payments - Retail Systems

GT: So you’ve got the token, you can send the token into the
cloud and have the cloud de-tokenise it and read the card data
to the bank without the agent listening to that information.
AH: But a chargeback when a customer says: ‘I didn’t make
this purchase’ the acquirer themselves send you the full card
number to query the transaction. That’s the example I was
talking about, the only time I can think of that having card
data is valid.
GT: Again we’ve got to educate the acquirers on this. I know
they email you with this information but some of the acquirers
are the least PCI compliant organisations. They should be looking
at their systems as well because there’s no reason why they
can’t provide that information via your cloud tokenised provider
– they give you the token and you then have to match to that.
Your challenge is as soon as you bring the card data back into
your environment that all the advantages of getting to an SAQ
A, or an SAQ C, all go out the window because you’re now back
into an SAQ D because you’ve now got a process that is managing
card data.
MG: What Alex was saying obviously has a lot of technical
advantages in that it reduces the scope and allows you to do
a simpler SAQ. But if you look at requirement 12.A, managing
your third parties, and then you look at the proposals of the
DPA in the new data protection regulation, it’s putting a lot of
emphasis on the fact that in the past the data controller was
ultimately responsible. Now the data controller and the data
processor can also be held responsible. As Jeremy said, for once
in your life you have to read the contract to see where your
liability stops and starts. I think that if acquiring banks are going
to write to their merchants or to use compliance validation
portals to promote outsource solutions for tokenisation and
point-to-point encryption and so on, they also need to promote
the fact that outsourcing has risks and that needs to be in your
risk dashboard and it needs to be fully managed.
GT: Well that’s where we have to say: ‘Well done to PCI’ because
it’s actually found a way to get that external provider audited on
an annual basis and to ensure that they stay compliant between
those two audit point. That’s probably one of the best things
that’s happened within the security industry because now we do
have a standard.
JK: If you want to use a service provider who claims they are PCI
approved, ask them for their certificate. If they have it they will
give it to you because they’re pleased as punch to have it. And if
they don’t give it to you, then you just go to another provider.
“Make sure your provider is PCI approved. ”
AY: I think that’s quite an important point to get across to
the Retail Systems readers, because they won’t necessarily
know what to look for. If you were going to write a list of the
top five things you need to know about PCI, ensuring that
your provider is approved or certified is probably up there
at number one.
roundtable
JK: If you’re going to go and deal with a payments service provider,
absolutely. Ask them to prove their credentials.
AY: So, number one – PCI can be a hassle – outsource it. And
number two – make sure your provider is certified.
JK: Absolutely.
CP: There’s three things that a merchant or a supplier should
have; a certificate of compliance, an attestation of compliance
and a ROC – record of compliance. This is very important. The
middle one, the attestation of compliance is the jewel in the
crown because no company will ever give you their ROC because
that’s confidential information. The certification of compliance
is just a certificate that the QSA can produce but the real gem,
that PCI requires to be completed, is the attestation. It tells you
exactly what has been audited, what has been assessed, even
within the different environments.
GT: And the same applies for tool lenders. And with the
attestation comes an implementation guide which the QSA
has written. So if you’re deploying a certain tool it tells you
exactly how it needs to be deployed in your environment to
remain PCI compliant. It’s not enough to say that you’ve got
an assessed tool there; it’s only if it’s deployed in a certain way
that it is compliant.
RS
June - July 2012 RS 37