Step right up folks. I have something that will cure all of your problems with credit card processing. It is called end-to-end encryption. Yes, folks, it is the be all, to end all in security. It will cure all that ails you, particularly those nasty data breaches. Don’t be shy, just step right up and get your own version while supplies last.
Gee, when end-to-end encryption (E2EE) is put that way, it sounds great, almost too good to be true. And you would be right; it is too good to be true. But if you listen to the statements of the proponents of E2EE, they make it sound like once E2EE is in place, it is like the Ronco Showtime Oven, “Just set it and forget it.”
Now, do not get me wrong. E2EE is not a bad thing, but it does have its own set of risks. And it is those risks that do not get discussed that concern me. The reason for my concern is that if you discuss E2EE with any merchant, most see it as this panacea, something that will get them out of the PCI compliance game altogether. However, nothing could be further from the truth. If anything, E2EE may make PCI compliance even more daunting than it is today.
The first thing everyone seems to forget is that E2EE only removes those systems and networks that are between the endpoints. That is because the data stream between the endpoints is encrypted and, therefore, out of scope for PCI compliance. However, for a merchant, that means that the device that accepts the credit card is still in-scope for PCI compliance. Bring this fact up to most merchants and they start complaining like no tomorrow.
That device might be as “simple” as a credit card terminal or as complex as an integrated point-of-sale (POS) workstation on a network. However, since this device is an endpoint, the merchant or the merchant’s QSA needs to ensure that the endpoint is properly secured and cannot end up being a breach point. Depending on the complexity of that device, that assessment might be very straight forward or very time consuming. The reason the endpoint needs to be assessed is that security is only as good as its weakest link. In the case of E2EE, the weakest links are the endpoints at which the data is encrypted and decrypted.
The next thing that seems to slip people’s mind is that fact that since the merchant has an endpoint, that endpoint is still a target. Worse yet, because it is an endpoint, the level of sophistication likely required to compromise that endpoint goes up exponentially, meaning that any successful attack will likely be beyond the average merchant’s capability to readily detect. The PCI DSS addresses this threat fairly well by requiring network monitoring, daily log reviews, anti-virus, anti-malware, firewalls and the like. However, I can tell you from personal experience that your average merchant is not going to be equipped to deal with this new threat.
And what is the new threat? The new threat is tampered with hardware and software. If you think this is farfetched, think again. It has already happened on a limited scale. The doctoring of hardware is fairly straight forward to both accomplish and to detect. Detection only takes looking inside the device and noticing something that does not belong. However, doctored software is another story. The concept of doctored software has been a concern in the health care industry since the start of using computerization for heart pacemakers. While the health care industry has developed rigorous testing and certification procedures, the rest of the software industry has said there is no need. That is, until now. As the world further automates, the need for reliable, safe and secure software only increases because of the reliance people and organizations apply to that software.
So what can an organization do to stem this new threat after implementing E2EE? Here are some thoughts.
- Purchase your credit card processing equipment only from your acquiring bank or reputable vendor. This is not a perfect solution to the problem, but doing this should be better than buying a used unit off of eBay or from Joe’s Guaranteed Card Equipment. Yes, you may save a few bucks, but is that worth having every one of your customers that uses a credit card being compromised? Probably not.
- Ask your supplier of terminals or POS workstations about what they do to test these systems to ensure that they operate as expected and are not routing cardholder data to Timbuktu as well as your bank. Ask them to provide those procedures in writing and review them to ensure they appear adequate.
- Use serialized tamperproof tape on the seams and doors of your terminals and POS workstations. Require that at every Manager shift change the new manager on duty is required to log their review of the devices, inventory the devices and notate if any have been tampered with. If a device does appear to have been tampered with, it should be taken out of service until a new, secure device can replace it.
- If using self-checkout systems, make sure to have those systems under both video and employee monitoring.
- Upgrade your card processing devices to the latest devices. Over the last few years, some of these devices have seen significant changes in their design that improves their tamper resistance. This is particularly true of fuel pumps and certain types of terminals.
- Review video monitoring if any manager notates that a device may have been tampered with to determine if you can identify possible suspects that may have tampered with the device.
- Patch your devices as soon as possible to minimize their susceptibility to attack or compromise.
- If the vendor of the equipment will perform updates, make sure that you or someone in your organization schedules the updates. If anyone shows up at a location to “update” your equipment and it was not scheduled by your organization, contact law enforcement.
- If updates will be done by the vendor remotely, make sure that someone from your organization initiates the remote access and they observe the remote update process. At the end of the update process, the person should terminate the remote session of the vendor.
Even implementing these processes will not remove all of the risk. Particularly the risk of having modified software introduced into your environment. However, these processes will show a court that you attempted to conduct due diligence and tried to keep your equipment secure.
