We finished the last module asking how we can stop criminals
profiting from stolen payment card data.
Well, the answer is standards,
and there are actually two different sets of
standards with different objectives, the PCI standards,
which are the focus of this course and are designed to secure payment card
data to make it harder for criminals to steal the data,
and the EMV code standards,
which are designed to make sure that even if criminals
manage to obtain payment card data,
they still can't make a fraudulent transaction.
For example,
EMV chip means that stealing data from face‑to‑face merchant
environments doesn't allow a criminal to make a fake card.
The 3‑D Secure or 3‑DS standard authenticates the cardholder
so that even if a criminal has card data,
they can't pass the authentication challenge.
And EMV tokenization means that if a criminal gets hold of a
token from a transaction or from a device,
it isn't possible to use this card number,
this token number, generally, for other transactions.
Initially, each of the main card schemes,
that's American Express, Discover, JCB, Mastercard,
and Visa had their own security standards for protecting data and for
protecting PINs and for protecting the production of cards.
The standards told banks how to make sure that their
suppliers and merchants took care of what the card schemes
considered to be at the time their data,
to make sure that criminals couldn't take advantage of the card payment system.
Now,
having five different sets of security standards that actually sometimes used to
contradict each other was very confusing for the industry.
And so in 2006 the Payment Card Industry Security
Standards Council, or PCI SSC, was formed.
It was formed by the five card brands, American Express, Visa,
Mastercard, Discover, and JCB.
And they took the best bits out of each scheme's
individual standards to make the PCI standards.
I should also mention here that although it didn't contribute
to the original standards back in 2006, in 2021 UnionPay also
became a member of the PCI SSC.
So let's have a quick recap.
Before we take a look at the PCI standards,
let's just quickly review what we've discovered so far,
that criminals use card data to make money,
either by taking money out of an ATM or by buying
things that they can resell for money.
They most like to steal physical cards and PINs.
Failing that,
they want to steal the data that allows them to make a fraudulent transaction,
and that's the data that's used when a transaction is authorized.
The payment card schemes produce standards that tell
people in the payment ecosystem, the acquiring banks,
the issuing banks,
and how the bank themselves and their suppliers and their merchants,
and the merchant suppliers must protect cardholder data.
The card schemes have their own standards,
but in 2006 they agreed to create one entire set for the
industry called the PCI standards, the Payment Card Industry standards.
There are now about 15 payment card industry standards, divided into two types.
The first is those that are designed to make sure that products or solutions
that people in the payment system buy that they are secure.
And then the second type are those that are designed for organizations involved
in payments to demonstrate that the organization is secure.
Depending on what you do, you might only come across one of those standards.
I'm going to quickly go over all of them so you can see how they fit together
to protect all forms of cardholder data from criminals,
and then we're going to look at each one in a bit more detail.
So firstly, there's the Data Security Standard,
or DSS, or PCI DSS, that protects cardholder data in organizations.
Next, there are standards for software security,
the Secure Software Standard and the Secure Software Lifecycle Standard.
And there's also an old standard for software security that's being phased out,
but you might see reference to it,
and that's the Payment Application Data Security Standard or PA‑DSS.
Thirdly,
there's a family of security standards that are designed to protect PINs.
Two PIN transaction standards, PTS, which,
as the name suggests, protects PINs, and is focused on devices,
both the readers where you insert cards and enter PINs,
or POIs, Points of Interactions, PCI calls them,
and to protect secret keys in hardware security modules which are used by
the banks for the encryption and decryption of PINs.
There's also the PIN security standard, which is simply known as PIN,
and that's focused on the way that the encryption and
decryption of PINs is managed by organizations.
Next are some standards for whole payment solutions that cover
devices and how cardholder data is encrypted,
transmitted, and decrypted on different devices.
There's the Point‑to‑Point Encryption standard,
or P2PE, which deals with using traditional POIs.
Then there's the software‑based PIN Entry on commercial‑off‑the‑shelf devices.
Now that's a name for a standard, isn't it?
And that allows a merchant to use a smartphone and a
secure card reader to accept transactions.
And then there's also the Contactless Payments on
commercial‑off‑the‑shelf devices, abbreviated to CPoC,
which describes how a merchant can use a device like a smartphone and turn
it into something that accepts contactless transactions.
There are also standards for systems that are Token Service
Providers, who generate and manage EMV code tokens,
and also two standards for systems that provide 3‑D
Secure functionality for issuers.
The first, 3DS Core, is for the servers that are
used in the 3‑DS authentication.
Then there's also standards for software development kits, or
SDKs, that merchants or people who write apps for merchants can
incorporate into apps. And finally,
there's a standard that's got no abbreviation or acronym, but a standard
that secures the production and personalization of payment cards, the
Card Production and Provisioning standard,
which has two sets of standards in it,
one for logical security and one for physical security.
Before we get into the details of all the PCI standards,
I want to pause here for a second to say sorry, because we're about to
enter an alphabet sea of the payment card industry,
which is full of 3‑ and 4‑letter acronyms.
And I know from experience this can be really confusing to begin with,
especially when so many of the acronyms are really similar and seem to
have been chosen from a very limited set of letters,
particularly p, q, a, s, c, and i.
But look, after a while, I promise this will become second nature to you.