slide1 n.
Download
Skip this Video
Loading SlideShow in 5 Seconds..
PCI Compliance Protecting Consumer Data PowerPoint Presentation
Download Presentation
PCI Compliance Protecting Consumer Data

Loading in 2 Seconds...

play fullscreen
1 / 23

PCI Compliance Protecting Consumer Data - PowerPoint PPT Presentation


  • 106 Views
  • Uploaded on

PCI Compliance Protecting Consumer Data. Fast Transact, Inc. is a registered ISO/MSP for Bank of America, N.A. Charlotte, N.C. and Wells Fargo Bank, N.A. Walnut Creek, C.A. Fast Transact, Inc | 2590 Willamette Dr NE, 2nd Floor | Lacey WA 98516 | 800.687.8505 / fax 360.357.1425.

loader
I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
capcha
Download Presentation

PowerPoint Slideshow about 'PCI Compliance Protecting Consumer Data' - brenna


An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript
slide1

PCI Compliance

Protecting Consumer Data

KioskCom 2008

Fast Transact, Inc. is a registered ISO/MSP for Bank of America, N.A. Charlotte, N.C. and Wells Fargo Bank, N.A. Walnut Creek, C.A.

Fast Transact, Inc | 2590 Willamette Dr NE, 2nd Floor | Lacey WA 98516 | 800.687.8505 / fax 360.357.1425

pci the payment card industry
PCI = The Payment Card Industry

Comprised of the 5 major payment-card brands:

  • Visa International
  • MasterCard Worldwide
  • American Express
  • Discover Financial Services
  • JBC

KioskCom 2008

in 2005 they formed the pci security standards council
In 2005, they formed the PCI Security Standards Council

Main Objectives:

  • Creation, ownership, and management of the PCI DSS (Data Security Standard)
  • Classify audit requirements to certify compliance
  • Provide a certification process for compliance assessors and network scanning vendors

KioskCom 2008

slide5

The PCI DSS comprises a common set of industry tools and measurements designed to ensure the safe handling of sensitive consumer information.

  • In January of 2007, Visa introduced its Payment Application Best Practices (Visa PABP).
  • This broadened the scope of PCI DSS compliance to include any third-party payment application.
  • Third-party payment applications include payment gateways and ANY third-party software that store, processes or transmits credit/debit card data.

KioskCom 2008

slide6

According to an October 23, 2007 Visa Bulletin, the PCI Security Standards Council has adopted Visa’s PABP program and will be releasing the standard as the Payment Application Data Security Standard during 2008.

KioskCom 2008

slide7

Q: Where does my company fit into the PCI DSS?Unlike other regulatory programs, compliance with the PCI DSS relies on the merchant to perform a self-assessment to determine if they are compliant.

KioskCom 2008

slide9

Compliance Time LinePCI DSS 1.1 sets an enforcement date for acquirers to validate PCI compliance for Level 1 and Level 2 merchants.The enforcement dates are as follows:

  • LEVEL 1 MERCHANTS: September 30, 2007
  • New LEVEL 1 MERCHANTS: 1 year after identification as Level 1
  • LEVEL 2 MERCHANTS: December 31, 2007
  • New LEVEL 2 MERCHANTS: September 20, 2007
  • LEVEL 1 and LEVEL 2 MERCHANTS: Prohibited Data Retention Attestation form, or Confirmation of Report Accuracy to acquirer by March 31, 2007
  • LEVEL 3 MERCHANTS: contact acquirer
  • LEVEL 4 MERCHANTS: Must have compliance plan submitted, via acquirer, to Visa by July 30, 2007

KioskCom 2008

slide10

Q: I use third-party software that has transaction processing imbedded. How do I ensure my software is compliant with the most up-to-date PABP and PA DSS requirements?

KioskCom 2008

the full list of pabp validated payment applications can be found at visa com paba validated list
The full list of PABP validated payment applications can be found at:Visa.com – PABA Validated List
  • An annual validation is required for those payment applications with major upgrade or product version changes.
  • If there are no changes to the product, Visa will require a letter signed by an Officer of the software company indicating no changes to the payment application and continued adherence to the Payment Application Best Practices.

