PCI

By Rob Sadowski – RSA Director, Marketing, Payment Solutions

Payment security is back in the public eye with the recent disclosure of a cardholder data breach at a leading US payment processor. While initial reaction to this latest incident has been unfortunately predictable, characterized by plenty of uninformed speculation, outrage, and a general lack of understanding of the workings of the payments industry, the story that is ultimately written about this latest incident might be one that is completely unexpected.

If this latest breach has reinforced something that we already know, it’s that cardholder data remains a valuable commodity in the criminal underground and that sophisticated and determined fraudsters continue to target organizations who have it. Large or small, processor or merchant, Level 1 or Level 4, if you handle payment card data, you are a target.

What’s also becoming clear is that defending information assets is more difficult than ever. As former U.S. Director of National Intelligence Mike McConnell recently stated in testimony on cyber security: “there isn’t a corporation in the nation today that can’t be penetrated, not one.” While he is speaking primarily about threats from advanced attackers seeking defense or military secrets, if there is another unfortunate fact that we are all aware of, it is that bad actors are better at sharing information than good actors, and successful techniques will soon become common knowledge and widely used against any valuable target.

Faced with this reality, we have to begin to accept the idea that intrusions are inevitable. It’s not easy. It doesn’t feel right, especially when we have relied for years on a perimeter security model where the focus is on keeping bad guys out of our networks. But once we do, we can start to envision a constructive path that moves payment security forward.  While intrusions may be inevitable, they don’t have to equal data loss and defeat. This industry has proven time and time again through its history that it can effectively manage risk to acceptable levels.

The first question to ask is why are organizations that have no need to handle unprotected payment card data still doing so? Here I am referring to merchants. We’ve been writing in this blog for the past two years about end-to-end encryption and tokenization. Properly implemented, with encryption where cardholder data enters the merchant environment for authorization, to the replacement of card data with tokens for use post-authorization, cardholder data is either protected or removed from merchant systems altogether with no loss of business functionality. Merchants who implement these capabilities as a service from a provider like their payment processor never have access to the unprotected card data, which drastically  reduces their risk and exposure in the (inevitable) event of an intrusion. If merchants cannot avoid being targets for cybercriminals, they have the means at their disposal to largely avoid the consequences.

Apparently, we’re not the only ones who think so. VISA, in their statement regarding this latest breach stated: “Visa also supports advanced security layers such as encryption, tokenization and dynamic authentication … to further protect sensitive account information and minimize the impact of data compromises.”

Our partner First Data has more than 250,000 merchants using this technology today. While this is a large number, it’s less than 5% of the more than 5 million US merchants that VISA tracks. As an industry, we’ve got a long way to go to reduce our attack surface.

This brings us full circle back to payment processors and card associations. The way the system works today, to authorize transactions, they must have access to unprotected card data in parts of their networks. They will remain the highest value targets for cybercriminals. The security mindset of these critical participants needs to evolve from preventing every intrusion to how to quickly discover intrusions, stop the attackers from gaining a foothold, minimizing the effects, and avoiding a substantial breach.

This next statement may seem like heresy, but as soon as we let go of the notion that we can have perfect security, that we will be able to keep every determined and skilled adversary at bay, we can constructively move forward as an industry. RSA has written extensively about this new security paradigm. You can read more here in this report, “When Advanced Persistent Threats Go Mainstream” and here “Getting Ahead of Advanced Threats”.

Let me make one more suggestion. While conventional wisdom would dictate that this is perhaps the worst time to make this statement, I think the attention makes it precisely the right time to make it: Merchants should seek to entrust the security of their customers’ payment card data to processors and other “repositories of risk” who will always be better prepared to face and defend against the latest attacks and threats. If merchants can’t trust their current provider, they should find one they can. Security has to be a core competency of these providers by virtue of their role in the ecosystem and the way the payments value chain works today. They need to embrace security as a duty and deliver it as part of their core product. But it needn’t be for merchants, whose core business is merchandising goods and services and serving consumers. RSA and a team of industry collaborators predicted such a shift several years ago in a research paper entitled “Secure Payment Services: Card Data Security Transformed” Many of our conclusions seem particularly prescient against the backdrop of recent events.

So what will be the long-term impact of this latest breach? Will we speculate endlessly about who perpetrated it, how it happened, the supposed ineffectiveness of regulations, or revisit any number of familiar rehashed topics, or is this finally the event that causes the payment security industry to reinvent itself based on today’s security reality?

I, for one, would like to see us push the reset button.

Rob Sadowski leads RSA’s go-to-market efforts with partners in the payments industry.