Credit Card Security

1. Credit Card Security ISM 6331 Des 1, 2003 by Welly Chandrawan

2. Introduction • Credit Card is small and thin plastic card. • Advantage of Credit Card over Debit card. • According to www.wired.com : • Use of Visa card in 1999 is $ 724 billion • 2 percent of $724 is made from online purchase. • Total number will be quintuple in year 2003

3. Visa Security Measurement • The way Visa enhances security in online shopping: • Implementing “network” firewall to all ISPs. • Visa’s merchants have to: • Encrypt flow of data through the network. • Update Antivirus software. • In year 2000, Visa has issued “Data Security” guidelines for all of merchants and ISPs

4. Visa’s New Payer Authentication • The new payer authentication is named “Verified by Visa” • The advantages offered by “Verified by Visa”: • Increasing online transaction security. • Recording purposes and resolving any transaction clashes.

5. How “Verified by Visa” works?

6. Smart Visa Card • A couple years ago, Visa launched Smart Card technology platform. • Visa Smart Card contains microprocessor chip in it. • Visa Smart Card increases level of security capabilities. For example: Fleet Smart Visa card • Implements “Triple Data Encryption Standard (TDES)” • There are 72 quadrillion encryption keys in it.

7. Visa’s Cardholders Information Security Program (CISP) • Two major entities in CISP: • Merchants • Service Providers • The main goal of creating CISP is to help those of entities prevent the mistreatment or abuse of cardholder information. • Lists of 12 basic security requirements in Visa CISP: • Install and maintain a working firewall to protect data. • Keep security patches up-to-date.

8. Cont’ • Protect stored data. • Encrypt data sent across public networks. • Use and regularly update anti-virus software. • Restrict access by “need to know”. • Assign unique ID to each person with computer access • Don’t use vendor-supplied defaults for passwords and security parameters. • Track all access to data by unique ID • Regularly test security systems and processes. • Implement and maintain security policy. • Restrict physical access to data. Note: all of the merchants and service providers have to comply with those of 12 requirements

9. MasterCard Payer Authentication • It is named MasterCard Secure Code. • It works exactly the same with “Verified by Visa”.

10. MasterCard Pay Pass Technology • An enhanced payment technology that contains a hidden built-in computer chip inside and antennae as well • Inside the chip: • All of the information of cardholder • Account Balance as well • The way it works: • Taps MasterCard PayPass in a special PayPass reader. • The card will transmit wirelessly the payment to the reader by using short range radio waves. • The cardholder receives payment confirmation. • Security: Increasing the feeling of security as the cardholders don’t need to hand over the card to the merchants.

11. MasterCard Security Standard • Created in April 2003, MasterCard launches the security standard to Merchants and Service Providers. • Main goal: to act as a guideline for the merchants and MasterCard Service Providers (MSP) in order to participate in the MasterCard Site Data Protection Program (SDP)

12. Cont’ • In SDP, there are six categories of the annual security self-assessment: • Security Management Assessment • Access Control Assessment • Operational Security Assessment • Application and System Development Assessment • Network Security Assessment • Physical Security Assessment Note: All of e-commerce merchants and service providers are required to do those of six annual security assessment.

13. Conclusion • Both Visa and MasterCard give their Cardholder more opportunity to control over where and when their card has been used. • Both Visa’s and MasterCard’s clients (merchants and service providers) have to protect their cardholders’ information.

14. Thanks