payments - Retail Systems

Aqil Nasser, Debenhams’ technical architecture controller,
says the retailer wanted an all-encompassing solution to avoid
having to undergo a complete overhaul of its IT infrastructure
which comprised a mix of systems.
“We wanted a solution from a single provider that would
protect credit cards from the point-of-sale through our
back-end decision support systems, including our merchandising
data warehouse and processing systems,” he says.
The retailer eventually chose a tokenisation solution
fromLiaisonTechnologies which Nasser claims reduced
programming and hardware costs as well as storage
costs. “Because of its ability to run on all of our systems
non-intrusively, we were able to meet all PCI DSS encryption
requirements with minimal effort,” he says.
Mikko Soirola, VP European sales for Liaison Technologies, says
tokenisation is an increasingly popular solution for cardholder
data protection. “This advanced form of encryption is a process
of replacing sensitive data with surrogate values, or tokens,
that can be used within company systems, but not outside of it.
Therefore, like a gambling chip in a casino, the data has no value
when it is taken from its intended location. The benefits of using
tokens include protecting staff and significantly reducing the
need to reengineer installed systems – further reducing costs.”
With so many solutions Soirola says retailers should be asking
questions of their providers such as How does your solution
address the PCI-DSS compliance and scope of audits? How do
you ensure my existing business processes, workflows and
systems can continue operating whilst you implement the
solution and can you offer me any benefits of PII data security
when I move into this phase of my compliance journey?
Of course retailers as well as completing their own selfassessment
questionnaire (SAQ) or undergoing an audit by a QSA
(Qualified Security Assessor) should also ensure their providers
are PCI compliant asking suppliers to provide their certificate
of compliance or checking approved suppliers against lists from
MasterCard and Visa.
“Vendors should have a PA DSS (Payment Application Data
Security Standards) Certificate that proves their application has
been audited by a Qualified Security Assessor (QSA) and Service
Providers should have a Level 1 Service Provider Certificate
again signifying that they have been audited by a QSA and that
their service is PCI DSS compliant,” says Semafone’s Thompson.
PCI compliance remains a complicated and costly process.
“Retailers are starting to appreciate the reputational damage
but there is no link to profits. The success is you don’t suffer
security breaches,” says The Logic Group’s Adams.
But Neira Jones, head of payment security at Barclaycard,
says it is being taken more seriously be retailers. “Four years
ago when I would do a presentation on this I would get an
interested or semi-interested audience of IT managers. Now in
2012 I talk to finance directors, governance and risk directors
PCI DSS supplement
and marketing and PR and legal managers because it has wide
implications. There is definitely more awareness and knowledge
but we do need to move forward more,” she says citing smaller
companies as being particularly at risk.
‘Tick box’ compliance
Andrew Henwood, director at Foregenix, says there is a worrying
trend in SMEs. “It is fair to say the smaller the merchant,
unfortunately, the less likely they are to be working towards
compliance. A “tick-box compliance” attitude is becoming
prevalent. i.e. compliance for the sake of satisfying quotas
rather than addressing the actual underlying risk,” he says.
But the managing director of one such retail business, who
asked not to be named, agrees: “Ultimately you only have to say
you are compliant not be compliant. For small businesses the
ambition is to ensure you are not being charged for not being
compliant,” he says.
PCI compliance is a necessity but one that still more could
be done to simplify the process according to Clive Kahn, CEO
of CardSave: “Frustratingly all too frequently banks relay
the message of PCI compliance in a manner that makes it
unpalatable for the businesses to which it applies. Traditionally
steeped in complex terminology and elaborate acronyms,
compliance has been seen as little more than a paper shuffling
exercise and, for smaller retailers in particular, one that distracts
from their core business activity,” he says.
If achieving true PCI compliance is really the goal there still
seems be more than can be done to help retailers.
RS
June -July 2012 RS 31