Card Data: Visa Praising Encryption
- Visa is readying Visa Merchant Data Secure with Point-to-Point Encryption, a new service meant to help acquirers and merchants secure their customers card data. The suite is to be made available in the beginning of 2013. Visa currently focuses on setting up specially crafted specifications to guide merchants and processors through integrating their new offer into their existing systems.
- Encrypted from the start, the data (including PANs, CVxs–the storage of which is not allowed– and expiration dates) could not be compromised where stored and would be worthless if retrieved upon transportation.
- For merchants, the impact on the existing environment would be slight (if PCI-compliant). The P2PE tool relies on standards already used at Visa to encrypt PINs (Triple Data Encryption Standard and Derived Unique Key per Transaction).
- Visa is to release specifications as well as an implementation guide in the months to come.
Source: Visa press release
- This tool fits in a global strategy praised by the card network currently pressuring to limit the collection of banking data in payments environments (and forbid their storage in clear); these efforts are added to its commitment to promote and implement EMV in the US.
- In 2009, Visa released a set of Best Practices, with which this solution complies. The network also explains that PCI-SCC requirements listed in its Point-to-Point Encryption Solution Requirements (version 1.1, March 2012) have been taken into account and could reduce the scope (and cost) of PCI-DSS compliance process. PCI-SCC’s P2PE Solution Requirements reminds that a validated solution must at least include: a PCI PTS compliant POS device integrated in a P2PE solution, a P2PE environment where the data is encrypted from the entry point and all related operations must be managed by an approved service provider.
- Visa explains that merchants can opt for the entire solution or for some options, to be added to the products they already subscribed for with their usual processor.