Sushila Nair, Product Manager, Managed Security Solutions Group, BT Global Services

The SSC has been clearly enunciating that companies should rationalize the cardholder data they retain and store only the data that is required for a specific time period.  Organizations should isolate, compartmentalize and secure sensitive data to reduce the scope and the cost of PCI compliance.

Organizations have struggled with rationalizing storage of sensitive data.   Not only is there a significant amount of cardholder data – commonly identified as the primary account number, the cardholder name and service code – but there are also a large number of databases and other reasons for storing customer information with cardholder data.   It is challenging enough to find data across multiple databases, but cardholder data has also been found in flat files, mail boxes, and backup tapes.   For example, when Forever 21 commented on their breach, they acknowledged that cardholder data was stolen from a location they didn’t know even stored cardholder data.

So, while understanding how cardholder data is flowing through the network and where it is intentionally stored is one part of a company’s responsibility, knowing where it is being stored unintentionally should also become part of a company’s compliance activities.  Encryption systems are often touted as a panacea to the many problems associated with securing cardholder date but, unfortunately, they are often badly designed, with the most common flaw being that keys are stored on the same system in plain text.

Controls around credit card data storage have often been weak because the focus is on enabling and processing the transaction and not on securing the transaction.  As a result, the SSC commissioned PWC to look at some of the emerging technologies to reduce the scope of PCI DSS and thus making it simpler for organizations to comply.  Among other factors, the solutions looked at by PWC needed to encompass:

• Positive ROI
• Reduction of Scope
• Legacy system compatibility
• Handle chargeback and fraud

Some of the mechanisms examined by the study, which interviewed 125 companies and encompassed more than 150 interviews globally, are:

• Tokenization — The idea behind tokenization is that the sensitive data is substituted with a token—or surrogate value.  Using tokens would concentrate sensitive data in one master database and then replace the card numbers with “tokens” in all the other systems.  The master database would be highly hardened and encrypted and keep track of which token matched which credit card.  Other systems would send the tokens to the master system for processing, which would then interface with the external transaction processing systems.  By limiting occurrences of encrypted data to a central vault, organizations can reduce the number of systems, applications and processes that must be audited for compliance with PCI DSS.  This can dramatically reduce the time and cost required to pass annual compliance audits

• Virtual Terminals — Moving systems to “cloud” style infrastructures enables organizations to focus on their core business and reduce costs.   Virtual Secure Terminals are generally available through browser style technology and form a way to process credit cards so that the processing of the transaction does not occur in the branch, call center, or customer support center, but instead occurs at another central location.  This infrastructure allows the organization to benefit from the security and features available through a third party or a central location.  It can replace or work in conjunction with a Point-of-Sale terminal system.  Virtual terminal users must ensure that the virtual terminal provider they are using is either PABP or PA-DSS validated.

• End-to-end encryption – Following the indictment of Albert Gonzalez for several high profile breaches, there were cries that end-to-end encryption would have prevented the breach from occurring.   Certainly, end-to-end encryption would prevent many data thefts from taking place.  However, several other strategies, including real-time monitoring, would have also detected the breach and decreased its depth.  There can be no doubt that end-to-end encryption would simplify the process of PCI compliance.  The problem currently lies in the lack of standardization surrounding end-to-end encryption and payment systems.  It is possible that by selecting an end-to-end encryption system from a payment processor, the merchant may tie themselves to a single supplier.  The SSC has recognized these issues and is creating a special interest group to advise on standards for interoperability; and Visa has recently released global industry best practices for data field, or end-to-end, encryption.

• Magnetic Stripe Imaging – Magnetic Stripe Imaging collects data from the stripe to prevent fraudulent cards from being used.  It cannot serve as a stand-alone technology to meet PCI requirements.  To be effective, it must be used in combination with other technologies to reduce scope.

• Chip and PIN — It is impossible to talk about securing credit card transactions without mentioning Chip and PIN technology, which is extensively deployed in the rest of the world.  Chip and PIN  technology has signficiantly decreased fraud in card-present transactions.  This technique is successful because the chip is difficult to clone.  In the U.S., the costs associated with upgrading all merchants, processors and banks has prohibited adoption.  A further negative is that Chip and PIN technology does not impact card-not-present and ATM fraud.  SSC has decided that this technology does not merit addtiional research.

Emerging technologies will reduce the scope of PCI.  Organizations with simple payment infrastructures will undoubtedly turn to end-to-end encryption systems provided by payment processors since they are the simplest mechanism to implement.  Smaller organizations will probably turn to virtual terminals and hosted solutions which will reduce the scope of PCI compliance, or remove it entirely from their hands.   Large organizations will likely look to reduce their risk of storage by using a combination of tokenization and encryption as there are many drivers for storing card information, including product returns, rewards and rates on reoccurring transactions.

The technologies associated with protecting sensitive data are relatively young, and while they are proving to be robust, they are not foolproof.  In addition to assessing which of these emerging technologies may prove most valuable to them, organizations need to assess how and when they use data to ensure that information is not being retained simply because it might come in handy without assessing the damage caused when that information is compromised.

http://www2.prnewswire.com/cgi-bin/stories.pl?ACCT=109&STORY=/www/story/09-12-2008/0004884255&EDATE=

http://www.btsecurethinking.com/2009/09/albert-gonzalez-pci-dss/

http://corporate.visa.com/media-center/press-releases/press941.jsp