Category Archives: PCI Compliance

Data breach prevention: update every device due to Intel vulnerability

Posted on by
Reply

News of the Intel chip flaw creating vulnerability in virtually everything with a computer chip in it was announced last week. Microsoft, Google and tech companies now have a fix so it’s time to update all your devices. These emergency updates are to address the bugs called Meltdown and Spectre.

“These hardware bugs allow programs to steal data which is currently processed on the computer. While programs are typically not permitted to read data from other programs, a malicious program can exploit Meltdown and Spectre to get hold of secrets stored in the memory of other running programs. This might include your passwords stored in a password manager or browser, your personal photos, emails, instant messages and even business-critical documents.”

“Meltdown and Spectre work on personal computers, mobile devices, and in the cloud. Depending on the cloud provider’s infrastructure, it might be possible to steal data from other customers.”

For PCI compliance, merchants must update software within 30 days, however, I wouldn’t wait. Prioritize updates now.

For more information on the bugs, see https://krebsonsecurity.com/2018/01/scary-chip-flaws-raise-spectre-of-meltdown/

Christine Speedy, CenPOS authorized reseller, 954-942-0483. CenPOS is a merchant-centric, end-to-end payments engine that drives enterprise-class solutions for businesses, saving them time and money, while improving their customer engagement. CenPOS secure, cloud-based solution optimizes acceptance for all payment types across multiple channels without disrupting the merchant’s banking relationships.

Test and fix TLS 1.0 to TLS v1.2 for merchant non-compliance notice

Posted on by
Reply

To keep your data safe, the Payment Card Industry Security Standards Council (PCI SSC) has mandated a security upgrade impacting all merchants where web browsers can be used in the payment process. Acquirers and payment gateways have set various deadlines in advance of the required PCI TLS v1.2 Security Protocol Upgrade by  2018. Either hardware may need to be replaced or software updated.

Recently, multiple vulnerabilities have been uncovered. Criminals are using the vulnerabilities at massive levels over prior years. Security company Zscaler blocked an average of 8.4 million SSL/TLS-based malicious activities per day in the first half of 2017 for its customers on its Zscaler cloud platform. That’s why all merchants need to upgrade to the most current version of TLS (Version 1.2) and should do so as soon as possible. Because this is an absolute necessity, merchants are getting emails about hard stop dates; if not fixed, merchants will not be able to process transactions after the deadline.

TLS Deadlines vary by acquirer and payment gateway. Dates have been changing due to non-compliance so check with your partners.

  • Chase Paymentech, September 30, 2017.
  • Authorize.Net, February 28, 2018.
  • First Data varies by solution. Datawire will remove SSL v3, TLS v1.0, and TLS v1.1 on February 15th 2018.

TLS 1.0 and TLS 1.1 need to be disabled from browsers, servers and related applications. SSL 3.0 should have been disabled years ago.

Do not rely on server host companies or consultants to do this for you. It’s up to merchants to maintain PCI Compliance. If you get a notice of non-compliance from your acquirer and use a virtual terminal, test your browser below.

FREE Test SSL/TLS for Browser and Servers and updating TLS for card not present transactions:

Free SSL and TLS test from Qualys. https://www.ssllabs.com/ssltest/index.html.  If you get a YES next to TLS 1.0, SSL 3, or SSL 2, then hardening is needed.

Try updating your browser and then run the test again. If the browser is current, go to your web browser settings or preferences and disable SSL and TLS 1.0. Run the same test on your web site. If you get a yes, go to your host administration and disable in security settings.

What is TLS Security Protocol?

Transport Layer Security (TLS) and its predecessor, Secure Sockets Layer (SSL) are both frequently referred to as “SSL”. When you go to a web page and the URL is “https”, the S stands for secure, and the domain host has a security certificate installed and enabled on the web host. Websites use TLS to secure all communications between their servers and web browsers. For example, when a merchant logs into a virtual terminal using a web browser, or a customer makes a payment online via a hosted pay page or ecommerce shopping cart.

 

Christine Speedy, CenPOS authorized reseller, 954-942-0483. B2B cloud payments solutions and CenPOS enterprise cloud payment solutions expert. CenPOS is a merchant-centric, end-to-end payments engine that drives enterprise-class solutions for businesses, saving them time and money, while improving their customer engagement. CenPOS secure, cloud-based solution optimizes acceptance for all payment types across multiple channels without disrupting the merchant’s banking relationships.

Dealership Post-Acquisition Standardization Cash Flow & Profits

Posted on by
Reply

Car, truck, and ag equipment dealership acquisitions by mega dealers are on a torrid pace. Cash-flow and profits are directly linked to standardization among locales. The right payment processing technology creates instant receivables financial transparency at headquarters regardless of varying dealer management software. heavy duty equipment credit card processingCloud-based payment processing is critical to financial transparency. For example, credit card processing terminals batched out individually means management has to wait for reports. A cloud solution, including payment gateway, can provide real-time insights by dealer location or any other number of data points.

Key payment gateway differences for dealership evaluation:

  • Real-time dashboard with drill down vs export reports to view (additional payment types not shown)dashboard net sales payment gateway report
  • Compliance with complex rules for rentals, preauthorizations, retail and card not present. How many merchant accounts needed to comply?
  • Compliance with Visa October 2017 stored credentials mandates
  • Level 3 processing capabilities for commercial cards
  • EMV chip or EMV chip and pin
  • Push payment requests (collect remote payments before delivery) via text or email
  • Cardholder authentication (3-D Secure) for remote payments
  • Payment methods supported: cash, check, wire, credit card and other methods vs just credit cards provides significantly tighter controls and data insights

Dealers hesitant to replace desktop EMV chip terminals due to prior investments should bite the bullet. Better solutions to improve customer experience and back office efficiency will reduce ROI time for acquisitions.

