Information Security Blog

New PII And PCI Concerns For Retail Stores

0 Flares

wireless-pii-pci When it comes to accepting payments, retail stores, companies are faced with Payment Card Industry (PCI) and Personally Identifiable Information (PII) concerns. CNET recently published an article on Google’s newest product, Wallet. The product allows consumers to use their Android device to send contact-less payments to retailers via Near Field Communication (NFC) technology. In the article, Elinor Mills illustrates potential security concerns regarding Wallet using data provided by ViaForensics.

After analysis of on the unencrypted data stored in a rooted device — Wallet passed for securely storing passwords, however, there were concerns as the following data was recoverable after transactions were deleted and the Wallet application data was cleared and reset:

Name on the card
Expiration date
Last four card digits
E-mail account

So should retailers be concerned about the security of mobile payments? Mobile payment services are becoming increasingly popular with PayPal, Wallet, Square Up, Intuit GoPayment, MasterCard Mobile Payment and others jumping on the bandwagon.

It’s likely a safe assumption that if Wallet has application vulnerabilities in their platform, that other competitors do as well.

Do retail stores need to worry that a malicious cyber security expert could sniff mobile payment traffic in a retail store? Is a man-in-the-middle attack possible? Even if credit cards and passwords are secured – is personally identifiable information for customers secured? Could a competitor bleed sales data?

History is on my side when I predict that – there will be business impacting breaches before these issues are fully resolved.

20
DEC

Download: Information Security Attestation Guide

A Best-Practices Guide to Information Security Attestation

Download our proven Information Security Guide to simplify the process of protecting your data, proving you’re secure and growing your business.

Free Whitepaper: Stop Wasting Money on Penetration Testing

Penetration Testing is most frequently performed to:

Substantiate the net effectiveness of a mature control environment
Prove to a third party that an environment is secure/trustworthy
Quickly assess the security of a less mature control environment (in a sense a technical risk assessment)
To validate that significant changes did not have unanticipated results

Free Download: ISO 27001 Implementation Roadmap

Have no fear – our “roadmap” will guide you, step by step, through the entire ISO 27001 process.

Getting to ISO 27001 certification is a process made up of things you already know – and things you may already be doing!

Best Practices for Firing A Network Security Administrator

Want to know how to fire a Network Admin? Need to know what precautions to take? Firing any employee can be a stressful event. Firing one who has significant knowledge of and privileged access to your Information Technology/Security infrastructure is even more stressful, as the risks are so notable.

Free Download: A Best Practices Guide to Database Security

Because data is only as secure as the systems & processes it relies on – a holistic approach to data security is essential. This roadmap is not meant to be exhaustive but rather to stimulate the necessary thought process to put you on the path to good data security.