KioskCom 2008

slide12

Not only have the PCI DSS deadlines come and gone, new mandates have gone into effect to enforce payment applications to adhere to the PABP.As of January 1, 2008, acquirers must not board new merchants that use known vulnerable payment applications. By October 1, 2008 ALL merchant levels MUST be PCI DSS compliant OR use a PABP-compliant application.

KioskCom 2008

q i am non compliant so what what can happen to me
Q: “I am non-compliant . . . so what! What can happen to me?”
  • Level 1 and 2 merchant can be charged $5k to $25k PER MONTH of non-compliance status.
  • If a security breach is not reported to Visa in a timely manner, a $100k – 500k fine can be levied.
  • If a full card number is stored OR provided on a customer receipt the merchant can be fined $100 - $1,000 PER TRANSACTION.

KioskCom 2008

slide15

It’s generally believed that these fines are never imposed, that they exist to “scare” merchants.In 2006, Visa levied $4.6 million in fines, up from a 2005 total of $3.4 million, to its acquirers.

KioskCom 2008

slide16

Have you ever heard of TJ Maxx or Marshalls? December 2007, TJX (parent company of TJ Maxx, Marshall’s and other discount retailers) alerted Law Enforcement that more than 45 million consumer records were stolen by data thieves.Since then, they have spent more than $20m on investigation, consumer notification, and an expert legal team to protect them against the multitude of lawsuits the breach generated.

KioskCom 2008

slide17
March 27, 2008:
  • The FTC ruled that TJX was in violation of the “FTC Act of 1914,” by failing to employ reasonable measures to protect the sensitive consumer information on its networks.
  • The March 2008 ruling will help acquirers and other transaction processors become less liable for breaches caused by poor security on the part of their merchant or sales organization.

KioskCom 2008

as reported by informationweek com in store computer kiosks are partly to blame
As reported by InformationWeek.com, in-store computer kiosks are partly to blame.
  • The kiosks allowed individuals to apply for jobs electronically; however, the kiosks were not protected by a firewall and therefore acted as a gateway into the company’s IT systems.
  • Even though the kiosks were NOT performing transactions, they provided a way for data thieves to get to credit card information through unsecured USB ports.

KioskCom 2008

slide19
Historically, acquirers are responsible for any fines incurred due to non-PCI DSS compliant merchants.
  • August 1, 2008: The Plastic Card Security Act of Minnesota takes effect.
  • This legislation marks the first time that the cost associated with data breaches has shifted from the financial institutions to the retailers that mishandle consumer financial data.

KioskCom 2008

pci lessons

PCI “Lessons”

KioskCom 2008

important lessons regarding pci dss and pabp
Important lessons regarding PCI DSS and PABP:
  • Look for weak links within your organization’s network. If you don’t find them someone else will.
  • Fines are real. They can and will be levied against those not complying with the PCI Security Standards.

and most importantly . . . customer data cannot be stolen if merchants are not retaining it!

KioskCom 2008

contact list
Contact List

FTI PROGRAM CONTACTS:

FTI POST-SALE CONTACTS:

KioskCom 2008

bibliography
Bibliography
  • Greenemeir, Larry. “The TJX Effect.” Information Week. 11 Apr 2007. Information Week. 8 Nov 2007. www.informationweek.com
  • “FTC Files Settlement Agreement with TJX.” TheGreenSheet.com. 28 Mar 2008. 1 Apr 2008. www.greensheet.com
  • Visa Announces New Payment Application Security Mandates. VISA International. VISA International, 2007.
  • Wollenhaupt, Gary. “PCI Standards Weight Heavy on ATMs, Kiosks.” Self Service World. 4 Jun 2007. Irvington Writers Studio. 8 Nov 2007. www.selfserviceworld.com
  • Payment Card Industry (PCI) Data Security Standard. PCI Security Standards Council. Wakefield, MA: PCI Security Standards Council, 2006.
  • “Fine Data.” PCI Compliance Guide. 3 Apr 2008. www.pcicomplianceguide.org
  • “Cardholder Information Security Program.” Visa International. 3 Apr 2008. www.visa.com

KioskCom 2008