PCI Compliance

Global Payments Integrated maintains that the most effective method for keeping cardholder data safe
is a multi-pronged approach, combining EMV, encryption and tokenization.

EdgeShield™ is the Global Payments Integrated answer –

An advanced security services bundle intended to protect credit card data, prevent counterfeit fraud, and enhance payments security. Through a unique collection of complementary security solutions, EdgeShield delivers one of the industry’s most secure payments platforms while preparing developers and merchants for EMV. When integrated into systems that accept payments, the bundle protects credit card data while at rest and in transit.

EdgeShield includes the PCI ASSURE program to help merchants simplify PCI compliance with online access to self-assessment questionnaires, network scans, a breach reimbursement program, and custom security profiles generated from the business’ processing activity.

EMV Technology
This fraud-reduction technology protects card issuers, merchants and consumers from losses due to the use of counterfeit and stolen payment cards at the point-of-sale. EMV smart cards are embedded with a chip that interacts with a merchant’s point-of-sale device, ensuring the card is authentic and belongs to the user. This chip technology is virtually impossible to duplicate. The technology helps insulate developers from complex device driving and card brand certifications.

End-to-End Encryption
Global Payments Integrated’s proprietary encryption is designed to render cardholder data unreadable, encrypted at the device. Merchants are unable to view card numbers after the swipe, dip or hand-key.

Tokenization
Cardholder data is replaced by digital “tokens” based on this technology. Sensitive data is stored in the secure Global Payments Integrated vault rather than in the merchant environment.

PA-DSS Out of Scope
Payment applications are rendered out-of-scope with EdgeShield, eliminating cumbersome PCI validation requirements.

The Payment Card Industry Data Security Standard (PCI-DSS) is comprised of twelve requirements focused on protecting cardholder data. Requirement 3 of the PCI-DSS directs all entities involved in processing credit cards to “protect stored cardholder data”. Payment solution developers and Service Providers should first aim to eliminate or limit storage of cardholder data. When data storage is necessary this data must be stored securely and according to the individual PCI requirements.

What Is Cardholder Data?

Cybercriminals are looking to steal account data by compromising insecure payment solutions, service providers and the merchants that use their services. This data is classified as either Card Holder Data (CHD) or Sensitive Authentication Data (SAD).

Cardholder Data (CHD) is typically data that is printed on the front of the card. This includes primary account number (PAN), cardholder name, and expiration date. Sensitive Authentication Data includes the CVV code, track data contained in the magnetic stripe, PIN/PIN Block, and EMV chip data. 

What Cardholder Data Can and Can’t Be Stored?

Sensitive authentication data cannot be stored after authorization. Storage of Cardholder Data must be limited to that which is required by legal, regulatory or business needs. Developers of payment solutions that eliminate storage of account data provides maximum PCI scope reduction to the merchants that use these products.

Do: Know the flow of payment card data throughout the transaction process. 

Developers of payment processing solutions and Service Providers must be aware of the flow of account data throughout the transaction process. Merchants are responsible for developing data retention policies and understanding which systems may affect the security of account data.  

Do: Use strong cryptography to render unreadable cardholder data that is stored. 

If Cardholder Data is stored, it must be rendered unreadable using one of the accepted methods listed in PCI-DSS required 3.4. This must be done through either one-way hashes, truncation, index tokens and pads, or strong cryptography including requirements for key management and strength at or above industry standards. Use industry-tested and accepted hashing algorithms for encryption including SHA-1, AES (128 bits and higher), TDES (minimum double-length keys), RSA (1024 bits and higher) along with layered security technologies to minimize the risk of data compromise. Additionally, merchants and service providers handling cardholder data must have a methodology for secure deletion and a quarterly process to identify the presence of cardholder data stored outside of the retention policy.

Developers of integrated payment solutions should always choose a solution that does not require storage or handling of account data. This is the easiest way to avoid the hassles of securing account data and the risk of a costly data compromise.

Do: Follow PCI DSS requirements, validated by yourself or outside assessment.

All entities involved in the storage, processing, and transmission of account data must validate PCI compliance. The PCI-DSS is a list of requirements designed to limit the possibility of exposure of account data. This exposure is typically the result of malicious actors looking to compromise merchants through physical means, or more commonly through the use of malware. Small merchants can validate PCI compliance through a self assessment process. Larger merchants and service providers should engage a third party Qualified Security Assessor to validate compliance with all PCI requirements.

Developers of payment solutions that fully outsource handling of account data to a Level 1 PCI-DSS validated service provider, like Global Payments Integrated, can limit or fully eliminate the burden of PCI compliance validation.

Don't: Store cardholder data unless necessary.

Sensitive authentication data can never be stored after authorization. Cardholder data can be stored only when absolutely necessary for legal, regulatory or business purposes. Stored Cardholder Data is a target for cybercriminals looking to steal this data and use it to perform fraudulent transactions. Developers should limit or eliminate the need for storage of cardholder data by fully outsourcing the payment processing to a validated Third Party Service Provider. For card on file or recurring billing transactions merchants should take advantage of tokenization services.

Don't: Store sensitive authentication data contained in the payment card’s chip or magnetic stripe.

Data contained in the EMV chip and magnetic stripe, as well as the 3 or 4 digit validation code (CVV) and PIN/PIN Block are considered sensitive authentication data and cannot be stored.

Don't: Print or display cardholder data that is not adequately masked.

Ensure that your payment solution does not print the expiration date or unmasked primary account number on receipts. The primary account number should be masked whenever printed or displayed, with the maximum number of digits being the first six and last four digits.

Don't: Locate servers/payment card system storage devices outside of fully-secured rooms.

Access to any systems that store cardholder data must be restricted appropriately. This includes access control measures that include visitor logs, physical access controls and video monitoring. Databases that store cardholder data cannot be available to the public internet. Again, the best way to avoid having to secure these systems is to eliminate any storage of account data.

Don’t: Engage in data security practices that violate the PCI DSS regulations, following the goals established by the Council. 

Developers of payment solutions and service providers that fail to comply with the PCI-DSS requirements are much more likely to become a victim of a data breach. Validating PCI compliance and developing robust policies and procedures to protect or eliminate stored cardholder data is the best way to avoid a costly data breach.

[Pendo Banner Test] https://partners-gp-one-portal.pantheonsite.io/