Payment Methods Newsletter June 2019

New program to train and certify Card Production Security Standards assessors

The PCI SSC has launched a new program that will provide training and ensure the knowledge of professionals who conduct reviews of the standards related to card production (Card Production Security Standards).

The program began at the end of April, but has only been opened to companies that are currently Card Production assessors. It will not open to new applicants until Q1 2020.

More details on the PCI blog

Tokenization in PCI DSS: FAQ and basic design of a solution with AWS (Chapter 1)

The first chapter on how to implement a tokenization solution in an AWS environment has been published on the company's corporate blog.

As a reminder, tokenization is used to limit the scope of a PCI DSS certification, and this first chapter will review the concept of tokenization, delve deeper into the topic, and differentiate between possible approaches that could be taken.

New validation program for payment applications

A new set of standards called "PCI Software Security Standards" is intended to serve as a framework for all software that functions as a payment application. These standards aim to secure applications throughout the software development life cycle and will replace the current PA-DSS (Payment Application Data Security Standard). The PA-DSS standard will expire in 2022, but will allow PA-DSS reports to be submitted until mid-2021.

With the retirement of that standard, the procedure for training new software development assessors will also be reviewed, although the details have not yet been published.

More information at the following links:
https://blog.pcisecuritystandards.org/programs-update-pci-software-security-framework https://blog.pcisecuritystandards.org/pci-software-security-framework-update-on-assessor-qualification

Internet Security Auditors as the first Ibero-American company in the PCI DSS QPA program

The new QPA (Qualified PIN Assessor) program, which allows for compliance auditing and certification of the PCI PIN program, leaves the updating of requirements for providers that manage card PIN services in the hands of the PCI SSC (formerly managed by VISA).

Internet Security Auditors is the first company in Ibero-America that can perform this type of work.

Standard updates for Contactless and SPoC

An addendum has been developed within the SPoC (Software-based PIN Entry on COTS (Commercial off-the-shelf)) standard, which allows for the development of new solutions based on magnetic stripe reading.

Regarding contactless transactions, the RFC (Request for Comments) has been closed, and comments are currently being reviewed to determine what and how will be included in the CPoC (Contactless Payments on COTS) standard.

More information on the PCI blog

At the end of April, there was talk of a possible breach affecting the healthcare sector again (although it was not until early June that it was formalized). In this case, the affected company is LabCorp, based in North Carolina. According to the official report, nearly 7.7 million customers' medical data were affected by the breach, including the financial information of at least 200,000. This breach has been identified as having started in August 2018 and lasting until March 2019.

A more detailed analysis of the incident indicates that the breach occurred through a third party, AMCA (American Medical Collection Agency), which reported a problem on its payment website, through which several organizations make payments for medical services. According to AMCA, the total number of affected patients could reach 12 million across all the organizations it worked with.

AMCA filed for bankruptcy weeks after notifying the incident.

More information at the following link:
https://www.bankinfosecurity.com/amca-bankruptcy-filing-in-wake-breach-reveals-impact-a-12662

Earl Enterprise is the group under which the restaurant chains "Planet Hollywood" and "Buca di Beppo" operate. According to its website, the incident only affects some of its chains and only brick-and-mortar stores, never online. The breach lasted for ten months, according to official dates from Earl Enterprise (from May 23, 2018, to March 18, 2019).

As part of its response, Earl Enterprise informs about the rights in the different affected states regarding identity theft or card data and provides some tips on how to protect yourself.

Although there is no number of affected individuals in the official report, several media outlets indicate that there are nearly 2 million affected card records.

More information on the Earl Enterprise website

Several media outlets have reported that the manufacturer and seller of gardening products AeroGrow has been the victim of a breach, although as of today, the number of affected individuals is unknown. According to reports, the company informed its customers through a statement about the possible breach, indicating the period of activity (from late October to early March) of the breach and that it was making a monitoring service available to customers.

The breach occurred on its website and appears to be a remnant of the Magecart group, which infected several businesses at the end of last year and the beginning of this year.

More information at this link.

This Canadian telecommunications company has been affected by a security breach. The investigators who reported the incident indicated that it could affect up to 1.5 million customers, although the company's reports indicate that only 15,000 customers are affected.

As has been indicated, in addition to customers' personal data, card data, including CVV and credit scoring linked to said customers, would also be included in the breach.

More information about the incident at:
https://www.cbc.ca/news/business/freedom-mobile-data-breach-1.5126952

Facebook prepares its new cryptocurrency… and Visa joins in

Facebook announced a few weeks ago its new project related to the launch of a new blockchain-based cryptocurrency (Libra), with the aim of using WhatsApp and Facebook to conduct transactions.

Libra is designed as a "stablecoin", with an actual dollar reserve as backing, so that it would be treated like any real currency.

For its part, Visa announced its intention to join the "Libra Association", which will manage the currency (a group that also includes companies such as PayPal and Mastercard).

Visa launches B2B to streamline international transfers

In order to streamline international transfers between companies, Visa has launched its Visa B2B Connect solution, a non-card-based payment network that enables cross-border banking transactions. This program will allow banking companies to participate in it, allowing their customers to make payments in a much more agile way.

This message has been sent pursuant to your authorization for the communication of commercial information from Internet Security Auditors. You can consult our Data Privacy Policy here. You have the possibility to exercise the rights of access, rectification, erasure, restriction, objection and portability provided for in the "Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC" by letter addressed to Internet Security Auditors, Calle Santander, 101. Edificio A-2 08030. Barcelona (Spain), or by email to the following address: legal@isecauditors.com. If you only wish to unsubscribe from these communications, click the following link and send that email from the email address at which you received our communication: marketing@isecauditors.com

This email is sent pursuant to your previous authorization for the transmission of commercial information from Internet Security Auditors. You can read our Data Privacy Policy here. You have the possibility at all times to exercise the rights of access, rectification, erasure, restriction of processing, objection and portability according to the "Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC" by sending a letter addressed to Internet Security Auditors, Calle Santander, 101. Edificio A-2. 08030 Barcelona (Spain), or through the following email: legal@isecauditors.com. If you only wish to request your cancellation of these communications, click on the following link and send that email from the email address at which you received our communication: marketing@isecauditors.com