The Payment Management Blog

Tokenization Vendors, Unite!

On Wednesday at the RSA Conference 2010, a presenter in the session for Tokenization and PCI raised an interesting point about the lack of standardization for the technology hindering its adoption in the market.

Ramon Krikken from the Burton Group said that, among many other things, the different ways vendors define and describe tokenization confuse the consumers. Additionally, the lack of interoperability between the tokens from different service providers fan the fear of vendor lock-in. For example, a merchant with multiple processors would likely use several tokenization services, and the tokens cannot be used interchangeably between the processors. 

In a sense, it's a chicken-and-egg problem. It is hard for vendors to standardize if the market hasn't matured enough, but consumers are not likely to adopt the technology due to lack of standardization. One way to break this roundabout is for a standards body such as the PCI Security Standards Council to lead the effort in drafting recommendations/guidance for tokenization as deployed for PCI compliance.This could go a long way in allaying confusion and fears in the industry.

What are your thoughts? Do you agree? Please share in the comments section.

Lock Down for the Holidays

With the emergence of Halloween decorations in stores and on front doors, the holiday shopping season is starting to awaken. Merchants are getting ready to introduce holiday sales promotions. They are prepping their sales channels and infrastructure to support the increase in business - hiring temporary staff, increasing server bandwidth to support website traffic, etc.

For most merchants, one critical preparation is to lock down the payment infrastructure to prevent unexpected outages. During this time, they are not likely to make any changes or upgrades unless critical to the operations. Unfortunately, that includes security patches that may be the one thing that stands between the system and a hacker.

Merchants should ensure all security holes in the payment infrastructure are taken care of before the holiday lock down. Otherwise, the person having a merry season would be the hacker instead of the merchants and their customers.

CyberSource at PCI Security Standards Council Meeting in Las Vegas

The PCI Security Standards Council is holding its community meeting in Las Vegas at the Mandalay Bay September 22 to 24. Like last year, included in the agenda is a vendor showcase available during breaks distributed throughout the day of September 23. If you are attending the meeting, come by our table to learn more about the principles behind Enterprise Payment Security 2.0. If you aren't able to come by the vendor showcase, feel free to catch one of the council representatives from CyberSource. See you there.

Putting Parentheses Around Management of Payment Security

Last week at the DRF in Tampa, the keynote speaker for the second day was Dr. Topher Morrison, expert in Neuro-Linguistics Programming, Hypnotherapy and Personal Evolution. He was charming, entertaining, and uplifting with his message - live the life you want through the power of positive thinking. He also talked about putting things in perspective: in the grand scheme of eternity, your life is just a set of parentheses. In another words, your life, bracketed by birth (open parenthesis) and death (close parenthesis), can be removed from the timeline of eternity without altering it.

Taking it one step further, the same metaphor can be applied to the management of payment security within your business. What that means is: put parentheses around the management of payment security so that it can be taken out of your business without affecting your business operations. Let trusted solution providers accept, transmit and store your payment data for you. Your business will continue to run smoothly and more efficiently, while maintaining PCI compliance with less complexity. Your customers will continue to trust your brand.

And most importantly, you will sleep better at night.

It's time to think differently about payment security

Today’s common approach to securing payment data is to encrypt the data during transit and/or at storage onsite. Recently there have been more discussion in the industry about end-to-end encryption (read article on post-breach Heartland Payment System's strategy). Even if there are solutions to support the concept in its entirety, that often becomes very complex and costly to manage as your business grows. Think about this – every time you add a new sales channel, or a new payment type, or a new geographical market, you double the complexity of your system. Add in human interaction and just-in-case practices that often permeate businesses, and you have your hands full in making sure your system is secure and PCI compliant. 

The less complex approach is to remove all that payment data from your system.  PCI standards do not mandate that merchants have to encrypt and store payment data. Even Visa has a Drop The Data campaign. Why not let the service providers who specialize in taking care of payment data do just that on your behalf, so you can focus on taking care of other parts of the business?