Evan Schuman's StorefrontBacktalk

Like any security application, IT management of tokens must consider that cyberthieves are going to be constantly updating their attack methodologies, especially when tokens become more popular and, as a result, more profitable targets.

“If a token is generated as a result of using a hash function, then it is a relatively trivial effort for a malicious individual to reconstruct original PAN data if they have access to both the truncated and hashed version of the PAN,” the guidance says. “Where hashed and truncated versions of the same PAN are present in the environment, additional controls should be in place to ensure that the hashed and truncated versions cannot be correlated to reconstruct the original PAN. Because it contains PANs as well as tokens, the data vault often presents the most attractive target for attackers. Compromise of the data vault could potentially result in the compromise of the entire tokenization system, and additional security controls above and beyond those required in PCI DSS may be warranted.”

A token strategy will also change retail contractual issues and bring in a new player—the token vendor—to the security mix.

“Some PCI DSS requirements will apply to the merchant even when a tokenization [approach] is outsourced or hybrid. For example, PCI DSS controls apply wherever PAN is processed, stored or transmitted—such as at the point of capture—as well as at any de-tokenization points. Additionally, the merchant is required to implement and maintain policies and procedures to manage service providers whenever cardholder data is shared,” the guidance says. “Ensure that proper contractual agreements are in place, with the tokenization service provider acknowledging that the service provider is responsible for the security of cardholder data processed, stored and/or transmitted by the service provider. Review logs of the merchant’s interaction with the tokenization systems and processes on a regular basis to ensure that only users and system components authorized by the merchant have access to the tokenization/de-tokenization processes.”

Another line should probably be added to contracts, one addressing the fact that the token vendor “supports the assignment of PCI DSS responsibilities between the [token vendor] and their customers. For example, the solution should not return PANs to a customer without the customer’s express permission and acknowledgement of how this action might affect the customer’s responsibility for securing cardholder data and for validating PCI DSS controls.”