Merchant Link SecurityCents

By Michael Ryan

This week, our team is down in Arizona for the North American PCI Community Meeting.  Each year we look forward to this event as it offers us a chance to network with Qualified Security Assessors (QSAs) and fellow Special Interest Group (SIG) members as well as others in the community and discuss the issues that are facing merchants both big and small.

In fact, the discussions are quite helpful as this is really the time for the PCI Council to outline programs, resources and goals for the coming year.  One of the most interesting aspects is to learn what the Council will provide guidance on next.

Merchant Link has been a part of the SIGs for both tokenization and point-to-point encryption (P2PE) and continues to offer our expertise in an effort to provide guidance to merchants.

We were excited to see that right before the meeting this year, the Council announced guidelines for P2PE focused on hardware-based implementations.  The 96-page document provides guidance on securing systems and devices, implementing monitoring and response processes, developing and maintaining secure applications, protecting sensitive data, and using secure cryptographic key management methodologies.  Interestingly enough, the Council has said that even with these guidelines, merchants should only use applications that have been validated to be PCI compliant.  This list is targeted to post on their website in spring 2012.

Perhaps, this delay, along with the delays for the tokenization guidelines and virtualization guidelines is why the Council is taking a new approach to SIGs.  For 2012, the SIGs will be manned by a Council member to ensure that the group stays on task and will only have a term of 12 months.

Over the last couple months, many proposals were made for what guidance should come next.  The proposals were short-listed and voting will take place on the PCI portal.  I’m looking forward to seeing what’s on the agenda for next year.

Originally published by SC Magazine, reported by Angela Moscaritolo

The use of a tokenization solution does not eliminate a merchant’s need to validate compliance with the Payment Card Industry Data Security Standard (PCI DSS), the industry group responsible for managing payment security guidelines said in a new document released Friday.

“The misconception is that I can buy one of these [tokenization solutions] and be PCI compliant,” Bob Russo, general manager of the PCI Security Standards Council, told SCMagazineUS.com. “That’s not the case.”

A mature and properly deployed tokenization solution can, however, simplify the requirements of PCI DSS by taking systems that no longer contain sensitive credit card numbers out of the scope of the standard, according to the 23-page supplement released by the PCI Council.

Meanwhile, Sue Zloth, product group manager at payment data security provider Merchant Link, a member of the PCI Council’s tokenization task force, told SCMagazineUS.com on Friday that she believes the document is a good first step, though it may lead to some confusion and deter adoption.

Zloth took issue with a section that discusses the need to evaluate whether a token itself could be used – in lieu of cardholder data – to perform a transaction.

The document states that so-called “high-value tokens,” which can be used as a form of payment, could be monetized by an attacker or used to generate fraudulent transactions.

The council introduced a valid concern –  that certain tokens could be valuable to attackers — but “fell down” by failing to describe how a tokenization system could adequately protect tokens from being fraudulently used, Zloth said.

“A properly implemented system will know who is sending transactions and will not allow anyone to send transactions with a token,” she added.

To read this full story go to http://www.scmagazineus.com/pci-council-releases-tokenization-guidance/article/209505/

By Sue Zloth

Call it what you will – Tokenization in the Cloud or Tokenization as a Service.  No matter what you call it, the bottom line is removing sensitive cardholder data completely from the merchant’s IT environment and reducing the scope of PCI DSS.

It is an approach that we have been behind for nearly a decade, through the many variations of terminology.  Ultimately, we believe strongly that keeping card numbers within an enterprise is a security liability.

But don’t just take it from us.  Others in the industry are beginning to understand that need to take tokenization into the cloud and are beginning to offer solutions in this area and the analyst community is also nodding their heads in agreement.  It is expected that tokenization in the cloud will become a common strategy for enterprises.

We live and breathe tokenization and encryption so it is always a bright spot when we see the industry embracing this technology and the cloud approach to tokenization.

As part of the Special Interest Group (SIG) for the PCI Council, we expect to provide merchants with formal guidance on the technology shortly.  We hope that the documents will offer a better understanding for the types of tokenization and ways to implement the technology.  In the meantime, if you have questions about different approaches, feel free to drop me a comment below.

By Sue Zloth

Last fall the PCI Council announced guidance on point-to-point encryption (P2PE) to help merchants protect their customers’ payment card information. Since then, merchants have had P2PE implementation on their minds.

Recently I’ve been a part of a working group that is evaluating technologies and determining the best ones to secure payment transactions and help reduce scope for PCI. One thing that’s becoming clear is that tokenization cannot be left out of the mix.

As a part of the PCI Special Interest Group (SIG) on tokenization, I’ve been evaluating this technology and offering recommendations for guidance. Although the guidance won’t be out until late spring, I wanted to share some educational information about tokenization that could benefit our readers.

Each week, I’ll post an article about what tokenization is, the types of tokenization, its benefits for merchants and some simple considerations before implementing a tokenization solution.

So what is tokenization?

In its simplest form, tokenization is data substitution.

What does that mean? Well, let’s say that you have the following credit card number:

4467 9388 2077 1234

(Don’t worry, I made this number up).

Hypothetically, if this card number were stolen, it would have a significant value to the thief. The bad guy could sell your number to other bad guys or could simply use your credit card to buy things on your dime.

However, if that same credit card number were tokenized, the real numbers would be replaced by other numbers that have no value at all. The tokens are worthless, replacing the original number with ones that don’t have any value:

1234 5678 9012 1234

This way, if the card is stolen, it can’t be used to make purchases and would be of no use to the bad guys.

It is impossible for a thief to crack the code and derive the real credit card number from the token. The real credit card information is sent to a centralized and highly secure server to be stored.

Next up in this series: Token Types