[Autogenerated] in this final module, we're going to look at Requirement 9.9,
which is concerned with the security of physical
devices that read payment cards.
If you don't have any of these in your environment,
perhaps you just process e commerce or motor transactions,
then really feel free to skip over this module.
Requirement.
9.9 has controls that aim to protect against the tampering,
skimming or substitution of payment terminals.
This is a real problem because criminals spend lots of time
trying to design overlays or skimmers,
or even re engineering the terminals so they can read both the
data on the card and the pin at the same time,
which means that in circumstances were then able to make fake cards.
With this data, you can see pictures of this type attack.
If you do an image search for card skimmer, a search engine or you go to visit.
Brian Krebs is Krebs on Security website,
which has got lots of pictures off physical card skimmers and overlays.
The requirement is to protect card data reading devices from
substitution on from tampering on the details of what's needed.
A basically, in all the sub requirements, 9.9 point one through 9.9 point three.
However, at the head at 9.9.
The testing procedures say the QoS A needs to check the details of the sub
requirements are supported by the policies and procedures.
It also makes it clear that it's only devices that
physically interact with card, which error in scope.
So this excludes the contact was only readers.
And, as I said,
the testing procedure here is just to check that the policies and procedures
support the sub requirements on the first of those sub requirements is to make
sure that you've gone inventory of devices on.
This isn't just a list that says, For example,
retail Store X has got 15 devices and one in a cupboard.
The inventory needs to be quite detailed.
It needs to list the make and model of the device,
the physical location and also the serial number of the device.
As the guidance state,
this inventory could be automatically generated on this is typically
by a terminal or upon its sale management system.
The QoS is actually got quite a bit of work to do to test this requirement.
They'll check the list devices then randomly picks
them that are on the infantry.
Then physically go and check to make sure the devices there
and matches where the lists as it should be.
And although the procedure doesn't say so, they'll probably do this in reverse.
So if they're in a retail store,
they'll check all the devices that could physically see in this store,
right serial numbers down on,
then check that that actually matches the inventory.
The QoS A will also talk with people to see how the inventory of devices kept
up to date when you devices the shipped out or when devices error replaced or
move between stores or whether decommissioned the next of requirement is a
physical inspection of each device on a regular basis to check for signs of
tampering or substitution on here.
The demand of the standard is that devices should be physically checked,
looking for a few things firstly, looking for overlays and skimmers.
So anything is going to be stuck on the device that can
also read the card or read the pin.
Secondly,
tampering of the device are all the stickers and seals and screws in place,
and then finally,
substitution Is this the right device or has it been swapped out?
Many merchants have actually deployed some pretty innovative systems say,
using a barcode on the on the on the reader that the
attach point of sale system reads.
Some even wait devices in the morning because an increase in weight is
actually really good indication of device substitution or the presence
of a skimmer or an overlay in most retailers is generally a how to check
a device manual for retail stuff to follow on a log to record when each
device was checked.
You'll notice that the standard uses the word periodically when
it talks about the frequency of device checks,
which often leaves retailers to ask the question of,
well, how frequently is periodically.
This is one of those rare occasions when the merchant could take a
risk based view based on the physical environment.
Is the device tethered?
Are they high security environment of the cameras everywhere?
So, look, the merchant is take a risk based view.
Mine is the longest device should be in use without being
checked is probably something like seven days.
The USA is going to check the procedures used by people to
check devices are there gonna look for that?
How to take a device manual?
And I want to see the documentation that justifies how periodic
you decided periodic words for your inspections.
The assessors going to interview store staff responsible for carrying
out the inspections to make sure they know how to inspect the device
and how regularly the check should be done.
Standard doesn't actually say so,
but most QoS error going to look to see if there are
records of device inspections, because if there are,
that could help speed up an assessment because the QoS
they'll probably have to do less interviews.
The final device security requirement wants to help everyone in the
company that works in the store or in head office to recognize the
potential attack against the device,
which means that the people need to be trained to spot the most common
attacks and implement easy processes to stop these attacks.
There are four specific attacks mentioned in the standard,
and believe me, in my time,
I've seen all four of these attacks attempted by criminals,
So the first thing that people need to be trained to look for his
bogus repair or maintenance people who come into the store or come
into head office to swap a device out.
So there needs to be a process in place so that any device swap out or
repairs could be independently verified with head office.
That should also extend to any new devices that error received in
the post by a courier that appeared to come from head office with
instructions to swap the device out again.
This is a known criminal attack.
It actually happened.
Eso the swap out needs to be verified by phone.
Someone in the store needs to call up someone in head office
where they've got a number to do this.
They don't read the number off the piece of paper that came with device because
that will be the criminals and ring up head office and say,
I've got a new device.
Is that correct?
I'm supposed to this swap out.
The training also needs to cover people behaving suspiciously around
devices on There is some great CCTV videos from retail stores showing
how quickly criminals have actually installed the skin want to device
and you can use these in your training.
They're very powerful.
Finally,
there needs to be a process in place that installed personnel
can follow if they want to check or report suspicious behavior
in relation to payment devices.
The U.
S A.
Is going to check the training materials to make sure
they cover all the points mentioned.
The requirement and QoS error will want to interview a sample of install
personnel to make sure they've had and understand the training.
Now there's actually no requirement in DSS for the
QoS A to check training records,
but they'll often do this to make sure that all staff have been trained.