Where's Your Credit Card Data? - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

IoT
IoT
Software // Information Management
Commentary
1/30/2008
03:53 PM
Connect Directly
LinkedIn
Google+
Twitter
RSS
E-Mail
50%
50%

Where's Your Credit Card Data?

PCI regulations require companies to protect credit card numbers. But first you have to know where they are. Here's what I've learned from retailers and PCI auditors about step one of PCI compliance.

PCI regulations require companies to protect credit card numbers. But first you have to know where they are. Here's what I've learned from retailers and PCI auditors about step one of PCI compliance.It's simple to track credit card data from the point of sale to your databases and the bank that processes the transaction. More challenging is uncovering the nooks and crannies it falls into throughout the organization. Depending on your business processes, credit card data could be stored on customer service PCs, inside spreadsheets in the marketing department, or on backup tapes being shipped off-premises.

As I research an upcoming feature on PCI, I've been speaking with a number of retailers and PCI auditors. Here are a few tips you might find useful.

1)Self assessments. CIOs are conducting internal audits of their IT teams and business units to find out who touches credit card data and where they keep it. It's important to get this information from all the stakeholders, particularly business units that take customer orders or use card data to analyze buying trends.

2)3rd-party audits. It's often instructive to bring in outside experts to help you ferret out credit card data. One auditor told me about a major grocery chain that had made significant efforts to purge card data from systems that didn't specifically need it. But when he bought a pack of gum with his credit card and then reviewed the logs of the point of sale system, he found it was recording the full card number and expiration date.

Of course, third-party audits are expensive, so you have to weigh the cost against the potential fines of PCI violation -- along with the risk of a malicious party getting access to that data source.

3)Use tools. One retailer bought a data leak prevention product to make sure intellectual property and other sensitive data didn't leave the network. He also used its discovery feature to crawl his headquarters network and remote offices for repositories of card numbers. He used the findings to approach the business units holding the data to ensure they were following IT policies for encryption.

He also crawls the network regularly for rogue data or noncompliant business units. Which brings us to ...

4)Get your processes in order. Some 99% of PCI compliance revolves around having IT and business processes in place to secure card data. You have to ensure that business units understand IT policies -- and that they're following them. You also may want to tweak business processes to minimize (or eliminate) the use of credit card data wherever possible. For instance, credit card numbers can be replaced with unique identifiers to analyze customer purchases.

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
News
COVID-19: Using Data to Map Infections, Hospital Beds, and More
Jessica Davis, Senior Editor, Enterprise Apps,  3/25/2020
Commentary
Enterprise Guide to Robotic Process Automation
Cathleen Gagne, Managing Editor, InformationWeek,  3/23/2020
Slideshows
How Startup Innovation Can Help Enterprises Face COVID-19
Joao-Pierre S. Ruth, Senior Writer,  3/24/2020
White Papers
Register for InformationWeek Newsletters
Video
Current Issue
IT Careers: Tech Drives Constant Change
Advances in information technology and management concepts mean that IT professionals must update their skill sets, even their career goals on an almost yearly basis. In this IT Trend Report, experts share advice on how IT pros can keep up with this every-changing job market. Read it today!
Slideshows
Flash Poll