PCI Compliance

PCI Compliance Protecting Consumer Data Fast Transact, Inc. is a registered ISO/MSP for Bank of America, N.A. Charlotte, N.C. and Wells Fargo Bank, N.A. Walnut Creek, C.A. Fast Transact, Inc | 2590 Willamette Dr NE, 2nd Floor | Lacey WA 98516 | 800.687.8505 / fax 360.357.1425 KioskCom 2008 A Brief History PCI Compliance KioskCom 2008 PCI = The Payment Card Industry Comprised of the 5 major payment-card brands:  Visa International  MasterCard Worldwide  American Express  Discover Financial Services  JBC KioskCom 2008 In 2005, they formed the PCI Security Standards Council Main Objectives:  Creation, ownership, and management of the PCI DSS (Data Security Standard)  Classify audit requirements to certify compliance  Provide a certification process for compliance assessors and network scanning vendors KioskCom 2008 The PCI DSS comprises a common set of industry tools and measurements designed to ensure the safe handling of sensitive consumer information.  In January of 2007, Visa introduced its Payment Application Best Practices (Visa PABP).  This broadened the scope of PCI DSS compliance to include any third-party payment application.  Third-party payment applications include payment gateways and ANY third-party software that store, processes or transmits credit/debit card data. KioskCom 2008 According to an October 23, 2007 Visa Bulletin, the PCI Security Standards Council has adopted Visa’s PABP program and will be releasing the standard as the Payment Application Data Security Standard during 2008. KioskCom 2008 Q: Where does my company fit into the PCI DSS? Unlike other regulatory programs, compliance with the PCI DSS relies on the merchant to perform a self-assessment to determine if they are compliant. Merchant Level Description Any merchant – regardless of acceptance channel – processing over 6,000,000 Visa transactions per year. Any merchant that Visa, at it sole discretion, determines should meet the Level 1 merchant requirements to minimize risk to the Visa system. Any merchant – regardless of acceptance channel – processing 1,000,000 to 6,000,000 Visa transactions per year. 1 2 3 Any merchant processing 20,000 to 1,000,000 Visa e-commerce transactions per year. Any merchant processing fewer than 20,000 Visa e-commerce transactions per year, and all other merchants – regardless of acceptance channel – processing up to 1,000,000 Visa transactions per year. 4 KioskCom 2008 Compliance Requirements by Merchant Level Level Validation Action  Annual On-site PCI Data Security Assessment 1  Quarterly Network Scan  Annual PCI Self-Assessment Questionnaire  Quarterly Network Scan 3  Same as Level 2  Annual PCI Self-Assessment Questionnaire  Quarterly Network Scan Description  Qualified Security Assessor or Internal Audit if signed by Officer of the company  Approved Scanning Vendor  Merchant  Approved Scanning Vendor 2  Same as Level 2  Merchant  Approved Scanning Vendor 4 KioskCom 2008 Compliance Time Line PCI DSS 1.1 sets an enforcement date for acquirers to validate PCI compliance for Level 1 and Level 2 merchants. The enforcement dates are as follows:      LEVEL 1 MERCHANTS: September 30, 2007 New LEVEL 1 MERCHANTS: 1 year after identification as Level 1 LEVEL 2 MERCHANTS: December 31, 2007 New LEVEL 2 MERCHANTS: September 20, 2007 LEVEL 1 and LEVEL 2 MERCHANTS: Prohibited Data Retention Attestation form, or Confirmation of Report Accuracy to acquirer by March 31, 2007 LEVEL 3 MERCHANTS: contact acquirer LEVEL 4 MERCHANTS: Must have compliance plan submitted, via acquirer, to Visa by July 30, 2007   KioskCom 2008 Q: I use third-party software that has transaction processing imbedded. How do I ensure my software is compliant with the most up-to-date PABP and PA DSS requirements? KioskCom 2008 The full list of PABP validated payment applications can be found at: Visa.com – PABA Validated List  An annual validation is required for those payment applications with major upgrade or product version changes.  