Web Advisory Committee June 17, 2009

 Implementing E-commerce at UW  Current Status and Future Plans  PCI Data Security Standard  Questions

 Prepare an e-commerce business plan.  Obtain approval from Financial Systems Mgmt. Committee.  Organize project.  Obtain bank merchant account & Beanstream account.  Design/build application or install packaged application or configure hosted application according to standards (PCI, Bank, UW).  Integrate with Beanstream if not hosted.  Test.  Review/signoff by Finance and Security.  Go – live.

 Describe the products or services to be offered and the rationale for offering them via e-commerce.  Provide estimated annual transaction and dollar volume.  Describe the business process to handle the additional workload from the e-commerce function, including the accounting, maintenance, and reconciliation of general ledger accounts and the credit card operation.  Indicate whether the operation currently accepts credit cards.  Identify the hardware requirements and hardware location.  Identify the source of technical support.  Identify areas or departments that need to be involved in the development and implementation of your e-commerce initiative; examples may include Finance, Information Systems and Technology, or Procurement and Contract Services.  Identify the working group to develop the initiative.

 Must use Beanstream for credit card processing.  Beanstream provides multiple integration methods.  UW uses Beanstream’s hosted payment page to ensure security, privacy, and for easier PCI compliance. No credit card information is stored on a UW server.  IST provides an e-commerce server to host Linux applications.  Use of other, secure servers is acceptable.

 May use a hosted shopping cart / event management site. Little experience with this at UW.  Must use Beanstream for credit card payment processing in all cases.

 Retail Services  Housing ◦ Residence deposits ◦ Off campus housing landlord fees  Watcard  Parking  CEMC  Events and conferences come and go

 Continuing Education  Conference Centre  Food Services

 UW approved, hosted shopping cart system.  UW approved, hosted event/conference system.  Hosting will significantly reduce implementation effort for all UW participants.  Will make small volume e-commerce sites more feasible.

 PCI = Payment Card Industry (Amex, Discover, JCB, MC, Visa)  PCI Data Security Standard (DSS)  PCI DSS v1.2 released October 2008  72 page document  Consistent security measures around the processing, storage, and transmission of credit card data  A nice baseline of security measures for any application

 Depends on how credit card data is handled  SAQ = Self Assessment Questionnaire  Assessment from an external QSA  Regular network scans of e- commerce sites SAQ Validation Type Description SAQ: V1.2 1 Card-not-present (e-commerce or mail/telephone-order) merchants, all cardholder data functions outsourced. This would never apply to face-to-face merchants. A 2 Imprint-only merchants with no electronic cardholder data storage B 3 Stand-alone terminal merchants, no electronic cardholder data storage B 4 Merchants with POS systems connected to the Internet, no electronic cardholder data storage C 5 All other merchants (not included in Types 1-4 above) and all service providers defined by a payment brand as eligible to complete an SAQ. D

 Our acquirer requires us to be compliant with PCI DSS  All validation types apply to UW  Security measures for validation type 5 are expensive  Strategy: Eliminate cases where validation type 5 apply

 E-commerce websites must not collect, transmit or store credit card information  Reduce scope: Isolate IP-based PoS terminals from the rest of the campus network  Include in more general security policies and procedures

 Heavy fines from the acquiring bank  Bank could suspend the University’s ability to process any credit card

 ml ml  rds/pci_dss.shtml rds/pci_dss.shtml  EcommerceSystemSecurityStandards EcommerceSystemSecurityStandards