Table of Contents

The Core and Beyond

The PCI DSS is a broad and comprehensive standard designed to secure cardholder data across a wide range of entities. Management's focus often falls on certain nuances of this extensive standard, occasionally overshadowing equally critical aspects. Notably, the security of PIN data - a fundamental component of transaction security - sometimes receives less attention than it deserves.

Anyway, the vast scope of PCI DSS and other traditional standards such as PIN is just the starting point...

To address more specific aspects and complement the broader objetives of payment security, the PCI Council has developed additional standards, each with its dedicated focus and certifies assessors for compliance validation.

By focusing on specific areas of payment security, the complementary standards simplify the process of achieving and maintaining PCI DSS compliance.

Meanwhile, innovations like mobile payments, contactless transactions, and near-field communication (NFC) are revolutionizing payment methods. The newer PCI standards are paving the way for secure payments in this evolving ecosystem. They mark a shift from traditional hardware-based security to solutions on "Commercial Off-The-Shelf" (COTS) devices like smartphones and tablets, becoming increasingly relevant.

The PCI Ecosystem

The PCI Security Standards Council continually updates and expands its suite of standards to address emerging challenges and technologies. Although the official "Overview" page on the PCI website lists 15 standards, this count is already outdated with the introduction of the Mobile Payments on COTS (MPoC) standard in 2022, bringing the total to at least 16.

The graphic above provides a snapshot of these standards and their applications, showing where they apply within the payment process. However, for a more nuanced understanding, I have segmented these standards into distinct groups based on their specific focus areas. This classification aims to improve the understanding of how these various standards interplay and support the overall objective of securing payment card data.

Traditional Cardholder Data Security

A series of standards including PCI DSS form the bedrock of traditional cardholder data security. These standards are specifically constructed to protect cardholder information - such as the cardholder's name, Primary Account Number (PAN) and security codes (CVV, CVC) - throughout the entire payment process, from the initial transaction point to data processing and storage.

• Data Security Standard (DSS): This is the core standard for ensuring the secure handling of cardholder information at businesses. It outlines measures for prevention, detection and reaction to security incidents. The DSS applies to all entities involved in payment card processing - including merchants, processors, acquirers, issuers and service providers and covers technical and operational components.
• Point-to-Point Encryption (P2PE): This standard involves the secure encryption of payment data from the point of interaction to the solution provider's secure environment. It is designed to encrypt data immediately after entry and making it unreadable until it reaches the secure decryption environment. P2PE can be seen as a specialized component within the broader DSS framework. Implementing P2PE solutions can simplify DSS compliance by reducing the scope for DSS, since it reduces the amount of plaintext cardholder data present.
• Token Service Provider (TSP): The TSP standard refers to requirements for entities that provide tokenization services. Tokenization is a process that replaces sensitive card data like the actual Primary Account Number (PAN) with a unique identifier called "token" which can be used for payment processing without exposing the actual card's details to improve security. Similar to P2PE, the TSP standard can be seen as a specialized component within the broader DSS framework: For businesses that use tokenization services, the scope of the DSS environment can be reduced, since tokenization minimizes the amount of cardholder data present.
• Payment Application Data Security Standard (PA-DSS): PA-DSS applies to software applications that are involved in processing cardholder data and outlines requirements for software developers, including secure data encryption, activity logging and secure password practices. The requirements are designed to work within the PCI DSS framework and by using PA-DSS compliant applications, merchants and service providers can more easily achieve and maintain DSS compliance. Furthermore, it is important to note that PA-DSS is part of the broader Software Security Framework (SSF), which is discussed in detail later.

Traditional PIN Security

While DSS is often at the forefront of discussions on cardholder data protection, it is crucial to recognize that the security of Personal Identification Number (PIN) data is targeted through a separate series of PCI standards. These standards are designed to safeguard this sensitive component of cardholder verification.

• PIN Security: The core security standard for handling, processing, storing, and transmitting the Personal Identification Number (PIN) data within payment systems. It focuses on securing the PIN data throughout its lifecycle in the payment processing environment. This includes its encryption and transmission across various points in the payment network.
• PIN Transaction Security Point of Interaction (PTS POI): A set of requirements designed to ensure the security of devices that are involved in the direct interaction with payment cards and PIN entry, such as point-of-sale (POS) terminals and ATMs. As distinguished from the "PIN Security" standard, "PTS POI" targets the security of the physical devices used at the point of interaction that capture PIN data.
• PTS Hardware Security Module (HSM): The HSM standard specifically focuses on the security requirements for hardware security modules (HSMs) used in the payment card industry. An HSM is a physical device that provides secure processing of cryptographic keys and operations which are essential for protecting sensitive data like authentication data and PINs.

