Best methods for navigating the POS security standard minefield

Commentary - As one might expect, there is no shortage of security standards when it comes to protecting the payment transaction lifecycle. As the old joke goes, “the great thing about standards is that there are so many to choose from.” These wise words are particularly applicable to the Point of Sale (POS) environment. Standards to protect PINs at the POS and beyond have been in place for a number of years, but it is equally important to protect other types of cardholder data such as the Primary Account Number (PAN) across the entire transaction process. There are three main initiatives under way today that apply to the protection of this data and aim to improve overall payment card security at the POS, between the POS and the acquiring bank and beyond. While the POS security standard landscape may seem complicated, when these various initiatives are broken down and analyzed, commonalities can be identified. What’s more, the implementation of single security technologies, such as end-to-end encryption or tokenization, can support compliance across all three initiatives.

Investigating the minefield
Given the complexity of the payment security standards environment, combined with the practical requirement to comply, greater clarification is needed to ensure that POS vendors, retailers/merchants and financial services organizations understand how each of these initiatives relate to one another and ultimately how they can help keep sensitive information safe. So, let’s look at these three different items in some more detail.

The Secure POS Vendor Alliance’s (SPVA) recent document on ‘End-to-End Encryption Security Requirements’ is designed to help make transactions more secure. The SPVA is a non-profit organization that works with the multiple stakeholders of the payment value chain. In its own words, the SPVA aims to develop an end-to-end security framework and to enhance security elements of payment solutions which protect cardholder information and defend merchants and acquirers against security breaches, while reducing fraud and lowering risk for all electronic payment stakeholders. Its end-to-end security guidelines overlap with other recommendations from at least two other entities. Fortunately for retailers, so too do the systems required to follow them.

The efforts of the SPVA parallel the work of the ASC X9F6 Standards Working Group, which is working on a new standard aimed at protecting sensitive payment data. ASC X9 is an ANSI Accredited Standards Committee (ASC) made up of members from the financial services industry.

Meanwhile, the Payments Card Industry Security Standards Council (PCI-SSC), which is managed by major payment card schemes like American Express, JCB, Discover, MasterCard and Visa, recently issued revised requirements of its own. These new guidelines bring together PIN Entry Devices (including POS devices) under a common document, known as PCI PTS-POI (PCI PIN Transaction Security Point of Interaction). The new document now also includes requirements for interfacing with open networks as well as the protection of cardholder account data. It is related to another set of requirements from PCI-SSC called PCI-DSS, which deals with cardholder data security in the payment transaction process (not only within the POS).

Identifying the commonalities
Protecting data through end-to-end encryption or tokenization

For those parties trying to make sense of all these new guidelines, the good news is that many of the recommendations relate to the protection of data with the goal of “end-to-end” encryption or tokenization. Here is a summary of how the initiatives relate - and how they are, in fact, entirely complementary:

The SPVA document is the first to cover what should be encrypted “end-to-end,” general requirements of how it should be encrypted and the tamper-resistant environment of the POS. Though this document is an important step forward, it contains only voluntary guidelines at this stage. The standard covers the following areas:

• Data to be encrypted during transmission
• Key management
• Physical and logical security of the Tamper-Resistant Security Module and key components
• Encryption monitoring and management systems requirements.

The new PCI PIN Transaction Security (PTS) Point of Interaction (POI) PCI PTS-POI Standard brings together requirements that were previously covered in three separate documents for Point of Sale PIN Entry Devices (PED), Encrypting PIN Pads (EPP), and Unattended Payment Terminals (UPT). This standard simplifies the testing process and eliminates overlap of documentation by providing one modular security evaluation program for all terminals and a single reference listing of approved products.

PCI PTS-POI contains a new Secure Reading and Exchange of Data (SRED) requirements module that gives POI vendors a clear set of security criteria for the protection of account data that they must build and test against. Vendors can now build devices to a defined standard for protecting data as it is read and then encrypted for exchange. Like the SPVA document, it covers the physical and logical environment, encryption that can be used, and so on. This is a critical first step in the establishment of a secure “end-to-end” encryption infrastructure although the standard does not provide specific details of the methods or encryption technology that POI vendors must use for protecting data.

The ASC X9 working group is part of the standards organization responsible for the development of all financial services standards in the U.S. It is comprised of numerous vendors and plays a key role in the development and adoption of new technologies in the banking, brokerage and insurance industries. ASC X9 intends to deliver a standard (X9.119) with specific security requirements for the protection of sensitive payment data using encryption and tokenization methods. This is a vital piece in defining what and how sensitive information should be protected from a standards body with representation from a broad spectrum of the financial services industry. Rather than specifying one way of protecting data, the standard will cover a number of different approaches. This is a pragmatic solution, as there are several valid ways to protect data, and vendors are already working together to provide solutions using a number of approaches.

We can perhaps expect the SPVA document (which already refers to the predecessor to the PCI PTS-POI specification) and PCI PTS-POI to be updated in time to refer to the X9.119 standard, since they both already reference other X9 standards related to key management and encryption technology, thereby completing the circle.

In addition to the above standards, Visa also issued best practice guidance on data field encryption in October last year. The guidelines were created as Visa recognizes that data field encryption is a useful approach that can simplify PCI Data Security Standard (DSS) compliance. Though it covers more than just the POS, it is very much part of the mix of initiatives, as Visa is chair of the ANSI X9F6 Standards Working Group that is working on the new standard to protect sensitive cardholder data. The best practices are based on the following security objectives:

• Cardholder and authentication data should only be available at the points of encryption and decryption
• Encryption key management solutions should follow international and/or regional standards
• Key lengths and cryptographic algorithms should follow international and/or regional standards
• Devices used to perform cryptographic operations should be independently assessed to ensure they are protected against compromise
• If cardholder data is needed after authorization (for example when processing recurring payments, customer loyalty programs or in fraud management), a transaction ID or token should be used instead of the data itself

More recently, in July 2010, Visa also released its “Best Practices for Tokenization” giving high level guidance for this alternative for protecting cardholder data. It is interesting to note that not all the data security documents published so far specify a Tamper Resistant Security Module (TRSM) for the protection of keys and sensitive cardholder data at all points where sensitive data is encrypted/decrypted. However, recent research commissioned by Thales showed that Qualified Security Assessors (QSAs), who audit the compliance of retailers and acquirers to meet PCI-DSS regulations, do recognize the value of hardware security in meeting regulations: 81 per cent of QSAs surveyed recommend or require Hardware Security Modules (HSMs) to manage data protection.

If the actions by all these various groups seem to be overkill, it is important to remember that the ultimate goal is to secure payment card information, which is in the best interest of consumers, merchants and all other entities involved in the payments card industry. With a bit of understanding about how each set of guidelines and standards overlaps, proper controls can be implemented to satisfy the best practices recommended by each document and prevent those involved in implementing these standards from doubling up on their efforts. Given the ever-present threat of card fraud, such efforts are vital.

biography
Steve Brunswick manages the global strategy and marketing for Thales Information Systems Security business and has more than 13 years’ banking industry experience. Before joining Thales, he worked as a Strategy Consultant and previously worked as Director of Marketing for De La Rue’s Cash Processing business.

Jose Diaz works on Enterprise and Government global strategy at Thales Information Systems Security focusing on payment systems. He has more than 10 years of experience in payment systems security including five years in a technical sales capacity. His background includes more than 17 years working in product development and communication system design and he has four patents for his work in digital communications