Society of Payment Security Professionals Welcomes 50 New CPISM/CPISAs

The Aegenis Group is led by

Chris Mark, CISSP, CIPP; CEO/President and Founder

Please feel free to call me to discuss the article comments.

Chris
Chris A Mark, CISSP, CPISA, CPISM, CIPP
The Aegenis Group, Inc.

I (Chris) want to thank Susan Kohl for sending this over. Digital Transactions has published several articles on new technology that will allow PIN Debit for eCommerce sites. Read the article here.

In short, the new technology will present a buyer with a floating ‘PIN Pad’ on the screen. Users can then enter their PIN which will then allow the merchant to immediately debit the user’s account for payment. While the technology appears very compelling from a convenience perspective I have to admit that it also gives me pause. In my mind, there are a number of potential issues with this technology. I am sure (or at least hoping) the companies, banks and card brands are working through these issues but they merit discussion here anyhow.

From a security perspective, I am challenged by the technology. My first thought is key stroke logging and malicious software. Now I know people will likely say that this is possible with traditional eCommerce transactions. This is accurate. In this scenario, however, PIN data is being transmitted. As discussed in a previous entry, there may not be a limit to the liability associated with compromise of PIN data. It brings another question to light, as well.

If the transaction is a ‘card not present’ transaction then where is the PIN Verification Value / PIN Offset stored?

In a traditional PIN Debit transaction it is resident on the magnetic stripe of the card. This has several benefits one of which is that it prevents a data thief from obtaining a PIN and only the primary account number and being able to conduct PIN based transactions.

If the card is not required to be presented, it appears that this would allow fraudsters to obtain the PAN or other card data and the PIN and conduct transactions.

65pc of Irish websites put consumers at risk

According to an analysis from Enterprise Risk Services at Deloitte, some 65pc of Irish websites put consumers at risk of fraud.


Consumers have been warned about identity theft and fraud today in the run-up to Christmas after a study found that online payment security is not fully enforced on 65 per cent of Irish websites.
According to a study done by Deloitte Enterprise Risk Services, which analysed over 100 Irish based e-commerce websites, "a significant proportion of websites" are not compliant with the payment card industry security standards.

Deloitte examined over 100 Irish e-commerce sites and checked for the kind of security measures in place to ensure safe online transactions for the shopper and found that "a significant proportion of websites" are not compliant with payment card industry security standards.

The good news, Deloitte said, is that the situation with regard to compliance with the Payment Card Industry Data Security Standards (PCI DSS) has improved since its last analysis.

A breakdown of figures showed that 100-plus companies had weak encryption for online transactions, meaning that customers entrusting their MasterCard or Visa across these sites were putting their card and personal data at risk of fraud or identity theft.

Moreover, 53 per cent of companies supported weak or legacy encryption, with 2 per cent of sites not encrypting cardholder data entry sessions at all. This means that the information that visitors to the site submit such as name, address and credit card details can potentially be compromised and accessed by fraudsters.

There were no details from the report with a breakdown of how the payments were managed, ie whether the online merchant was privy to those details, or whether they were passed on to a trusted third-party payments processor such as Realex or PayPal, both of which would automatically have extremely secure methods of encryption and data protection.

Most sites will ask you to verify your credit-card details with the three-digit CVV2 code on the back of your credit card, which is another protection against fraud, but the Deloitte analysis found that 7pc of Irish e-commerce sites did have this.

A further 3 percent had expired SSL certificates, which are certificates displayed to ensure that the site you are dealing with is actually that site – another method of protection against phishing attempts whereby a fraudster could put a false web front in place in order to steal your details.

“The results of the survey show that many websites do not have adequate levels of security for processing online transactions, which many consumers carry out on a very regular basis,” said Colm McDonnell, partner, Enterprise Risk Services, Deloitte.

“Identity theft and credit-card fraud is a growing problem here in Ireland, and inadequate levels of security must be addressed by merchants as a matter of priority.”

By Marie Boran

Transacting business seamlessly over the internet means having a decent grasp of how things work, and more importantly, why they don't. That's why, with help form the smart folks at technology publisher O'Reilly Media, we've assembled a glossary of e-commerce-related tech terms that every entrepreneur should know.

