PCI Compliance - Encrypted Mobile Apps

Question

My company (health care) went through a PCI audit and needs to solve some major issues. Our branches collect CHD on paper and saves them to a network drive as a pdf that our corp office accesses to enter into Paymentech and charge them ongoing everchanging weekly charges. Obviously, that was flagged, mainly for unencrypted transmission via scan to mail email to the desktop where the pdf was then saved on the drive. The two options discussed were either continue with paper and to encrypt directly from the branch's copy scanner and save to a secure server directly or to use a mobile ipad app that encrypts the CHD that is properly keyed (not swiped) into the app and send it to our secure servers. I haven't found any copy scanner with encryption option nor have I found an app that sends encrypted data and removes it from the ipad immediately.

Any ideas on on how to secure this CHD via option 1 or 2 or your own? Thanks

***To CntrlDot - You are right, another big problem is the need to retain the CHD that is collected in the field before the charges are created. Plus the credit card is sometimes not present and CHD is given over the phone to the sales rep. So the swipe option won't cover what we do. I just found out we are locked into Xerox scanners, which I cannot find any immediate encryption option. Still looking at using the ipad option which removes the paper from floating around, but can't find an app the encrypts, sends and then removes. Thanks for any answers.

Answer 1

My advice to you is, rip off the band-aid and go modern.

It's hard to judge without knowing more about your situation (who's collecting the CHD? What environment? In an office? On the phone? On the street?). But the easiest way to make it all go away is to go for mobile-device based swipies that will encrypt before the info hits your device and send it on in. If you never have unencrypted card data, you don't have to worry as much, and you have less PCI scope.

I'm aware of Roam and Square that do this off the top of my head, and there are other companies out there doing the same. Enabling the mobile device is the new black.

Could you add compensating controls to ease your existing solution? Sure. Google quickly shows me that Ricoh has a device whose scanner can

Protect sensitive or confidential scanned documents with security features, including encrypted PDF transmission.

Some doco for that here.

But it sounds like you've got some jury-rigged methods in place, and that's what's drawn the auditors (well, that and the lack of encryption). If you jury rig controls on top of a jury rigged solution you're not doing yourself any favors.

Answer 2

The ideal solution always avoids storing card data in electronic form. I know that many payment processors have functionality now that lets you store cards with them in customer profiles. Then when you need to charge the card you can just pull up the customer and enter in the amount through the management interface the processor provides. I'm not super familiar with Paymentech but a quick Google search for this type of service pulled this up for me:

Chase Paymentech Orbital Payment Gateway

Check out the section about Customer Profile Management. Sounds like they offer what I am talking about.

I think the best and most secure solution for you is to come up with a process that lets the agents taking the payment info on the phone, create the profile with the card number and then the billing side could access that profile to charge the card each week. This eliminates the transmission of PDFs as well as the electronic storage of card data.