STORES Magazine - April 2009 - (Page 68) CONSIDER THIS / ARTS UPDATE Best Practices for Protecting Customer Data BY RICHARD MADER The percentage of PCI-compliant retailers continues to rise, yet compromised credit accounts continue to make news. In fact, two of the largest breaches were committed against PCI-certified companies Hannaford and Heartland, so PCI compliance is clearly no silver bullet providing absolute protection of sensitive customer data in the new world of wireless and public networks. applications that used these numbers. The NRF CIO Council, working with ARTS Tokenization significantly reduces the attack and David Taylor of the PCI Knowledge surface of the retailer, as well as the cost and Base, has posted 25 best practices that can effort needed to demonstrate PCI complihelp retailers secure customer data and beance. When combined with network segmencome PCI certified. These best practices tation, confidential data can be isolated and were based on hundreds of hours of anonyaccess to this data much more effectively mous interviews and sharing of success stocontrolled. Companies like MerchantLink, ries from implementers. Several key best EPX, Paymetric or Shift4 offer tokenization practices that retailers can implement that solutions. will reduce their risk of a security breach are Implement end-to-end encryption. Enhighlighted below. crypting card data at the point of transmission Conduct an enterprise application comfrom retailer to payment processor (as repliance review. The principal requirement for quired by PCI-DSS) has proven inadequate controlling access and securing data is because it allows hackers to steal data as it knowing exactly what data is stored where. Richard Mader is executive travels through the retailer’s application from Therefore, the first best practice is to conduct director of ARTS. card swipe to point of transmission. End-toan enterprise application audit that identifies end encryption begins when the card is and locates data designated as confidential. swiped, and data remains encrypted through the entire The audit must document which applications use confidenpayment process. tial data — a big job, since most retailers have huge appliSecure card-readers make this solution possible, and cation portfolios and confidential data is most frequently ARTS UnifiedPOS version 1.12 includes support for secure stored in older applications. card-readers and end-to-end encryption. This method of The results of such an audit become your foundation for encryption offers additional protection to the retailer and protecting customer data and determining which other PCI goes beyond PCI requirements. MagTek, SEMTEK and best practices are right for your company. Further, this Veriphone are among the vendors offering true end-to-end audit will help you prepare for the Payment Application encryption and secure readers. Data Security Standard (PA-DSS), which requires any apOver the next few months, NRF and ARTS will continue plication that uses confidential data to be certified conforto provide actionable information that will enable retailers mant by July 1, 2010. to go beyond PCI compliance in securing customer data. Pilot data tokenization solutions. Tokenization soluWe will expand our PCI best practices with a focus on tions replace credit card numbers with meaningless numupdates to the audit points and new regulations such as bers that have no black market value. Sounds easy, but PA-DSS and PIN Entry Device (PCI-PED) security reit is a real data management problem. Token numbers quirements. are assigned, and the relationship of the real card numARTS and MagTek will present a webcast on achieving ber to the token must be stored in the most confidential maximum protection for customer data on April 29. Regismanner and location. Confidential data must then be ter to attend at www.nrf-arts.org and learn how to protect purged from all existing locations using a semi-automatyour data and your business. ed process to find and replace the confidential data in 68 STORES / APRIL 2009 WWW.STORES.ORG http://www.nrf-arts.org http://WWW.STORES.ORG
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.