If there are no changes to the product, Visa will require a letter signed by an Officer of the software company indicating no changes to the payment application and continued adherence to the Payment Application Best Practices. KioskCom 2008 Not only have the PCI DSS deadlines come and gone, new mandates have gone into effect to enforce payment applications to adhere to the PABP. As of January 1, 2008, acquirers must not board new merchants that use known vulnerable payment applications. By October 1, 2008 ALL merchant levels MUST be PCI DSS compliant OR use a PABP-compliant application. KioskCom 2008 The Impact of Non-compliance KioskCom 2008 Q: “I am non-compliant . . . so what! What can happen to me?”  Level 1 and 2 merchant can be charged $5k to $25k PER MONTH of non-compliance status.  If a security breach is not reported to Visa in a timely manner, a $100k – 500k fine can be levied.  If a full card number is stored OR provided on a customer receipt the merchant can be fined $100 $1,000 PER TRANSACTION. KioskCom 2008 It’s generally believed that these fines are never imposed, that they exist to “scare” merchants. $$$ WRONG $$$ In 2006, Visa levied $4.6 million in fines, up from a 2005 total of $3.4 million, to its acquirers. KioskCom 2008 Have you ever heard of TJ Maxx or Marshalls? December 2007, TJX (parent company of TJ Maxx, Marshall’s and other discount retailers) alerted Law Enforcement that more than 45 million consumer records were stolen by data thieves. Since then, they have spent more than $20m on investigation, consumer notification, and an expert legal team to protect them against the multitude of lawsuits the breach generated. KioskCom 2008 March 27, 2008:  The FTC ruled that TJX was in violation of the “FTC Act of 1914,” by failing to employ reasonable measures to protect the sensitive consumer information on its networks.  The March 2008 ruling will help acquirers and other transaction processors become less liable for breaches caused by poor security on the part of their merchant or sales organization. KioskCom 2008 As reported by InformationWeek.com, in-store computer kiosks are partly to blame.  The kiosks allowed individuals to apply for jobs electronically; however, the kiosks were not protected by a firewall and therefore acted as a gateway into the company’s IT systems.  Even though the kiosks were NOT performing transactions, they provided a way for data thieves to get to credit card information through unsecured USB ports. KioskCom 2008 Historically, acquirers are responsible for any fines incurred due to non-PCI DSS compliant merchants.  August 1, 2008: The Plastic Card Security Act of Minnesota takes effect.  This legislation marks the first time that the cost associated with data breaches has shifted from the financial institutions to the retailers that mishandle consumer financial data. KioskCom 2008 PCI “Lessons” KioskCom 2008 Important lessons regarding PCI DSS and PABP:  Look for weak links within your organization’s network. If you don’t find them someone else will.  Fines are real. They can and will be levied against those not complying with the PCI Security Standards. and most importantly . . . customer data cannot be stolen if merchants are not retaining it! KioskCom 2008 Contact List FTI PROGRAM CONTACTS: Terry Roberts Director of Software Integration  800-687-8505 ext. 126 Adriane Armbruster Senior Account Executive  800-687-8505 ext. 106 FTI POST-SALE CONTACTS: Fast Transact, Inc 2590 Willamette Dr NE, 2nd Floor Lacey WA 98516 Phone: 360.357.1400 Toll Free: 800.687.8505 Fax: 360.357.1425 info@FastTransact.com Customer Service Monday - Friday 6 am - 11 pm (PST) Phone: 360.357.1400 Toll Free: 800.687.8505 support@FastTransact.com Technical Support Monday - Friday 6 am - 11pm (PST) Phone: 360.357.1400 Toll Free: 800.687.8505 support@FastTransact.com KioskCom 2008 Bibliography  Greenemeir, Larry. “The TJX Effect.” Information Week. 11 Apr 2007. Information Week. 8 Nov 2007. www.informationweek.com “FTC Files Settlement Agreement with TJX.” TheGreenSheet.com. 28 Mar 2008. 1 Apr 2008. www.greensheet.com Visa Announces New Payment Application Security Mandates. VISA International. VISA International, 2007. Wollenhaupt, Gary. “PCI Standards Weight Heavy on ATMs, Kiosks.” Self Service World. 4 Jun 2007. Irvington Writers Studio. 8 Nov 2007. www.selfserviceworld.com Payment Card Industry (PCI) Data Security Standard. PCI Security Standards Council. Wakefield, MA: PCI Security Standards Council, 2006. “Fine Data.” PCI Compliance Guide. 3 Apr 2008. www.pcicomplianceguide.org “Cardholder Information Security Program.” Visa International. 3 Apr 2008. www.visa.com       KioskCom 2008