Commercial Off-The-Shelf (Mobile) Devices

The emergence of so-called "Commercial Off-The-Shelf" (COTS) devices in the payment landscape represents a significant shift towards more accessible and flexible payment processing solutions. Recognizing this trend, the PCI Security Standards Council has developed standards that focus on these widely used devices.

The somewhat cumbersome term COTS refers to readily available consumer hardware, such as smartphones and tablets, which are not specifically designed for payment processing but can be repurposed for this function. The following standards are making payment processing more accessible and adaptable to these devices, aligning with modern lifestyle and business practices.

• Contactless Payments on COTS (CPoC): This standard is designed to enable contactless payment transactions using COTS devices with NFC capabilities. It allows merchants to use their own COTS devices equipped with NFC technology. Unlike the traditional hardware-based point-of-sale systems, CPoC relies on software solutions to securely process contactless payments on everyday devices.
• Software-based PIN Entry on COTS (SPoC): SPoC addresses the secure acceptance of PIN entry on COTS devices and therefore ensures the secure entry and transmission of PIN data on devices not traditionally meant for payment processing using software-based methods for its encryption and protection, in contrast to traditional payment terminals. SPoC solutions require backend monitoring and control systems to detect and prevent fraudulent activities.
• Mobile Payments on COTS (MPoC): Pertains to the security of mobile payment solutions on consumer-grade mobile devices. It focuses on fortifying the security framework around mobile payment applications and services.

3D Secure Protocol

The 3D Secure (3DS) Protocol refers to a framework for online transaction security, designed to improve the security of credit and debit card transactions over the internet. It is widely known for its use in systems like "Verified by Visa", "MasterCard SecureCode" and "American Express SafeKey". The two key standards address different aspects of its transaction processes:

• 3-D Secure (3DS) Core: This standard is focused on the security requirements for server components that facilitate 3-D Secure transactions. These components include the Access Control Server (ACS), Directory Server and 3DS Server.
• 3-D Secure Software Development Kit (3DS SDK): This standard is directed towards the mobile and digital application side of 3D Secure transactions. It outlines specific requirements for software developers who are creating applications that support the 3DS protocol. Given that the standard is often used in mobile applications, it also covers mobile-specific security considerations.

Software Security Framework

The PCI Software Security Framework (SSF) is a collection of standards and programs to ensure the security of payment software throughout its lifecycle and address the evolving security needs in the payment software ecosystem and to replace the previous Payment Application Data Security Standard (PA-DSS). While the PA-DSS focuses on payment applications as part of the authorization or settlement, the SSF has a broader scope and is more flexible, covering a wider range of software types and development practices.

• Secure Software: This standard focuses on the payment software itself and sets out requirements for software developers and vendors to ensure their products protect the integrity and confidentiality of payment transactions and data. This process should integrate security into every stage of software development, from initial design to deployment and maintenance.
• Secure Software Lifecycle (SLC): This standard is aimed at software development organizations and focuses on the integration of security into the software development lifecycle.

Card Production

The PCI Security Standards Council rigorously focuses on two parts within the production of payment cards: The tangible materials and the sensitive data involved:

• Card Production - Physical: This standard focuses on the physical aspects of card production, like the secure handling, storage and destruction of card materials and components. It covers aspects like the security of blank card stocks, the physical printing process and the secure disposal of cards.
• Card Production - Logical: This standard deals with the protection of sensitive data during the card personalization process. Personalization involves customizing each payment card with specific cardholder information, cryptographic keys and other sensitive authentication data that are essential for card security. This includes securing the process of data encoding, encryption and transfer of data onto the card's chip.

The Big Picture: Understanding the Payment Card Transaction Process

When we go to a store and use our card for a transaction - whether by touching the card or entering the card - a seemingly simple action triggers a sophisticated chain of events involving multiple parties.

Understanding this network of interactions is crucial for effective PCI scoping. It lays the groundwork for identifying where and how cardholder data is handled. However, it is important to recognize that this overview only scratches the surface of the complex environment in which these transactions occur. Comprehending this "big picture" is just the first step in much deeper exploration.

