1 / 23

PCI Compliance Protecting Consumer Data

PCI Compliance Protecting Consumer Data. Fast Transact, Inc. is a registered ISO/MSP for Bank of America, N.A. Charlotte, N.C. and Wells Fargo Bank, N.A. Walnut Creek, C.A. Fast Transact, Inc | 2590 Willamette Dr NE, 2nd Floor | Lacey WA 98516 | 800.687.8505 / fax 360.357.1425.

brenna
Download Presentation

PCI Compliance Protecting Consumer Data

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. PCI Compliance Protecting Consumer Data KioskCom 2008 Fast Transact, Inc. is a registered ISO/MSP for Bank of America, N.A. Charlotte, N.C. and Wells Fargo Bank, N.A. Walnut Creek, C.A. Fast Transact, Inc | 2590 Willamette Dr NE, 2nd Floor | Lacey WA 98516 | 800.687.8505 / fax 360.357.1425

  2. A Brief HistoryPCI Compliance KioskCom 2008

  3. PCI = The Payment Card Industry Comprised of the 5 major payment-card brands: • Visa International • MasterCard Worldwide • American Express • Discover Financial Services • JBC KioskCom 2008

  4. In 2005, they formed the PCI Security Standards Council Main Objectives: • Creation, ownership, and management of the PCI DSS (Data Security Standard) • Classify audit requirements to certify compliance • Provide a certification process for compliance assessors and network scanning vendors KioskCom 2008

  5. The PCI DSS comprises a common set of industry tools and measurements designed to ensure the safe handling of sensitive consumer information. • In January of 2007, Visa introduced its Payment Application Best Practices (Visa PABP). • This broadened the scope of PCI DSS compliance to include any third-party payment application. • Third-party payment applications include payment gateways and ANY third-party software that store, processes or transmits credit/debit card data. KioskCom 2008

  6. According to an October 23, 2007 Visa Bulletin, the PCI Security Standards Council has adopted Visa’s PABP program and will be releasing the standard as the Payment Application Data Security Standard during 2008. KioskCom 2008

  7. Q: Where does my company fit into the PCI DSS?Unlike other regulatory programs, compliance with the PCI DSS relies on the merchant to perform a self-assessment to determine if they are compliant. KioskCom 2008

  8. Compliance Requirements by Merchant Level KioskCom 2008

  9. Compliance Time LinePCI DSS 1.1 sets an enforcement date for acquirers to validate PCI compliance for Level 1 and Level 2 merchants.The enforcement dates are as follows: • LEVEL 1 MERCHANTS: September 30, 2007 • New LEVEL 1 MERCHANTS: 1 year after identification as Level 1 • LEVEL 2 MERCHANTS: December 31, 2007 • New LEVEL 2 MERCHANTS: September 20, 2007 • LEVEL 1 and LEVEL 2 MERCHANTS: Prohibited Data Retention Attestation form, or Confirmation of Report Accuracy to acquirer by March 31, 2007 • LEVEL 3 MERCHANTS: contact acquirer • LEVEL 4 MERCHANTS: Must have compliance plan submitted, via acquirer, to Visa by July 30, 2007 KioskCom 2008

  10. Q: I use third-party software that has transaction processing imbedded. How do I ensure my software is compliant with the most up-to-date PABP and PA DSS requirements? KioskCom 2008

  11. The full list of PABP validated payment applications can be found at:Visa.com – PABA Validated List • An annual validation is required for those payment applications with major upgrade or product version changes. • If there are no changes to the product, Visa will require a letter signed by an Officer of the software company indicating no changes to the payment application and continued adherence to the Payment Application Best Practices. KioskCom 2008

  12. Not only have the PCI DSS deadlines come and gone, new mandates have gone into effect to enforce payment applications to adhere to the PABP.As of January 1, 2008, acquirers must not board new merchants that use known vulnerable payment applications. By October 1, 2008 ALL merchant levels MUST be PCI DSS compliant OR use a PABP-compliant application. KioskCom 2008

  13. The Impact ofNon-compliance KioskCom 2008

  14. Q: “I am non-compliant . . . so what! What can happen to me?” • Level 1 and 2 merchant can be charged $5k to $25k PER MONTH of non-compliance status. • If a security breach is not reported to Visa in a timely manner, a $100k – 500k fine can be levied. • If a full card number is stored OR provided on a customer receipt the merchant can be fined $100 - $1,000 PER TRANSACTION. KioskCom 2008

  15. It’s generally believed that these fines are never imposed, that they exist to “scare” merchants.In 2006, Visa levied $4.6 million in fines, up from a 2005 total of $3.4 million, to its acquirers. KioskCom 2008

  16. Have you ever heard of TJ Maxx or Marshalls? December 2007, TJX (parent company of TJ Maxx, Marshall’s and other discount retailers) alerted Law Enforcement that more than 45 million consumer records were stolen by data thieves.Since then, they have spent more than $20m on investigation, consumer notification, and an expert legal team to protect them against the multitude of lawsuits the breach generated. KioskCom 2008

  17. March 27, 2008: • The FTC ruled that TJX was in violation of the “FTC Act of 1914,” by failing to employ reasonable measures to protect the sensitive consumer information on its networks. • The March 2008 ruling will help acquirers and other transaction processors become less liable for breaches caused by poor security on the part of their merchant or sales organization. KioskCom 2008

  18. As reported by InformationWeek.com, in-store computer kiosks are partly to blame. • The kiosks allowed individuals to apply for jobs electronically; however, the kiosks were not protected by a firewall and therefore acted as a gateway into the company’s IT systems. • Even though the kiosks were NOT performing transactions, they provided a way for data thieves to get to credit card information through unsecured USB ports. KioskCom 2008

  19. Historically, acquirers are responsible for any fines incurred due to non-PCI DSS compliant merchants. • August 1, 2008: The Plastic Card Security Act of Minnesota takes effect. • This legislation marks the first time that the cost associated with data breaches has shifted from the financial institutions to the retailers that mishandle consumer financial data. KioskCom 2008

  20. PCI “Lessons” KioskCom 2008

  21. Important lessons regarding PCI DSS and PABP: • Look for weak links within your organization’s network. If you don’t find them someone else will. • Fines are real. They can and will be levied against those not complying with the PCI Security Standards. and most importantly . . . customer data cannot be stolen if merchants are not retaining it! KioskCom 2008

  22. Contact List FTI PROGRAM CONTACTS: FTI POST-SALE CONTACTS: KioskCom 2008

  23. Bibliography • Greenemeir, Larry. “The TJX Effect.” Information Week. 11 Apr 2007. Information Week. 8 Nov 2007. www.informationweek.com • “FTC Files Settlement Agreement with TJX.” TheGreenSheet.com. 28 Mar 2008. 1 Apr 2008. www.greensheet.com • Visa Announces New Payment Application Security Mandates. VISA International. VISA International, 2007. • Wollenhaupt, Gary. “PCI Standards Weight Heavy on ATMs, Kiosks.” Self Service World. 4 Jun 2007. Irvington Writers Studio. 8 Nov 2007. www.selfserviceworld.com • Payment Card Industry (PCI) Data Security Standard. PCI Security Standards Council. Wakefield, MA: PCI Security Standards Council, 2006. • “Fine Data.” PCI Compliance Guide. 3 Apr 2008. www.pcicomplianceguide.org • “Cardholder Information Security Program.” Visa International. 3 Apr 2008. www.visa.com KioskCom 2008

More Related