PCI-DSS compliance for business with only swipe terminals

Question

I support the IT infrastructure for a small retail business which is now required to undergo a PCI-DSS assessment. The payment service and terminal provider (Streamline) has asked that we use Trustwave to do the PCI-DSS certification.

The problem I face is that if I answer all questions and follow Trustwave's requirements to the letter, we will have to invest significantly in networking equipment to segment LANs and /or do internal vulnerability scanning, while at the same time Streamline assures me that the terminals we have (Verifone VX670-B and MagIC3 X-8) are secure, don't store any credit card information and are PCI-DSS compliant so by implication we don't need to take any action to ensure their network security.

I'm looking for any suggestions as to how we can most easily meet the networking requirements for PCI-DSS.

Some background on our current network setup:

• single wired LAN, also with WiFi turned on (though if this creates any PCI-DSS complexities we can turn it off).
• single Netgear ADSL router. This is the only firewall we have in place, and the firewall is out the box configuration (i.e. no DMZ, SNMP etc). Passwords have been changed though :-)
• a few windows PCs and 2 windows based tills, none of which ever see any credit card information at all.
• two swipe terminals. Until a few months ago (before we were told we had to be PCI-DSS certified) these terminals did auth/capture over the phone. Streamline suggested we moved to their IP Broadband service, which instead uses an SSL encrypted channel over the internet to do auth/capture, so we now use that service.

We don't do any ecommerce or receive payments over the internet. All transactions are either cardholder present, or MOTO with details given over phone and typed direct into terminal. We're based in the UK.

As I currently understand it we have three options in order to get PCI-DSS certification.

1. segment our network so the POS terminals are isolated from all PCs, and set up internal vulnerability scanning on that network.
2. don't segment the network, and have to do more internal scanning and have more onerous management of PCs than I think we need (for example, though the tills are Windows based, they are fully managed so I have no control over software update policies, anti virus etc). All PCs have anti virus (MSE) and windows updates automatically applied, but we don't have any centralised
3. go back to auth/capture over phone lines.

I can't imagine we are the first merchant to be in this situation. I'm looking for any recommendations a simple, cost effective way to be PCI-DSS compliant - either by doing 1 or 2 above with (hopefully) simple and inexpensive equipment/software, or any other ways if there's a better way to do this. Or... should we just go back to the digital stone age and do auth/capture over the phone, which means we don't need to do anything on our network to be PCI-DSS certified?

Answer 1

I am not an auditor, and no one but an auditor can give you valid answers. That said, the PCI Data Security Standard is reasonably direct on these matters:

The cardholder data environment is comprised of people, processes and technology that store, process or transmit cardholder data or sensitive authentication data.

Therefore, storage of card data is not required to put you in scope; transmission is sufficient. Your terminals will be transmitting cardholder data, and so are "in scope" for PCI requirements.

Network segmentation of, or isolating (segmenting), the cardholder data environment from the remainder of an entity’s network is not a PCI DSS requirement. However, it is strongly recommended as a method that may reduce:

• The scope of the PCI DSS assessment
• The cost of the PCI DSS assessment
• The cost and difficulty of implementing and maintaining PCI DSS controls
• The risk to an organization (reduced by consolidating cardholder data into fewer, more controlled locations)

In other words, any system connected to the network with processing terminals on it is "in scope", and will have to be scanned and audited as well. You only have to segment it if you don't want to attest that it's up to PCI security snuff every year! (That being said, it's probably cheaper and easier for you to segment it than to subject everything on your network to PCI requirements).

The PCI DSS Self-Assessment Questionnaire outlines the different types of businesses and what their broad requirements are. Based on your description, you're SAQ "C", outlined on page 11. I've quoted part of it below and highlighted the bullet stating that, yes, they want you to segment your network:

SAQ C merchants validate compliance by completing SAQ C and the associated Attestation of Compliance, confirming that:

• Your company has a payment application system and an Internet connection on the same device and/or same local area network (LAN);
• The payment application system/Internet device is not connected to any other systems within your environment (this can be achieved via network segmentation to isolate payment application system/Internet device from all other systems);
• Your company store is not connected to other store locations, and any LAN is for a single store only;
• Your company retains only paper reports or paper copies of receipts;
• Your company does not store cardholder data in electronic format; and
• Your company’s payment application software vendor uses secure techniques to provide remote support to your payment application system.

The good news is:

1. At the low-volume merchant level, you're pretty much only required to fill out a form and sign it saying that you're compliant, so you don't have the expensive audit to deal with.
2. There are many PCI rules which seem silly. This is not one of them. Network segmentation, or lack thereof, has been repeatedly shown to be a significant factor in card data breaches.
3. If the shop is that small, then this is not expensive to fix. Buy a SOHO firewall with a integrated 4-port switch, make sure it has wireless turned off, connect your two terminals to it and then connect the WAN interface to your LAN. You're done for less than $100.

Answer 2

I'm concerned about your MOTO transactions. When you say they are done on a terminal, you mean the vendor (Verifone VX670-B and MagIC3 X-8) terminals, right? If so, that is good.

Do your systems allow for any mapping of card transaction info onto any consumer data you may keep, for instance a credit card authorization transaction number onto a customer name and email that you keep in your database? If so, you have an exposure that the PCI folks will want to examine. One customer of mine in the past had properly secure systems, but their mailchimp (offsite mass email) account got hacked and all the customers got an email saying their card info had been compromised when in fact all data was still safe and secure. But PCI addresses this anyway because above and beyond anything else, PCI exists to protect the collective Payment Card Industry (PCI) reputation.

I'd put Splunk on your till PCs to consolidate your Win error, system, SQL transaction, firewall, and AV logs, then review that integrated log resource regularly (you attest in your PCI questionnaire that you do this). Reviewing the logs, especially the TSQL and Win system logs (installation of new sfwr, etc) is especially valuable in revealing vulnerabilities, and certifying that no exploitable vulnerabilities exist. If you are not consolidating and examining these logs, you have no reasonable basis to assert otherwise.

Better to do it now and have it done, than to have forensic auditors 'suggest' it to you.

Answer 3

Have you talked to an auditor yet? You likely don't have to do anything except answer a survey. Once you certify that you don't accept anything other than card swipes and you don't store card numbers anywhere, then your audit is complete.

All that other stuff is required when the business keeps credit cards stored somewhere.