According to the 2020 Mid-Year Data Breach QuickView Report, there was a 52% decline in the number of data breaches in the first six months of 2020 as compared to 2019. However, the number of records exposed climbed to 27 billion – 12 billion more than the records exposed in the entirely of 2019. What this tells us is very simple - strengthening cybersecurity is a necessary ongoing process. Whether your business is already protected or not, the risk of data theft is ever growing, and you need to continuously be assessing your security measures to make sure you are protected against new threats, especially in payments.
Over the years, point-to-point encryption (P2PE) has emerged as a solution that assures top-notch security of payment data. P2PE works to keep this sensitive payment data secure in transit as well as prevent tampering at the point of sale (POS) devices themselves, as it encrypts card data at the point of interaction - when a card is inserted or swiped. From that point, the data is encrypted until it reaches the gateway so no cybercriminal or third party can access the unencrypted data.
In addition to the security benefits to the business, P2PE also reduces the scope, complexity and administration costs of Payment Card Industry Data Security Standard (PCI DSS) compliance for payment solutions. As the gateway is the only holder of the decryption key, and sensitive card data is kept out of the POS environment, the scope is greatly reduced for PCI DSS certification. This saves the merchant a lot of time and money.
There are a few ways businesses have implemented P2PE into their security strategy. Some large grocers with dedicated security resources and a quality security assessor build their strategy from scratch. Internally built solutions such as those might work for larger grocers but are less accessible for smaller grocers with fewer resources. Often, building a custom P2PE solution can create more complexities, require long and costly certifications and prove to be an immense challenge.
In the past, many have opted to pair together different parts of P2PE solutions from different vendors, which requires trusting both the service provider and a third-party entity that validates all these pieces independently. To avoid the headache associated with this, many smaller grocers should look to invest in validated solutions.
Vendors with validated-P2PE solutions can properly implement all parts of the technology into your systems with an assurance of full PCI DSS compliance. What is equally important, is that they can eliminate the need for security experts within your business. These providers can greatly simplify the process of implementation and are trained to correctly implement people, process and technology in five domains:
With all the benefits of P2PE, both in securing payment data and cutting down on the scope of PCI DSS compliance, many grocers are realizing the value of integrating this technology into their security strategy. How they choose to implement all the elements of a P2PE solution is the second step.
In the age of open source solutions, creating your P2PE solution can be tempting. Choosing to do this without an in-house specialist, however, can pose a challenge. With complex implementation and certification costs for payment security, working with an expert will save you time, money and effort in the long run. Investing in a validated solution ensures that most of the heavy lifting is already done for you - and your customers’ data will stay secure.
The PCI SSC maintains an updated authoritative list of validated components and solutions on its website. To learn more visit this page.
If you would like to learn more about a validated- P2PE solution for your grocery business, drop us a line and speak with our security experts!
Steven Bowles is the Regional Security Officer & Director of Security Solutions at Ingenico