Point to Point Transactions Security – New Forensics Opportunities

More than 300 million payment card records were breached in 2011  alone  and a large percentage of those stolen records were used fraudulently. In  fact, the underground economy is teeming with stolen payment card data. Some controls are in place to help card payment processors prevent credit card fraud through increased controls around data and by limiting potential exposure to compromised information records.

The Payment Card Industry Data Security Standards (PCI DSS), for example, are widely considered to be a worldwide set of best practices for securing sensitive data. PCI DSS procedures are an essential component in any merchant’s holistic risk management program— but they are not without their burdens and limitations.

More than a billion dollars. That’s how much money merchants have collectively spent on PCI DSS compliance as part of their security systems.2 Indeed, PCI DSS compliance is a resource intensive challenge to businesses of all sizes. According to the analyst firm Gartner, a Level 1 merchant (generally defined as a merchant that annually processes 6 million or more Visa® or MasterCard® transactions) might spend millions of dollars to initially meet the security requirements prescribed by the PCI Security Standards Council (PCI SSC).

Even a Level 4 merchant (commonly defined as a merchant that annually processes  less than 20,000 eCommerce or 1 million Visa or MasterCard transactions) might have  to spend several thousand dollars on the initial security assessment and new technology and
security measures. And meeting the security requirements is just the start; maintaining  PCI DSS compliance is a continuous process that requires constant vigilance and incurs  ongoing costs.

Despite enormous efforts and vast expenditures since December 2004 when the security standards were first released, hundreds of millions of records with sensitive information have been breached. This clearly indicates that many merchants still have work to do to fully implement standard security procedures and technologies to thwart theft of cardholder data.

In recent years, larger merchants have begun implementing data encryption as a way to protect cardholder data. Now there is a new component to data security beyond encryption that holds  the promise of diminishing both a merchant’s risk of a data breach and burden of PCI DSS  compliance—and it’s a viable solution for merchants of any size.

This new element, called tokenization, replaces sensitive cardholder data with a randomized token that represents the cardholder data. Tokenization eliminates a merchant’s storage of actual cardholder data. From a merchant’s perspective, if the cardholder data is never stored, it’s far less likely to be stolen. What’s more, a large portion of a merchant’s computer systems are removed from the scope of a PCI DSS compliance audit since those systems no longer process  or store cardholder data.  Data encryption, when combined with tokenization, greatly improves cardholder data security.

These security techniques and helps merchants understand how and when  they can be used to implement secure transaction management and reduce the burden of PCI DSS compliance.