MERCHANT AT RISK
In part of 1 this article, risk management was covered, outlining
some of the threats and the need for a risk management plan.
This installment reviews the security requirements being mandated
by the financial acquiring networks. They include VisaNet
International, American Express, Nova, and Wells Fargo over which
credit card transactions are settled. The requirements were announced
last year, are similar across all networks, and affect every merchant
taking credit cards through an on-line store.
The mandated requirements are known collectively as CISP
(Cardholder Information Security Policy) and should have been
implemented by merchants and processing providers as of May of 2001.
These are administrative, not legal, requirements and aren't
necessarily enforced across the board, that is, until something
goes wrong. So it is essential to make an effort to implement
these requirements wherever possible. Otherwise, your merchant
account could be in jeopardy.
The mandates apply to any merchant taking credit cards no matter
if they host their own storefront or rely on a processing provider. If
you are a merchant using a provider, make sure the provider complies
with CISP requirements because you as the merchant are the responsible
party.
CISP MANDATES
1) Establish a company privacy policy statement that discloses how
cardholder payment data is being stored and used.
2) Install and maintain a working network firewall to protect
credit-card data accessible via the Internet.
3) Keep security patches up to date.
4) Encrypt stored data accessible from the Internet.
5) Encrypt data sent across public networks.
6) Use and regularly update anti-virus software.
7) Restrict access to data on a "need-to-know" basis.
8) Assign a unique ID to each person with computer access to data.
9) Do not use vendor-supplied defaults for system passwords and other
security parameters.
10) Track access to data by unique ID.
11) Test security systems and processes daily.
12) Maintain a policy that addresses information security for employees
and contractors.
13) Restrict physical access to cardholder information. Give an individual
or team specific responsibility for managing information security.
14) Limit storage of CID (Cardholder Identification) or other rightful
owner verification information.
15) Notify the acquiring processor of security breaches.
16) Capture the remote host IP address.
17) Restrict customer access to payment forms by time and sessions.
WHAT YOU NEED TO DO
Looking at the list above:
Item 1, privacy statement:
A cardholder privacy/security statement should be placed in a
prominent location in your web site. A good location might be
from link to a small pop up window that loads the statement.
According to an Information Resources study earlier in 2001,
63% of consumers polled said they want to find security
statements on sites. Remember, there is no privacy if you
don't provide security.
Items 2 and 3, network protection Network security is
a major topic that will not be addressed here; however, you should ask
your provider or IT staff about the network security tools in place,
including network layers, routers, firewalls, and IDS (Intrusion
Detection Systems).
Item , encrypt stored data Interpret this requirement
to include vital
credit card information stored in any database that is ultimately
accessible to the Internet even though the database file itself may
reside in a location accessible only from a trusted server. The
encryption requirement is 3DES called triple DES, standing for
Data Encryption Standard, first introduced in the '70s and
subsequently modified. Triple means that the data is twice
redundantly encrypted making it virtually impossible for ordinary
hackers to afford the resources to crack the code.
To comply with this requirement, if you're storing credit card
numbers and possibly addresses, you're going to have to add a
module within your database entry script that does the encryption
prior to entry. Alternately, if supported in the database itself,
you could encrypt all entries. This, however, can result in an
extremely bloated database file.
Fortunately there are available some free 3DES encryption modules
so you won't have to start from scratch. There is a custom
ColdFusion tag for doing 3DES encryption as well as a Java module.
A little searching should turn up a Windows COM object as well.
Item 5, data sent across public networks The standard
protocol for transferring information over the Internet is TCP/IP using
ascii text to format information. This makes information, while in
transit on the Internet, human readable by any party with a computer
that can intercept the information.
