This is page 2 of:
Are Data Backups Unintentionally Expanding Your PCI Scope?
If we think the five users’ smartphones have a copy (admittedly, this assumption may be a stretch), we get to 17 locations and then to 22 when the users sync their phones to their home computers. Because most users back up their home systems, we now have 27 locations before considering any Windows restore points, which could take us up to 32 locations.
All these locations sprang from one digitized fax, and I’m not even counting the paper backup or the electronic copy remaining on the fax machine’s internal memory. And you thought only Tribbles could multiply this quickly!
Even low-tech backup systems expand your PCI scope. Printed order forms used in callcenters or sent in by customers frequently contain PAN data. Many merchants retain these forms in (hopefully locked) file cabinets as a backup system in case of a dispute. Sometimes the forms are scanned into electronic databases.
Smart retailers and their callcenters design their forms to place the cardholder data on the bottom, so it can be easily separated and shredded once the transaction is authorized. Simply scratching out the PAN with a pen or a marker does not count as truncation for PCI compliance purposes. You can still read the PAN pretty easily by tilting the paper or holding it up to the light.
Merchants mistakenly keep these paper records as a backup system. They think they need the data in case of a dispute. Hopefully, Visa’s recent guidance will convince these merchants they don’t need to keep these complete records. Merchants need to store payment data–name, date, amount, first six or last 4 digits of the card–for any number of reasons, but they do not need to keep cardholder data.
The spread of cardholder data and your PCI scope gets more complicated when card security codes are involved. These codes (e.g., CVV2, CVC2, CID) are never to be retained after authorization. Unfortunately, retailers can inadvertently store these in backup paper records or electronically in forms they have scanned into a database.
As we reported back in April, the PCI Council is very well aware of the risk in data backups, both those you know about and those unknown-unknown ones. I expect version 2.0 of the PCI-DSS will require every merchant to have some process or procedure to locate all their cardholder data. I do not know what they will require or how frequently (i.e., annually during your compliance assessment or quarterly like vulnerability scanning). What I do know is that data storage is a dynamic process, and just because you checked last week doesn’t mean someone hasn’t done something new today.
What do you think? I’d like to hear your thoughts. Either leave a comment or E-mail me at wconway@403labs.com.
Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code.
-Marc
