payments - Retail Systems

RS
30 RS June - July 2012
supplement PCI DSS
Underlying risk
Many retailers find the requirements for PCI compliance confusing. But even
more worryingly there are some who adopt a ‘tick box’ approach rather than
addressing real security issues, writes Liz Morrell
Any retailer that takes card payments must comply
with the Payment Card Industry Data Security Standards
(PCI DSS) or risk hefty fines. But many feel that the
PCI standards, which comprise a list of 12 requirements covering
both technology and business processes and procedures
surrounding the electronic or manual storage, processing or
transmission of cardholder information, are confusing and
therefore difficult to adhere to. Especially as there are also
different levels of compliance according to the size of a
retail business.
And although the current version of the standard, which is
updated in three yearly cycles, has been in place since October
2010 there have been minor enhancements which retailers have
to keep on top of – for example the announcement in January
of an internal vulnerability assessment which comes into force
at the end of this month and must be completed on a quarterly
basis as well as the necessity for payment applications to also be
compliant with the standard at the same time.
Acquiring banks now have a bigger focus than ever on PCI
compliance and are imposing monthly fines to spur retailers into
achieving compliance.
“The acquirer is tending to give quarterly reports back to
the card schemes who are imposing monthly fines and can also
charge higher transaction charges of retailers because they
view them as an increased threat,” says Robin Adams, director
of security, fraud and risk management at The Logic Group
and also a QAS (qualified assessor) for PCI DSS.
Solution explosion
The stricter enforcement has led to an explosion in technology
vendors rushing to market with PCI solutions and that in itself
can be confusing.
A number of solutions are becoming popular, including
point-to-point encryption (P2Pe), tokenisation and outsourcing.
“Many retailers are now looking at point-to-point encryption
(P2Pe) and tokenisation as potential ways to minimise their
PCI requirements – taking legacy environments out of scope
can dramatically reduce the effort and cost involved,” says a
spokesman for VeriFone.
“For others, who want to reduce the PCI burden even
further, opting for a ‘Payments as a Service’ which involves a
third party managing the entire payments process, can offer a
cost-effective and less-disruptive route to PCI.”
Tony Hammond, product director at Torex, says the ultimate
protection is from using P2PE in conjunction with tokenisation.
“Point to point encryption (P2PE) utilising hardware based
encryption used in conjunction with a tokenisation process not
only secures data but can mitigate up to 70 per cent of PCI
controls,” he says.
Graham Thompson, sales and marketing director at
Semafone, saysremoving card data from retail environmentscan
provide big savings. “As decryption keys are not available to
the merchant this encrypted data can cross their networks
without bringing them into scope for PCI DSS.This can then save
merchants millions of pounds of cost in not having to secure
their networks and information systems to the standard of PCI
DSS,” he says.
Tim Allitt, sales and marketing director at independent
payment processor SecureTrading, says in the world of
e-commerce payment service providers (PSPs) need to help
retailers by giving them different options to help them become
PCI compliant based on the merchant’s requirements.
“For example for small to medium enterprises or larger
companies who prefer to outsource, a hosted payment page
is ideal. The PSP hosts the relevant website page on their own
PCI DSS compliant server. Card data gets captured, transmitted
and stored by the PSP and all the retailer has to do is fill out a
simple self-assessment questionnaire to become compliant, with
no technical work involved for them,” he says. The Logic Group’s
Adams believes that the stricter enforcement of PCI DSS has
come as somewhat of a surprise after its introduction way back
in 2004.
Retailer’s concerns
“Retailers in general find it far more rigorous than they
expected. They find it onerous which is why a lot are
outsourcing it because it’s easier as in a lot of cases merchants
would have to make significant changes to their infrastructure,”
he says. This was a concern for Debenhams when it began a
programme to achieve PCI DSS compliance in 2008.