Greenemeir, Larry. “The TJX Effect.” Information Week. 11 Apr 2007. Information Week. 8 Nov 2007. www.informationweek.com
“FTC Files Settlement Agreement with TJX.” TheGreenSheet.com. 28 Mar 2008. 1 Apr 2008. www.greensheet.com
Visa Announces New Payment Application Security Mandates. VISA International. VISA International, 2007.
Wollenhaupt, Gary. “PCI Standards Weight Heavy on ATMs, Kiosks.” Self Service World. 4 Jun 2007. Irvington Writers Studio. 8 Nov 2007. www.selfserviceworld.com
Payment Card Industry (PCI) Data Security Standard. PCI Security Standards Council. Wakefield, MA: PCI Security Standards Council, 2006.
“Fine Data.” PCI Compliance Guide. 3 Apr 2008. www.pcicomplianceguide.org
“Cardholder Information Security Program.” Visa International. 3 Apr 2008. www.visa.com