[Autogenerated] finally I'd like to end this course by thinking
about who will have to comply with Pc IDs S version for I'm afraid
I don't have an answer to that question because although the
pieces c developed the standard,
it is the card brands that require compliance with the standard.
And over the course of the last few years I've observed that
the card brands appetite for protecting pan,
which is what decides this is all about,
appears to be decreasing firstly with the move to eight
digit bank identification numbers or Bins.
The new truncation rules mean that Pc IDs only protects three digits out
of 16 digits in the card number and that indicates to me that the brands
are much more comfortable preventing fraud where an attacker has just got
the card number and expiration date.
Let me show you what I mean by this.
Here's the 16 digit primary account number.
The bank identification number.
The bin is the first eight digits.
This pan would need to be protected by all of the pc IDs requirements.
And yes,
I know that you did not actually find a pan that starts with the digits 1234.
It's just an example,
this is a truncated pan Has been truncated to the bin and the last four
digits following the brand requirements which are detailed in 1091
truncated pounds do not need to be protected by Pc IDs S This is
explained in 11 17 So all Pc IDs is protecting is those four digits that
have been removed from the pan.
And actually because of how the lunch check some works with a pan.
It's only protecting three digits Because if you have 15 digits of a pound you
can calculate the 16th logically you have to assume that the brands are happy
that they have enough other protection in place to detect criminals taking
stolen truncated pans which according to the required no Pc IDs s protection
and they're taking those stolen truncated pans And making a brute force attack
against the remaining three digits Secondly chip and pin or m for face to face
transactions has been deployed throughout much of the world now where 75% of
payment transactions are taken through EMV or chip and pin capable terminals.
Three of the major card brands no longer require the merchant
to validate their compliance with PCI DSS.
And this is despite the fact that the primary account number the pan
is president in any transaction data stolen E.
M.
V transaction data cannot be reused to make a transaction because
one of the principles of the way that the MV works is as a secure
cryptogram generated a secure and unique cryptogram generated
with every transaction.
And so the implication is that the card brands are not concerned
that the pan present in an MV transaction data.
They're not concerned that that pan can be taken from the stolen data
Within the European Union version two of the three D.
Secure Protocol has been mandated by law.
This protocol requires again a unique cryptogram to be generated for every
transaction and also for the customer to approve each transaction with some
form of dynamic secondary security authentication,
like using the issues app on their smartphone.
This has cut the fraud related to stolen cardholder data from an e
commerce environment because it means that you can't make a
transaction with stolen card data from an e commerce transaction and
if you can't make a transaction with it,
there's no need to protect that data over and above the way that any
organization would protect personal data or P.
Ii.
The number of transactions originating from devices such as smartphones,
watches and wearables is increasing these all used tokens instead of the
real pan and so stolen data from transactions initiated with this type
of device can't be reused to commit fraud.
Finally,
my observation is that the brands are increasingly reluctant to enforce peace,
IDs compliance on merchants.
They are fed up of being the enemy.
I predict that the compliance landscape is going to change in the next few
years and that this may happen before the use of Pc IDs s version four becomes
mandatory compliance with PCI DSS won't go away,
but I think the brand's compliance programs will change in terms of
what this means you should do in your preparation for a transition to
Pc IDE ss version for I'd encourage you to think of it as a business
risk and a technical issue.
So talk with your executive management and if you're a merchant,
you're acquiring bank based on the impact analysis you've done,
you'll know when you need to start projects to meet the new requirements,
so you can factor this into your plans.
All of the new future dated requirements are good security,
but it's better to have your security program based on your threat
environment rather than being driven by compliance mandates.
When the card brands change their compliance programs,
they will usually update the information on their website.
Each card brand has a security for merchants section of their website.
So it's valuable to check bees because the PCs sc isn't able to provide
information about changes to each brand's compliance programs.
I hope this course has been useful but it is only the introduction
to the changes in pc IDs I've heard what I think are the major ones
that will affect every organization.
But there could be other small things in there that
would affect your organization.
So please, can I encourage you to download the summary of changes,
document and the standard itself from the document library on the pc
SSC website I wouldn't say it's a delight to read,
but the working group tried really hard to make the standard
a lot more accessible in this version.
When it comes to making compliance decisions,
there is no substitute for knowing what the standard actually says