New PCI SSC Tool Educates Small Merchants on Payment Card Data Security
| Contact Us | |
| Free Demo | |
| Chat | |
The PCI Security Standards Council released a new tool Tuesday designed to help small merchants better protect their customers' payment card data.
While traditionally overshadowed by large merchants, small merchants – businesses like the corner bodega, the local hairdresser, and the food truck parked in the town square – remain ripe targets for cybercriminals.
Point of sale terminals, where sensitive Payment Card Industry Data Security Standard (PCI DSS) data is securely processed and transmitted, are consistently targeted in hacking campaigns. With the average cost of a data breach having risen this year, from $141 to $148 per lost or stolen record, having defenses in place to protect customer payment card data continues to be crucial for small merchants.
The PCI Security Standards Council, a Massachusetts-based consortium that oversees the PCI DSS set of standards, released a new tool on Tuesday to ensure small businesses are on the right path when it comes to protecting card data and cognizant of their security risks.
The Data Security Essentials Evaluation Tool, a series of questions on merchant payment card security, is meant to simplify the act of measuring a business's security posture.
The tool walks small merchants through multiple payment system diagrams and has them identify the payment system that's closest to their setup. From there it gives a comprehensive overview of the payment system, breaks down where card data is at risk, how cybercriminals can steal data, and recommended ways to protect data.
The tool is a solid primer for small businesses, especially those unfamiliar with the many ways cardholder data can be stolen. The tool guides companies through how threats like skimming equipment, payment card data stealing malware, and compromised POS terminals, can be used to exfiltrate data.
The tool is based on a resource recently retooled by the council, Version 2.0 of its Common Payment Systems guide, essentially a best practices guide on payment system types and the best ways to secure them. After a small merchant has concluded the evaluation they're encouraged to download an additional evaluation form that offers advice and instructions on encrypting card data, using secure payment terminals and solutions, and reducing risk in their environment.
While the council says any merchant can use the tool to see how their security practices stack up, there are some prerequisites that an organization should tick off before using it.
A merchant should ensure the tool is right for their organization by contacting the acquirer, or payment brand, to make sure they’re eligible to use the tool, namely to ensure they have the right completion and submission instructions. Acquirers should then work with merchants to complete the Data Security Essentials evaluation and work with the merchant on fulfilling recommended safeguards.
58 percent of breach victims from this year's Verizon Data Breach Investigations Report were categorized as small businesses. According to the report 90 percent of the breaches that hit the accomodation and food services industry stemmed from point of sale intrusions.
The release of the tool also comes a few weeks after researchers, presenting at the Black Hat security conference in Las Vegas, outlined vulnerabilities in mobile point of sale readers like Square, SumUp, PayPal and iZettle. While these devices had physical security mechanisms in place to thwart criminal activity some also contained vulnerabilities that attackers could theoretically exploit to carry out arbitrary commands and perform remote code execution.
Having a robust data protection solution deployed can also help organizations, small merchants and banks alike, protect financial data and achieve PCI/DSS compliance.
Credit card image via frankieleon's Flickr photostream, Creative Commons
Recommended Resources
All the essential information you need about DLP in one eBook.
Expert views on the challenges of today & tomorrow.
The details on our platform architecture, how it works, and your deployment options.