KioskCom 2008 Fast Transact, Inc | 2590 Willamette Dr NE, 2nd Floor | Lacey WA | / fax Fast Transact, Inc. is a registered ISO/MSP for Bank of America, N.A. Charlotte, N.C. and Wells Fargo Bank, N.A. Walnut Creek, C.A. PCI Compliance Protecting Consumer Data

KioskCom 2008 A Brief History PCI Compliance

KioskCom 2008 PCI = The Payment Card Industry Comprised of the 5 major payment-card brands:  Visa International  MasterCard Worldwide  American Express  Discover Financial Services  JBC

KioskCom 2008 In 2005, they formed the PCI Security Standards Council Main Objectives:  Creation, ownership, and management of the PCI DSS (Data Security Standard)  Classify audit requirements to certify compliance  Provide a certification process for compliance assessors and network scanning vendors

KioskCom 2008 The PCI DSS comprises a common set of industry tools and measurements designed to ensure the safe handling of sensitive consumer information.  In January of 2007, Visa introduced its Payment Application Best Practices (Visa PABP).  This broadened the scope of PCI DSS compliance to include any third-party payment application.  Third-party payment applications include payment gateways and ANY third-party software that store, processes or transmits credit/debit card data.

KioskCom 2008 According to an October 23, 2007 Visa Bulletin, the PCI Security Standards Council has adopted Visa’s PABP program and will be releasing the standard as the Payment Application Data Security Standard during 2008.

KioskCom 2008 Q: Where does my company fit into the PCI DSS? Unlike other regulatory programs, compliance with the PCI DSS relies on the merchant to perform a self-assessment to determine if they are compliant. Merchant Level Description 1 Any merchant – regardless of acceptance channel – processing over 6,000,000 Visa transactions per year. Any merchant that Visa, at it sole discretion, determines should meet the Level 1 merchant requirements to minimize risk to the Visa system. 2 Any merchant – regardless of acceptance channel – processing 1,000,000 to 6,000,000 Visa transactions per year. 3 Any merchant processing 20,000 to 1,000,000 Visa e-commerce transactions per year. 4 Any merchant processing fewer than 20,000 Visa e-commerce transactions per year, and all other merchants – regardless of acceptance channel – processing up to 1,000,000 Visa transactions per year.

KioskCom 2008 Compliance Requirements by Merchant Level Level Validation Action Description 1  Annual On-site PCI Data Security Assessment  Quarterly Network Scan  Qualified Security Assessor or Internal Audit if signed by Officer of the company  Approved Scanning Vendor 2  Annual PCI Self-Assessment Questionnaire  Quarterly Network Scan  Merchant  Approved Scanning Vendor 3  Same as Level 2 4  Annual PCI Self-Assessment Questionnaire  Quarterly Network Scan  Merchant  Approved Scanning Vendor

KioskCom 2008 Compliance Time Line Compliance Time Line PCI DSS 1.1 sets an enforcement date for acquirers to validate PCI compliance for Level 1 and Level 2 merchants. The enforcement dates are as follows:  LEVEL 1 MERCHANTS: September 30, 2007  New LEVEL 1 MERCHANTS: 1 year after identification as Level 1  LEVEL 2 MERCHANTS: December 31, 2007  New LEVEL 2 MERCHANTS: September 20, 2007  LEVEL 1 and LEVEL 2 MERCHANTS: Prohibited Data Retention Attestation form, or Confirmation of Report Accuracy to acquirer by March 31, 2007  LEVEL 3 MERCHANTS: contact acquirer  LEVEL 4 MERCHANTS: Must have compliance plan submitted, via acquirer, to Visa by July 30, 2007

KioskCom 2008 Q: I use third-party software that has transaction processing imbedded. How do I ensure my software is compliant with the most up-to-date PABP and PA DSS requirements?

KioskCom 2008 The full list of PABP validated payment applications can be found at: Visa.com – PABA Validated List Visa.com – PABA Validated List  An annual validation is required for those payment applications with major upgrade or product version changes.  If there are no changes to the product, Visa will require a letter signed by an Officer of the software company indicating no changes to the payment application and continued adherence to the Payment Application Best Practices.

