Criminals have increased their efforts to target legitimate businesses for data theft. Sensitive data, intellectual property, customer information and financial records are like gold to these groups of organized cybercriminals and are increasingly attracting attention. These criminals have created a global market for their stolen currency, which is data. They will take anything of value and sell it on the open market. However, if this data is gold, then payment card data is platinum for these thieves, and is often the primary objective in their attacks against businesses. They have created a criminal economy that is increasing its scale globally.

Grocery, retail, hospitality; these are all high-value targets for the cybercriminal. Whether it is through complex malware in our reservation systems, skimming devices at the check-in desk or a shifty bartender or waiter in our food establishments, there are many avenues criminals will pursue to secure the payment card data that is the lifeblood of our commerce.
 
A recent Verizon report highlights compliance with the PCI Data Security Standard (PCI DSS) as a key factor to data security. This reiterates what we’ve seen in similar industry reports over the years – those organizations with security controls in place as part of complying with PCI Standards improve their chances, both of avoiding a breach in the first place, and of minimizing the resulting damage if they are breached.

Yet compliance does not equal security. Asking “Am I compliant?” is not the same thing as “do I have a strong security strategy for protecting my customer’s payment card data?” There’s too much focus on cramming for the test and not on being a good student year round. We have to change the conversation in the boardroom and all the way down and across our businesses to focus on building a culture of security and vigilance.
 
PCI standards are a driver for getting a baseline of security practices for card data into the fabric of a business. But just like the fact that a lock is no good if you forget to lock it, these controls are only effective if they are implemented properly and as a part of an everyday, ongoing business process.

The latest version of the PCI Data Security Standard (version 3.0) aims at helping organizations make payment security part of business-as-usual activities with greater flexibility, an increased focus on education, awareness and security as a shared responsibility. Let’s take a closer look at ways to leverage this in your business.

Whether it’s new forms of malware or other types of attacks, the PCI Standards outline the security controls necessary to effectively help prevent hackers from penetrating a payment environment and jeopardizing the protection of card data as it is being processed. These include techniques for maintaining POS security and a secure terminal environment, and monitoring and managing access to systems.
 
Technologies that devalue card data such as EMV chip, point-to-point encryption and tokenization can also play an important part in a layered approach.

When implemented properly, technologies such as tokenization and point-to-point encryption can remove or render payment card information useless to cybercriminals, dramatically increasing data security at vulnerable points along the payment transaction chain.

If we can limit the locations of cardholder data, the smaller subset of systems to protect should improve the focus and overall security of those systems.  And better security should then lead to simpler compliance efforts.

But these technologies are only as good as the way in which they’re applied and implemented. The focus should be to limit exposure of data in your systems – and the first step is properly identifying the cardholder data environment to begin with. Knowing where your cardholder data is located is a critical part of your planning.

The Council offers training and education programs. For larger companies, the Internal Security Assessor (ISA) program, which provides your staff with training on the standard and on how to effectively work with an assessor, has proven helpful to ensure proper implementation and maintenance of PCI measures and to prepare adequately for an assessment, as well as enhance the quality, reliability and consistency of the organization’s internal PCI DSS self-assessments. Additional Council offerings help build payment security understanding and awareness, including PCI Awareness and Insider’s Guide to PCI DSS 3.0. PCI Essentials, an entry-level course that covers payment security basics. Offered as an e-learning course, it’s helpful for training employees on security basics. 

Find more information about PCI Training courses on the PCI SSC website: https://www.pcisecuritystandards.org/training/index.php

Managing Third-party Risk
Breach reports continue to highlight security vulnerabilities introduced by third parties as a leading cause of data compromise. According to a 2013 study by the Ponemon Institute, the leading mistake organizations make when entrusting sensitive and confidential consumer information to third-party vendors is not applying the same level of rigor to information security in vendor networks as they do in their own.

As managing third-party provider access remains a challenge for organizations, the Council also encourages organizations to reference recently released guidance developed by a special interest group on managing risk and securing data when working with third parties to support PCI DSS and ensure payment data and systems entrusted to third parties are maintained in a secure and compliant manner. Some of the key recommendations to consider include:

• Conduct due diligence and risk assessment when engaging third-party service providers to help organizations understand the services provided and how PCI DSS requirements will be met for those services.
• Implement a consistent process for engaging third parties that includes setting expectations, establishing a communication plan, and mapping third-party services and responsibilities to applicable PCI DSS requirements.
• Develop appropriate agreements, policies and procedures with third-party service providers that include considerations for the most common issues that arise in this type of relationship.
• Implement an ongoing process for maintaining and managing third-party relationships throughout the lifetime of the engagement, including the development of a robust monitoring program.

The full document (Third-party Security Assurance Information Supplement) is available at www.pcisecuritystandards.org and includes high-level suggestions and discussion points for clarifying how responsibilities for requirements may be shared between an entity and its third-party service provider, as well as a sample responsibility matrix that can assist in determining who will be responsible for each specific control area.

The PCI Security Standards provide the foundation for a multilayered approach to data security. But even with the best standards in place, these criminals are persistent in their attacks and no organization is immune. Those in the hospitality industry have to be persistent in their defenses, relying not just on one layer of protections but many. This has to be a daily priority built into business practices, not a one-time effort.

Bob Russo is the general manager for the PCI Security Standards Council.

©2014 Hospitality Upgrade
This work may not be reprinted, redistributed or repurposed without written consent.
For permission requests, call 678.802.5302 or email info@hospitalityupgrade.com.