• In Pictures: 25 E-Commerce Tech Terms You Should Know
  
• In Pictures: 30 Social Networking Terms You Should Know

Some of that gobbledygook is the province of tech jocks. However, if entrepreneurs want to achieve operational excellence while keeping technology investment in check, they have to be able to at least speak the language. And you don't have to know how to get down and dirty with computer code to understand the implications these issues have on strategy and budgeting.

Online retailers, for example, are trying to move beyond what has become the conventional, rather static consumer experience. One solution: real-time, individualized pricing. A new system, developed by uBee, allows merchants to "sense" what items a shopper is looking for on their websites, and spits out a custom price based on inventory levels and other particulars.

"That," says uBee CEO Bill Carpenter, "can give you personalization between buyer and seller."

The e-commerce platform that UBee plans to launch next month will rely on SOAP, for Simple Object Access Protocol, a technology standard based on using "envelopes" that retailers and uBee use to exchange information quickly enough to make these real-time offers. The "documents" in these envelopes invariably are written in XML, the most common software language in e-commerce, including variants such as XML-RPC and XML Business Reporting Language. (The acronyms are dizzying at first, but you get used to them.)

For all the billions of dollars being spent and collected online, the code at the core of e-commerce remains highly fragmented — and that creates communication breakdowns within the overall system.

"The Internet is still the wild, wild west," said Clint Page, chief executive of Dotster, a Vancouver, Wash.-based provider of Internet-business services. "It's not like more-developed parts of business and commerce where you get standardized platforms."

Take setting up a merchant account with a bank so that you can accept and process online payments. While bricks-and-mortar retailers only have to decide whether to accept checks and major credit cards, e-commerce is open to all sorts of other payment possibilities and transactions in currencies other than the dollar, such as HomeATM's PIN Debit/Credit Platform.

You'll also want to know a thing or two about affiliate programs. Under these advertising arrangements, companies collect cash for driving traffic to your site, and visa versa.

With Google now as much a verb as a company name, search engine optimization (or SEO) — the process of increasing a site's odds of ranking high in the search stacks — is a key consideration for any e-commerce player.

Says Dotster's page: "There is ferocious competition to be on the first two or three pages of each search." Editor's Note:  Do a Google Search on PIN Debit. 


Then there's the problem of security. While millions of consumers have grown comfortable with entering credit-card information into a Web site, reports of massive identity theft continue to crimp online sales. Editor's Note:  Consumers should NOT be comfortable entering their credit/debit card information into a Website. 

The lines of defense begin with authentication programs that determine whether someone signing on under a specific name is actually authorized to use the site via that specific account. Editor's Note: Dually Authenticated HomeATM PIN based transactions allow consumers to swipe their card (eliminating the risk and conveniently saving them from typing their card numbers onto a website). Entering the PIN (non-keystroke) makes for a  highly (dual) secured transaction.   Force users to jump through too many hoops, though, and you risk driving them away. Hence the single sign-on approach, in which either the user's computer or the website "remembers" passwords. Access control beefs up the barricades by granting entry only to specific site functions, such as adding an item to a shopping cart.

Want to make it clear that your site is indeed secure? Use software that adds a padlock icon in the user's browser window. Editor's Note:  Or use HomeATM's globally patented PIN based checkout system!

"Ensuring that your checkout process and, more important, the credit card form are well-secured will guarantee your customers feel safe when transmitting their information," says Pat Kaeowichien, director of information technology for Magnetic, a Tampa-based Web-development firm.

Credit card firms have taken critical steps to fend off identify thieves, too. In 2006 a consortium including Visa, MasterCard, American Express and Discover helped devise the PCI/DDS standard for providing secure communication for transactions over the Internet. 

"This standard is now in place for all merchants globally who accept credit cards — no exceptions," says Bill Bradley, senior industry marketing manager for Akamai Technologies in Cambridge, Mass. "Non-compliance can mean fines and, for that retailer, a loss of public trust. And that's the main reason people don't buy online in the first place."  Editor's Note:  Ironically, PCI DSS was initially designed for bricks and mortar retail locations, there is no specific WPCI (Web Payments Card Industry) standard...

Keeping them buying: That's what understanding e-commerce — and the technology that drives it — is all about.  Editor's Note:  Keep them buying securely, that's what HomeATM's technology is all about!