Risk
10/26/2012
12:05 PM
50%
50%

Ten Ways To Secure Web Data Under PCI

PCI compliance can create headaches for companies that do online commerce. Is your e-business ready?

Whether they're brick-and-mortar or online, merchants find the Payment Card Industry's requirements for protecting credit card data challenging and confusing.

But all retailers must understand how to protect the credit card and other customer data that comes from online transactions, because their businesses are in cybercriminals' crosshairs. Retailers are the second leading source of leaked data (after the hospitality industry), accounting for 20% of total breaches, according to Verizon's 2012 Data Breach Investigations Report. And though the U.S. Census Bureau reports that e-commerce transactions account for only about 5% of the retail economy, they've steadily grown every year.

"It's an interesting world out there, and a very scary world for a merchant, because from day one, you're a target," says John South, chief security officer for payment processor Heartland Payment Systems.

Many of the retailers playing in this scary online world are small businesses, and they're the most vulnerable: Nearly 95% of breaches happen to merchants with 100 employees or fewer, according to the Verizon report. They don't have the dedicated security and risk management teams larger businesses have.

"We aren't seeing a lot of large-scale breaches. We're seeing much smaller breaches," says Bob Russo, general manager of the PCI Security Standards Council, the governing body for PCI's Data Security Standard (PCI DSS). "These standards are right on target for the big guys with the big security departments, ... but we have to find out a way to make it easier for the smaller merchants."

Online retailers have one big security requirement that the 100% brick-and-mortar corner store doesn't have: card-not-present transactions. Because customers don't physically hand over their credit cards for online purchases, payment processors require all online merchants to submit to a quarterly network scan by an approved security vendor. Such scanning is designed to detect vulnerabilities and misconfigurations.

Many online retailers aren't aware of this and other PCI requirements and how to deal with them, but simple steps can make a big difference when it comes to protecting customer data. The Verizon study found that 96% of victims of successful attacks had failed to comply with the PCI rules they were subject to, and 97% of breaches could have been prevented through simple or intermediate security controls.

The following 10 steps will help your company institute the controls needed to secure cardholder data and meet PCI's requirements.

1. Know Your Infrastructure

Online merchants must worry about the degree to which their online retail systems integrate with their day-to-day business networks. Start by assessing your infrastructure to determine which systems handle transaction and cardholder data.

Network scanning and log analysis can help identify which systems have access to card data, says Greg Rosenberg, a qualified security assessor with managed security provider Trustwave. These systems are the ones that you'll want to subject to PCI DSS.

"There are a lot more attack vectors--a lot more systems--that we find and can identify vulnerabilities in than customers know about," Rosenberg says.

Get a qualified security assessor involved, he says. "I'm not looking for who can get me through my audit really quickly, but who can help me understand my risk," Rosenberg says. "I would rather significantly reduce my risk posture than quickly pass PCI."

2. Find The Data

Companies save card data for three main reasons: to better handle customer service requests, to allow easy reuse of credit cards, and to handle chargebacks, according to the Ponemon Institute's 2011 PCI DSS Compliance Trends Study. "We still have way too many companies using credit card numbers as the primary identifier for their customers," says Martin McKeay, a security evangelist at Internet services company Akamai.

Whatever the reasons for hanging on to customer data, companies should hunt down every instance on their systems, whether on Web servers, in a customer service application, or on a sales associate's laptop. Discover where the data resides, who has ac- cess to it, and whether they need the information at all.

Marketing types, for instance, want to save everything, "because someday they might use the data to send someone a coupon," says PCI SSC's Russo. "If you don't need the data, don't store it."

chart: Percentage of companies that passed the three most difficult PCI requirements last year

Robert Lemos is a veteran technology journalist of more than 16 years and a former research engineer, writing articles that have appeared in Business Week, CIO Magazine, CNET News.com, Computing Japan, CSO Magazine, Dark Reading, eWEEK, InfoWorld, MIT's Technology Review, ... View Full Bio

Previous
1 of 3
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Experienced reindeers wanted
Current Issue
Five Things Every Business Executive Should Know About Cybersecurity
Don't get lost in security's technical minutiae - a clearer picture of what's at stake can help align business imperatives with technology execution.
Flash Poll
Dark Reading Strategic Security Report: The Impact of Enterprise Data Breaches
Dark Reading Strategic Security Report: The Impact of Enterprise Data Breaches
Social engineering, ransomware, and other sophisticated exploits are leading to new IT security compromises every day. Dark Reading's 2016 Strategic Security Survey polled 300 IT and security professionals to get information on breach incidents, the fallout they caused, and how recent events are shaping preparations for inevitable attacks in the coming year. Download this report to get a look at data from the survey and to find out what a breach might mean for your organization.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
Security researchers are finding that there's a growing market for the vulnerabilities they discover and persistent conundrum as to the right way to disclose them. Dark Reading editors will speak to experts -- Veracode CTO and co-founder Chris Wysopal and HackerOne co-founder and CTO Alex Rice -- about bug bounties and the expanding market for zero-day security vulnerabilities.