Evan Schuman's StorefrontBacktalk

Visa noted that “Merchants using this type of configuration are being targeted by criminals who gain unauthorized access to the merchant’s Web site by directly exploiting vulnerabilities in either a merchant’s Web site or in the merchant Web server. Once compromised, hackers will modify the merchant’s code, which links to the hosted payment page, redirecting customers to a counterfeit page that looks identical to the third-party’s authentic hosted payment page.”

That is, the bad guys hack your server and instead of directing your customers to your payment processor, you end up sending them to badguys.com—or at least badguys.com sees the transaction. Now your customers’ card data has been well and truly breached.

Currently, SAQ A does not require that the merchant’s Web site be located behind an effective firewall (Requirement 1) or that the server be scanned (internally and externally) and penetration tested (Requirement 11) to identify vulnerabilities that make the bad guys’ job easier. SAQ A merchants should comply at least with these two additional PCI requirements. It should not matter that these are not in the SAQ. Just because merchants do not store cardholder data does not mean they are invulnerable to a cardholder data breach.

I know some SAQ A merchants do have their servers behind an effective firewall, and I even know a few who perform quarterly internal and external scans. None of these requirements is in their SAQ, but they take these steps because they want to be secure.

SAQ B is for merchants who use dial-out POS terminals or imprinters (a.k.a., zip-zap machines or knuckle-busters). This SAQ has 29 questions, and it includes all the PCI requirements in SAQ A plus three more: parts of Requirement 3, for protecting cardholder data and not storing sensitive authentication data like the mag stripe; one part of Requirement 4, so you don’t E-mail or text unencrypted PANs; and parts of Requirement 7, which restrict data and system access to staff whose job requires it. There also are additional subsections of Requirement 12 in SAQ B covering security policies and staff training.

I’d say SAQ B is pretty complete. If a merchant only has POS terminals connected to dial-out phone lines (no Internet, remember), then this SAQ looks to do a pretty good job. I would add one item that is good security even though it appears nowhere in PCI today: requiring regular physical inspection of POS devices to identify evidence of tampering.

POS devices are vulnerable to tampering and even replacement by criminals. Smart retailers train their staff and managers to report when they observe changes (“Golly, the terminal wasn’t green yesterday, was it?”). Really smart retailers monitor their POS devices with an automated system that alerts them when a device is turned off or disconnected.