There is nothing a hacker or common thief loves more than a credit card with all related cardholder information. Hackers trade with these stolen details on the dark net, and even an incomplete cardholder record can be enough to begin a campaign of identity hacking and financial terror. This means that every single business that processes credit or debit cards is in possession of theft-worthy data, data that could not only seriously hurt your customers if exposed, it could also damage your business.
In order to process payments, your business needs to be PCI compliant. PCI-DSS stands for Payment Card Industry Data Security Standard. It is a set of regulations and guidelines requiring businesses to take the necessary steps to protect cardholder data. Failing to achieve PCI-DSS compliance can lead to hefty fines, sanctioning, and – worst of all – exposes customers to unnecessary risk. Today, Contego is talking about why protecting cardholder data is good for your business and how to use the PCI-DSS guidelines to keep your business and your customers safe from cyber attacks.
Cardholder Data Attacks are On the Rise
Cardholder data attacks come from every direction, and we are not being hyperbolic. You not only need to firewall your Point of Sale computers and monitor your customer account services – you must also watch for keypad-swaps on your card reader devices, wifi camera hacks to read card numbers over a cashier’s shoulder, and hacks of cardholder data in-transit during the payment processing itself.
Risks of a Cardholder Data Breach
What are the risks to your business if cardholder data is breached in a cyber or scanner attack?
Fines from Payment Processors and Banks
When it comes to damage to your business, the Payment Card Industry does not take data breaches lightly. Expect hefty fines for every single cardholder whose data was exposed, potentially scaling with the severity of the exposure. Banks and other financial institutes that may be involved in compromised transactions may also choose to level fines.
Class Action Lawsuits
Those whose lives are negatively affected by a data breach will typically have grounds to file a lawsuit. If a large number of accounts were exposed, that can lead to a class-action lawsuit which can make massive trouble for your business and hit the papers, which leads to the next problem.
Loss of Faith from Customer Audience
Data breaches often lead to a loss of faith in the brand and company. You may lose the loyalty of customers who have been with you for years while gaining at least a temporary reputation as a brand that may not be safe to buy from. Customers are hesitant to shop online or in person if your brand has a reputation for losing card numbers and cardholders’ personal details.
Providing Identity Monitoring to Affected Parties
You will likely be required to provide identity monitoring to each person whose cardholder data was exposed in the breach. While Experian and other providers of such services often provide a business bulk price, this requirement adds to the already hefty cost of a data breach.
Direct Financial Harm to Customers
Finally, there is the simple harm calculation. Every exposed account exposes a person and their family to harm. Not everyone will catch the fraudulent charges early. Some will be subject to Machiavellian identity theft operations. Some will lose thousands of dollars and years off their life in stress as a result of a cardholder data breach. This is not just a matter of servers, compliance, and fines. Protecting cardholder data is also a matter of preventing human suffering – something every brand can get behind.
PCI-DSS Compliance Provides Best Practices for Protecting Cardholder Data
The good news is that remaining fine-free and PCI-compliant is good for your business on a number of levels. Many businesses see the PCI-DSS as a useful handbook for across-the-board cybersecurity best practices. Let’s take a closer look at what the Payment Card Industry requires to certify a well-secured business for card handling.
Have a Firewall and Anti-Virus Software In Place
Make sure you have a modern firewall and anti-virus software installed. Consider a suite that monitors, scans regularly, checks files, stops harmful downloads, and more. The latest bells and whistles are not just hype, they’re features designed by security specialists to help automate the protection of your network and individual devices.
Apply Custom and Secure Configurations to All Systems
Never leave a device or piece of software set to default settings. “admin” “password” is the first login that any hacker or their bot will try. Always configure your firewall with settings that match your current network size, details, and usage patterns. Close your router ports, block known bad actors, and make sure your SSL certificate is up to date. Don’t forget to configure every new app and device that enters you sphere or processes payments.
Make Use of Access and Control Security Measures
Use unique IDs for every employee and customer. Then make use of access and control management combined with zero-trust permission policies to ensure that each person has access to the minimum cardholder data they need to do their job. This can smoothly prevent internal cardholder data breaches and immediately red-flag any “snooping” malware that tries to read whitelist-only files.
Restrict Physical Access to Cardholder Data
Use the same access and control methods for physical access to cardholder data. Your card readers, point of sale devices, and servers that hold cardholder data should be limited only for the times and people required for business operation. Viewing cardholder data on a screen should also be highly restricted and nearly impossible for anyone who is not actively serving the customer.
Maintain Secure Systems & Use Secure Applications
Do not “set and forget” your cardholder data security. Regularly update applications and systems. Check on your firewall and virus scanner configurations. Make sure your software stack does not create a security gap between tools. Also remain acutely aware of the data security provided (or not provided) by each of the applications your business uses to directly or indirectly handle cardholder data.
Remember that just one insecure app can become a backdoor.
Protect Account Data
When cardholders create an account with their legal names and personal information you are charged with protecting this account data in addition to specific information about payment cards. This is because financial peril can be created through identity theft alone – and card theft is easier with a full name and date of birth.
Apply End-to-End Encryption
Encrypt everything. Store your cardholder data encrypted. Make sure the data is encrypted when in-transit between apps and devices. Then ensure that the cardholder data is encrypted in each app where it is opened and handled. Stealing encrypted data for hackers is like opening a book and finding it was printed in the WingDings font – useless and therefore safe.
Monitor Systems and Set Up Alerts
Monitor your computer and networks systems to identify threats as they occur. Combine live monitoring with a comprehensive set of red-flag alerts to let you know if a hacker or their malware has crossed any security lines or attempted to access files that are protected by multiple layers of digital security.
Regularly Test the Security System
Run your security system through its paces on a regular basis. Perform penetration tests to find any potential security gaps and repair immediately should any be found.
Document Your Cardholder Security System
Lastly, be sure to document the entire structure and measures taken in your cardholder security system. You will need this documentation to prove your PCI compliance and to use as a roadmap for maintenance and updates in the future.
Master Your PCI Compliance and Protect Cardholder Data with Contego
Is your business effectively protecting cardholder data through PCI compliance? If you’re ready to take charge of your cardholder data security and ensure flawless PCI compliance, contact us to arrange a free security system consultation for your business.