The PCI standard goes to great lengths to protect Personal Account Numbers (PANs), the numbers on our credit cards.\u00a0 And if you are breached and PAN data stolen, the credit card companies can fine you.\u00a0 They can also require you to implement better security.\u00a0 This is a problem for both small and large business.<\/p>\n
If you are a small business, the fines and costs of higher security can put you out of business.\u00a0 Just paying for forensic investigators can run into tens of thousands of dollars.\u00a0 Fines and higher levels of compliance can take you to a hundred thousand dollars.\u00a0 Since small businesses typically don’t have great levels of security, this is a real risk for the small guy.\u00a0 How do you deal with that?<\/p>\n
One simple approach is to treat PANs as if they were a toxic substance that you never want in your environment.\u00a0 Don’t store them.\u00a0 If you get breached, your PAN data is a treasure trove for the hackers, and you’ll pay the price in fines.\u00a0 But if you must store them, use tokenization with the real credit card data stored offsite to limit the impact of the breach.<\/p>\n
Use point to point encryption (P2PE) on your POS terminals.\u00a0 With P2PE, unencrypted card data never enters you POS, systems, or network.\u00a0 It is encrypted by the reader, and stays encrypted until it reaches the payment processor.\u00a0 If someone breaches your POS systems, they won’t be able to scrape any PANs.<\/p>\n
Are P2PE card reader solutions more expensive than their non-encrypting cousins?\u00a0 You bet.\u00a0 Consider the extra cost an insurance policy against disastrous fines.<\/p>\n
If you follow these suggestions, does that mean that you can skimp on security?\u00a0 No.\u00a0 You still have to be PCI compliant.\u00a0 Beyond that, you still need to do your best to make your systems secure.\u00a0 But P2PE and tokenization can go along way in securing your PAN data, and limiting your exposure.<\/p>\n","protected":false},"excerpt":{"rendered":"