ABOUT: Christine Speedy is a payment processing expert with deep experience in the multi-department needs of dealerships. Solutions empower CFO’s to achieve common customer satisfaction goals with tight financial controls, risk mitigation, and reduced PCI Compliance burden. Need standardization help? Call 954-942-0483 to learn more about solutions for your business that are quick and easy to adopt, increasing efficiency and growing profits virtually overnight.

 

Microsoft Dynamics Partner: PCI-Validated P2P Encryption

Posted on by
Reply

CenPOS, a payment technology provider, launched their PCI-Validated P2P Encryption solution July 7, 2017. The Microsoft Dynamics Partner offers a full-cashiering payment processing module to Dynamics AX 2012 channel partners and end-users. The CenPOS Validated P2PE encrypts cardholder data so businesses can simplify compliance with Payment Card Industry Data Security Standards (PCI DSS). It’s also QIR certified and HIPAA compliant.

With full cashiering, users have tight financial controls all within Dynamics AX ERP. Cash, checks with and without guarantee, credit card, and other payment options are all supported for retail needs. Hardware terminal options include the Verifone MX 915, Ingenico ISC250, Ingenico IPP320, and the mobile Ingenico ICMP EMV Reader. Note the module is for Dynamics AX 2012 ERP, not Retail.

CenPOS Dynamics AX Software modules include:

  • POS with EMV enabled
  • Mobility with EMV
  • P2P E Validation
  • Electronic Bill Presentment and Payment
  • Tokenization
  • Consumer Electronic Wallet supporting all tender types
  • Electronic Signature Capture
  • Integrated Shopping Carts
  • Enhanced fraud and risk mitigation tools

Christine Speedy, CenPOS authorized reseller for Dynamics end users and channel partner development, 954-942-0483. CenPOS is a merchant-centric, end-to-end payments engine that drives enterprise-class solutions for businesses, saving them time and money, while improving their customer engagement. CenPOS secure, cloud-based solution optimizes acceptance for all payment types across multiple channels without disrupting the merchant’s banking relationships

PCI SECURITY STANDARDS COUNCIL PUBLISHES SUPPLEMENTAL PCI DSS SCOPING GUIDANCE

Posted on by
Reply

Guidance Clarifies Scoping Principles Outlined in the PCI Data Security Standard —
WAKEFIELD, Mass., 9 December 2016 — Incorrectly identifying where and how payment data is at risk in an organization’s systems continues to lead to data breaches. Today, the PCI Security Standards Council (PCI SSC) published Guidance for PCI DSS Scoping and Network Segmentation to help businesses address this challenge.

PCI Data Security Standard (PCI DSS) Requirement 1.1 states that organizations need to maintain a cardholder data flow diagram to help identify which systems are in scope and need protection. Yet data breach investigation reports continue to find that companies suffering compromises were unaware that cardholder data was present on their compromised systems. This guidance provides a method to help organizations identify systems that, at a minimum, need to be included in scope for PCI DSS. It includes guidance on how segmentation can be used to help reduce the number of systems that require PCI DSS controls and illustrative examples of some common segmentation approaches.

“For years, we have preached the need to simplify and minimize the footprint of cardholder data,” said PCI SSC Chief Technology Officer Troy Leach. “One way to accomplish this is through good segmentation. It allows an organization to focus their attention on a limited number of assets and more readily address security issues as they arise. As a result, it should also reduce the level of effort to comply with PCI DSS.”

While segmentation is not a PCI DSS requirement, it is a strongly recommended practice. Segmentation of networks included in or connected to the cardholder data environment is important for organizations as it can limit the exposure of payment data in a system, simplify PCI DSS compliance efforts and reduce the chance of being targeted by a criminal. However, as improper segmentation can put cardholder data at risk, it’s critical that organizations understand and implement segmentation properly.

The guidance was developed with industry input and collaboration in order to address common questions from PCI SSC stakeholders on scoping and segmentation. Christian Janoff, PCI SSC Board of Advisor member and Security Solutions Architect for Cisco, works regularly with merchants using scoping and segmentation products and was a leading contributor to the guidance. “Knowing the scope of your cardholder data environment and properly segmenting to protect it has been a challenge for many organizations. By providing guidance, we hope this will help to simplify the process, making it easier to secure payment card data,” he said. “We at Cisco are proud to partner with the Council and industry peers to bring additional scoping and segmentation guidance to the industry.”

Guidance for PCI DSS Scoping and Network Segmentation is intended for organizations looking to understand scoping and segmentation principles when applying PCI DSS to their environments. It also provides a method for facilitating effective scoping discussions between entities and is useful for:

  • • Merchants, acquirers, issuers, service providers (issuer processors, token service providers, and others) responsible for meeting PCI DSS requirements for their enterprises;
    • Assessors responsible for performing PCI DSS assessments;
    • Acquirers evaluating merchants’ or service providers’ PCI DSS compliance documentation;
    • PCI Forensic Investigators (PFI) responsible for determining PCI DSS scope as part of an investigation.

It is important to note each organization is responsible for making its own scoping decisions and that following this guidance does not guarantee that effective segmentation has been implemented, nor does it guarantee compliance with PCI DSS. The guidance is available on the PCI SSC website. Chief Technology Officer Troy Leach provides additional insights on the topic on the PCI Perspectives blog.

About the PCI Security Standards Council
The PCI Security Standards Council is a global forum that is responsible for the development, management, education, and awareness of the PCI Data Security Standard (PCI DSS) and other standards that increase payment data security.