Retail Observer

RETAILOBSERVER.COM JANUARY 2017 88 B A N K I N G . S O L U T I O N S P C I C O M P L I A N C E T he sales are over, the returns and refunds have been processed and the accounting completed. The holiday season is behind us. While you're sweeping up confetti with Auld Lang Syne still echoing in your head, I'd like to point out something you might have missed during all of the end-of-year commotion. Back on October 31 the Payment Card Industry (PCI) Security Standards Council's update to its digital security standard, PCI DSS 3.2, went into effect, retiring v3.1. Yeah, I know. Not exactly the best timing. You had bigger problems to tackle and as a result you may have missed the memo, or just outright forgot. Don't worry; your secret is safe with me. Instead of wallowing in guilt, let's do something about it. For starters, you may be wondering what PCI DSS 3.2 is and what the update means. Let's start at the top. PCI DSS is an information security standard established in 2004 by the leading credit card brands in response to fraud. Since then, it has been adopted as a benchmark and minimum standard for organizational security programs. PCI DSS is intended to help protect retailers and their customers from cybercrime and fraud affecting credit, debit and other digital transactions. The regulation is also regarded by some states as the benchmark for making a good-faith effort at protecting consumers in the event of a data breach. Among the changes contained in the 3.2 are updates intended to address security vulnerabilities associated with the use of point-of-sale (POS) systems. Whether self-serve kiosks, cash machines, checkout payment devices or other swipe-to-pay systems, PCI DSS 3.2 compliance is meant as a hedge against the kinds of hacks and data breaches that have hit the retail industry in recent years. These events include attacks on specific devices, such as the hack on a network of 330,000 cash registers as reported by USA Today, or the networks of specific stores, including the hack that involves the retail chain Eddie Bauer as reported by PC World. PCI DSS compliance doesn't offer immunity to attacks, but it does offer best practices for the retail industry. Following these standards will make it more difficult for criminals to crack your IT systems. At the same time, PCI DSS can help you mitigate the risk of fines and lawsuits, in the event that your system is breached. The larger aim of PCI DSS compliance is prevention of a crisis stemming from a data breach that would affect personal and financial consumer data. Such occurrences bring about legal hassles, logistical challenges and damaging affects to your brand. The PCI Security Standards Council regularly evaluates and updates PCI DSS in response to the industry's understanding of the current threat environment. As part of its ongoing evaluation of threats and defenses, in April of 2016 the Council, adopted the new standard and, in a series of blog posts, addressed the reasons for the update as well as guidance for organizations to help prepare for and achieve compliance. PCI DSS is all about prevention. While the new standards may seem like a daunting undertaking, a failure to meet PCI DSS 3.2 standards could lead to greater problems for your organization and more risk for your customers. As with any worthwhile journey, reaching your destination means taking a first step. In the case of establishing and maintaining PCI DSS compliance, there are six steps (and twelve principles) to reach that destination: Step 1: Build and maintain a secure network • Install and maintain a firewall configuration to protect cardholder data • Do not use vendor-supplied defaults for system passwords and other security parameters Step 2: Better protect cardholder data • Protect stored cardholder data by implementing data retention and disposal policies • Encrypt transmissions of cardholder data across open, public networks Step 3: Maintain a vulnerability management program • Protect all systems against malware and regularly update anti-virus software and programs • Develop and maintain secure systems and applications Step 4: Implement strong access control measures • Restrict access to cardholder data by business on a need to know basis • Identify and authenticate access to system components • Restrict physical access to cardholder data Step 5: Regularly monitor and test networks • Track and monitor all access to network resources and cardholder data • Regularly test security systems and practices Step 6: Maintain an information security policy • Maintain a policy that addresses information security for all personnel Once completed, you'll find that the journey to PCI DSS 3.2 compliance was worthwhile and that the reward will be realized in greater trust in your brand. PCI DSS COMPLIANCE RESOLUTIONS FOR 2017 Greg Hoffer, Vice President of Engineering at Globalscape RO

• Cover