This is page 2 of:
Is PCI Skimping On Skimming?
A second change would be to monitor all POS devices and to generate an alert whenever a POS device is removed, disabled, turned on or off, or added. The bad guys are adept at removing retailers’ POS devices, then either compromising them or replacing them with their own compromised devices. I recognize this recommendation does nothing for dial-up POS retailers or those with standalone devices, but these are rarely unattended and I don’t think these merchants are necessarily the primary targets of skimmers.
The next issue is where in PCI to make the changes. PCI Requirement 9 (Restrict Physical Access to Cardholder Data) addresses physical security of your cardholder environment and that is a reasonable place to add POS devices. Some people think this requirement only applies to their datacenter, but it also addresses media (both electronic and paper) containing cardholder data.
Another potential place to address POS device security is Requirement 11 (Regularly Test Systems and Processes). This requirement addresses internal and external vulnerability scanning and it requires merchants to search quarterly for rogue wireless networks. Under PCI v 2.0, retailers may use visual inspection to find rogue wireless networks, so we have a precedent for adding visual inspection of POS devices to this requirement, albeit on a daily not quarterly basis.
Wherever we make the changes, we need to add requirements specifically aimed at protecting both attended and unattended POS devices from skimming attacks. The PCI Council can change PCI at any time without waiting for the three-year lifecycle to run its course. They have the flexibility to adapt PCI at any time to address new or expanded security threats. POS skimming is not new, but it does seem to be increasingly common so it might justify an interim update to the DSS.
Regardless of any action by the PCI Council, retailers do not need to wait before taking action. They can adopt the changes I suggested (and maybe others, too) as part of their security program. If, on the other hand, PCI is your entire security program, you will miss this chance to reduce your risk and you may be the next retailer to get to ask their customers to check their monthly credit card bills.
I look forward to some Participating Organizations providing this feedback to the Council. Now is the time since the feedback period is officially open. In the meantime, I hope retailers will limit this season of sharing so it does not include sharing their customers’ credit cards with the bad guys.
What do you think? Have you or your company been the victims of a skimming attack? Could you spot a compromised POS device in one of your stores? Are there other changes to PCI you will be suggesting during the feedback period? I’d like to hear your thoughts. Either leave a comment or E-mail me at wconway@403labs.com.
-Marc
November 30th, 2011 at 11:51 am
Please consider EMV. This is exactly what it was designed for.
November 30th, 2011 at 10:01 pm
Thanks for the comment, Jonathan. Unfortunately, EMV is not going to be a solution for several years at the soonest. And since ATMs still use the mag stripe almost everywhere, EMV does nothing for banks’ risks. (I focused on retailers’ risks, but banks face the same or larger risks at their ATMs!)
What merchants (and banks) need to do is address the problem now based on the technology that is in use. That means at least visual inspection of POS devices and automated monitoring of them when they are moved, disconnected, or turned on/off. And then, once EMV (or at least some form of chip) is implemented across the planet, all we need to do is make sure the chips never, ever fail so retailers don’t need to read the mag stripe. Unfortunately, that is not likely to happen soon, either.
I’m putting my money on changes to smart retailers’ security practices coupled with enforcement from a change to PCI to encourage everybody else.
December 1st, 2011 at 2:52 pm
Walt,
EMV payment processing machines were implemented throughout the USA and in ATMs but have not been enabled at this time. For example, all of Wal-Mart payment devices are EMV-equipped to handle chip and pin.
December 2nd, 2011 at 11:37 am
Good comment, Ed, but terminals are not the issue. The cards are the issue.
That is until retailers no longer use or need the mag stripe, skimming is going to happen. And it is going to happen to the least prepared, least vigilant, and least aware retailers. This is less a technology issue (although monitoring your devices is a great idea) but a result of living with a 50-year old technology (i.e., mag stripe), and until that is changed all the EMV-equipped terminals in the world won’t help too much.