But now let's demystify this process:

• Merchant: This is where the transaction typically begins. The merchant is the business where the cardholder makes a purchase. They use a terminal provided by an acquiring bank to facilitate the transaction.
• Acquiring Bank: Also known as the acquirer, this entity provides card processing services to the merchant. They are responsible for capturing the transaction data from the merchant and initiating the process of transaction authorization.
• Payment Brand Network: When a transaction is initiated, the acquirer sends the transaction details to the relevant payment brand network, such as Visa or Mastercard. This network conducts preliminary checks on the transaction and routes it to the appropriate issuing bank.
• Issuing Bank: This is the financial institution that issued the card to the cardholder. It receives the transaction details from the payment network, performs further verification, and either authorizes or declines the transaction based on the cardholder's account status and transaction parameters.
• Cardholder/Customer: The individual who owns the card being used for the transaction. They initiate the transaction by presenting their card for payment.
• Payment Network: This is the infrastructure used by the payment brand to process the transaction between the acquiring and issuing banks.
• Processors: These are entities that handle the processing of the transaction data. They provide the necessary technological infrastructure to route the transaction through the different stages of the payment process.
• Other Service Providers: In addition to the primary parties, there are various service providers involved in the transaction process. These can include payment gateway providers, fraud and risk management services, and others who contribute to the secure and efficient processing of card payments.

This cycle is similar for ATM transactions, with the primary difference being that the transaction begins at an ATM terminal rather than a merchant's card terminal.

With this transaction map in mind, I would like to refer one more time to the initial official overview graphic in the "The PCI Ecosystem" section. It will now provide a clearer understanding of which PCI standard applies to which of these various aspects in the transaction cycle.

Scoping for PCI Compliance

Understanding the scope is a crucial step in any organization’s journey toward PCI compliance. PCI compliance is a technically demanding and rigorous standard, and an accurate comprehension of scope is essential to ensure that the compliance efforts are both effective and comprehensive.

In the context of PCI compliance, scope can be defined as the extent to which an organization interacts with cardholder data. This includes any system, network, or process that stores, processes, or transmits cardholder information. The process of becoming PCI compliant begins with a thorough identification of the scope. This involves an in-depth analysis proportional to the organization's size and its exposure to cardholder data. The scope delineates the boundaries within which the PCI requirements will be implemented.

Methodology for Scope Creation

• Understanding Cardholder Data Flow: To develop an effective PCI-scoped environment, it is vital to understand the flow of cardholder data within the organization. This helps in identifying the touchpoints where cardholder data is stored, processed, or transmitted.
• Creating the Cardholder Data Environment (CDE): A cardholder data environment (CDE) is framed around these touchpoints and any shared services. This environment is the focal point for PCI compliance efforts.
• Industry-Specific Touchpoints: Different industries have distinct touchpoints relevant to their operations. For instance, merchants, service providers, and processors each interact with cardholder data in different ways, which affects their PCI scope.

Scope Reduction Techniques

• Utilizing Tokenization and Other Methods: Implementing tokenization and adopting secure web-application development practices, especially for e-commerce entities, can significantly reduce the PCI scope.
• System Components Consideration: Identifying and understanding the system components that fall within the PCI scope or the CDE is fundamental. This includes both technology and human elements involved in handling cardholder data.

Risk Management and PCI Scope

• Mature Risk Management Processes: Organizations with robust risk management frameworks are generally more adept at handling PCI scope creation. These processes help in accurately assessing and mitigating risks within the PCI scope.
• Scope as a Project Consideration: Scope should be treated as a critical component of the PCI compliance project. It dictates the extent of effort required, both in terms of human resources and the environment or area of implementation.

In conclusion, accurately defining and understanding the scope is the first and perhaps most crucial step in the PCI compliance process. It sets the stage for targeted and effective compliance efforts, ensuring that all relevant areas of cardholder data interaction are securely managed and protected.

Conclusion: Embracing Change in the Payment Landscape

As our journey through the landscape of PCI Security Compliance unfolds, it becomes increasingly clear that the payment industry is on the edge of a substantial transformation. This shift, fueled by rapid technological advancements and innovations, is reshaping the payment landscape and compliance strategies.

The author (David Schmid) within join.tech welcomes these changes as they not only comply in line with PCI Security Compliance but also offer opportunities for greater innovation in payment methods, recognizing the immense potential these advancements hold, being proud contributing to such approaches.

A prime example of this innovation is the integration of advanced programming languages and frameworks, such as Rust and WebAssembly, into the payment industry. These technologies offer a robust and secure foundation for developing efficient payment applications.

Organizations that embrace these changes and integrate them into their compliance and security strategies will not only meet the current standards but also pave the way for a new era of payment processing. This is a journey of not just safeguarding transactions but redefining them for the digital age.

Comments

No comment on this post yet... Initiate the dialogue - be the first to illuminate this page with your thoughts!

Leave a Comment

Name:

Email:

Comment:

Please preserve the rules of respect and avoid any shadow that might fall upon the realm. Keep your discourse pure and use simple characters. Your scroll shall contain no more than a thousand characters.

Captcha:

Only the worthy may share their wisdom beneath the sacred tree of insight. To prove yourself a true hero and not a shadowy automation, solve this puzzle:

Submit Comment