KioskCom 2008 Not only have the PCI DSS deadlines come and gone, new mandates have gone into effect to enforce payment applications to adhere to the PABP. As of January 1, 2008, acquirers must not board new merchants that use known vulnerable payment applications. By October 1, 2008 ALL merchant levels MUST be PCI DSS compliant OR use a PABP-compliant application.

KioskCom 2008 The Impact of Non-compliance

KioskCom 2008 Q: “I am non-compliant... so what! What can happen to me?”  Level 1 and 2 merchant can be charged $5k to $25k PER MONTH of non-compliance status.  If a security breach is not reported to Visa in a timely manner, a $100k – 500k fine can be levied.  If a full card number is stored OR provided on a customer receipt the merchant can be fined $100 - $1,000 PER TRANSACTION.

KioskCom 2008 It’s generally believed that these fines are never imposed, that they exist to “scare” merchants. In 2006, Visa levied $4.6 million in fines, up from a 2005 total of $3.4 million, to its acquirers. $$$ WRONG $$$

KioskCom 2008 Have you ever heard of TJ Maxx or Marshalls? December 2007, TJX (parent company of TJ Maxx, Marshall’s and other discount retailers) alerted Law Enforcement that more than 45 million consumer records were stolen by data thieves. Since then, they have spent more than $20m on investigation, consumer notification, and an expert legal team to protect them against the multitude of lawsuits the breach generated.

KioskCom 2008 March 27, 2008:  The FTC ruled that TJX was in violation of the “FTC Act of 1914,” by failing to employ reasonable measures to protect the sensitive consumer information on its networks.  The March 2008 ruling will help acquirers and other transaction processors become less liable for breaches caused by poor security on the part of their merchant or sales organization.

KioskCom 2008 As reported by InformationWeek.com, in-store computer kiosks are partly to blame.  The kiosks allowed individuals to apply for jobs electronically; however, the kiosks were not protected by a firewall and therefore acted as a gateway into the company’s IT systems.  Even though the kiosks were NOT performing transactions, they provided a way for data thieves to get to credit card information through unsecured USB ports.

KioskCom 2008 Historically, acquirers are responsible for any fines incurred due to non-PCI DSS compliant merchants.  August 1, 2008: The Plastic Card Security Act of Minnesota takes effect.  This legislation marks the first time that the cost associated with data breaches has shifted from the financial institutions to the retailers that mishandle consumer financial data.

KioskCom 2008 PCI “Lessons”

KioskCom 2008 Important lessons regarding PCI DSS and PABP:  Look for weak links within your organization’s network. If you don’t find them someone else will.  Fines are real. They can and will be levied against those not complying with the PCI Security Standards. and most importantly... customer data cannot be stolen if merchants are not retaining it!

KioskCom 2008 FTI PROGRAM CONTACTS: Terry RobertsAdriane Armbruster Director of Software IntegrationSenior Account Executive  ext. 126  ext. 106 FTI POST-SALE CONTACTS: Fast Transact, Inc 2590 Willamette Dr NE, 2 nd Floor Lacey WA Phone: Toll Free: Fax: Customer Service Monday - Friday 6 am - 11 pm (PST) Phone: Toll Free: Technical Support Monday - Friday 6 am - 11pm (PST) Phone: Toll Free: Contact List

KioskCom 2008 Bibliography  Greenemeir, Larry. “The TJX Effect.” Information Week. 11 Apr Information Week. 8 Nov  “FTC Files Settlement Agreement with TJX.” TheGreenSheet.com. 28 Mar Apr  Visa Announces New Payment Application Security Mandates. VISA International. VISA International,  Wollenhaupt, Gary. “PCI Standards Weight Heavy on ATMs, Kiosks.” Self Service World. 4 Jun Irvington Writers Studio. 8 Nov  Payment Card Industry (PCI) Data Security Standard. PCI Security Standards Council. Wakefield, MA: PCI Security Standards Council,  “Fine Data.” PCI Compliance Guide. 3 Apr  “Cardholder Information Security Program.” Visa International. 3 Apr