Visa Releases Global Data Encryption Best Practices
Paves way for industry standards; Implementation enhances card data security
"While no single technology will completely solve for fraud, data field encryption can be an effective security layer to render cardholder data useless to criminals in the event of a merchant data breach," said
In addition to issuing encryption best practices, Visa has led efforts to develop a much needed industry data field encryption standard as chair of the ANSI X9F6 standards working group. Establishing industry wide standards are essential for ensuring that emerging encryption solutions are open, consistent and enable merchant choice. X9 is the ANSI accredited committee for financial services that is focused on "standardization for facilitating banking operations." Membership includes financial institutions, vendors, insurance companies, associations, retailers and regulators.
"Given the interest expressed by merchants and processors, guidance from the card brands is a critical determinant in figuring out how to move ahead with encrypting data in transit, especially absent a global standard," said
Visa's best practices are designed to help organizations:
-- Limit cleartext availability of cardholder data and sensitive authentication data to the point of encryption and the point of decryption.
-- Use robust key management solutions consistent with international and/or regional standards.
-- Use key-lengths and cryptographic algorithms consistent with international and/or regional standards.
-- Protect devices used to perform cryptographic operations against physical/logical compromises.
-- Use an alternate account or transaction identifier for business processes that requires the primary account number to be utilized after authorization, such as processing of recurring payments, customer loyalty programs or fraud management.
It's important to note that sensitive authentication data such as full contents of the magnetic strip, CVV2, PIN/PIN block should not be used for any purpose other than payment authorization and may not be stored after authorization, even if encrypted.
While data field encryption applies after the card is swiped and throughout the merchant's environment, encryption solutions between acquirer processors and Visa would further reduce the value of card data to criminals. Visa accepts encrypted transaction data from acquirers, third-party processors and merchants directly connected to VisaNet. Visa has offered an authorization and settlement encryption solution since early 2008, and the service is available to direct connect clients.
"Investing in data field encryption is valuable, but should be understood as a complement rather than a replacement for PCI DSS compliance, which remains the best protection against a data compromise," Perez concluded.
Link to Visa Best Practices, Data Field Encryption Version 1.0: https://corporate.visa.com/_media/best-practices.pdf