CyberCQR Case study · Compliance
Shrinking the PCI zone: card payment compliance by isolation
How organisations that take card payments in person and over the phone reached PCI DSS compliance by isolating the payment equipment, keeping card data out of everyday systems, and making sure call recordings never hold card details.
About this case study. It draws on several engagements in which Neil Brady took organisations through Payment Card Industry Data Security Standard (PCI DSS) compliance. The organisations are not named, and the approach is described as a pattern rather than as one project.
Summary
The point for boards. PCI DSS applies to every system that stores, processes or transmits card data, and to everything connected to those systems. Getting it wrong can mean card brand penalties, breach costs and a UK GDPR fine of up to £17.5 million or 4% of turnover. If card terminals sit on the same network as everything else, the whole network is in scope. The cheapest way to comply is usually to make the area that handles card data as small as possible, then protect that small area well.
The value
| Value | What it meant here |
|---|---|
| Risk reduced | A smaller card-handling area means fewer places for card data to leak, and less exposure to card brand penalties, breach costs and a UK GDPR fine of up to £17.5 million or 4% of turnover. |
| Cost | Compliance work, assessments and the yearly effort to stay compliant cover a small isolated zone, not the whole business. Where the conditions are met, a shorter self-assessment questionnaire can apply. |
| Simpler to run | One isolated zone with one route out, and one clear rule for staff: card details are never written down or stored outside it. |
Table 1. The value of the work, in risk, cost and simplicity.
The starting point
The organisations took card payments in two ways: on chip-and-PIN terminals, and over the phone. In each case three things had pulled far more of the business into PCI DSS scope than the payments themselves needed:
- Terminals on the main network. Card terminals and their network equipment shared the network used by everyone else, so every laptop, server and printer on that network was in scope too.
- Card data in everyday systems. Staff could note card details in email, documents, notes fields or customer records, which put those systems in scope as well.
- Card details in call recordings. Where calls were recorded for quality or compliance, card numbers and security codes read out by customers could end up stored in the recordings. PCI DSS does not allow card security codes to be kept after a payment is authorised [1].
Why getting it wrong costs so much
PCI DSS is not a law. It is a contractual requirement, enforced by the card brands and the acquiring banks that process a merchant's payments, and any penalties for non-compliance are set by the individual card brands [5]. After a breach, the costs can also include a forensic investigation, fraud losses and the cost of replacing customers' cards.
The larger risk is that card details are personal data. A PCI DSS failure that exposes them is usually a UK GDPR failure too, and the Information Commissioner's Office (ICO) can fine up to £17.5 million or 4% of global annual turnover, whichever is higher.
| Case | What happened | ICO fine |
|---|---|---|
| British Airways, October 2020 | Attackers took card details from about 429,000 people, including card security codes for most of them. The ICO's penalty notice pointed to PCI DSS when judging what appropriate security looked like: card security codes had been logged in plain text, file integrity monitoring was missing, and a supplier's account had no multi-factor authentication [6]. | £20 million |
| Ticketmaster UK, November 2020 | Malicious code in a supplier's chatbot on the payment page captured card details. About 60,000 Barclays customers' cards were compromised, and Monzo replaced 6,000 cards over suspected fraud [7]. | £1.25 million |
Table 2. Two UK cases where weak protection of card data led to fines under data protection law.
A PCI failure is rarely only a PCI problem. The same weakness can bring card brand penalties through the bank, the costs of the breach itself, and a regulatory fine sized against the whole business. Keeping card data in a small, well-protected zone reduces all three.
What changed
| Area | Before | After | Why it mattered |
|---|---|---|---|
| Payment equipment | Chip-and-PIN terminals and their network equipment on the main network | Terminals and network equipment isolated in their own zone, with a separate path to the internet and on to the payment provider | The rest of the network no longer touches card data, so it drops out of scope [2]. |
| Staff handling of card data | No clear rule on where card details could be written or kept | All staff trained not to record card data anywhere outside the PCI zone | Email, documents and customer systems stay out of scope, and stay that way. |
| Telephone payments | Call recordings could capture card numbers and security codes | Recording paused while card details are given, or the call handed to the payment provider's secure payment line, which does not record the customer speaking or keying in their card details | Recordings and the systems that store them stay out of scope [3]. |
Table 3. The three moves.
Make the area that touches card data small, then protect it properly.
Why isolation works
PCI DSS does not require segmentation, but the PCI Security Standards Council recommends it as a way to reduce scope [2]. When the payment terminals sit in their own isolated zone and talk only to the payment provider, the questions an assessor asks apply to that zone, not to the whole business.
For merchants whose only card systems are approved standalone terminals connected over the internet, isolation can also open the way to a shorter self-assessment questionnaire, SAQ B-IP. Its conditions include that the terminals are on a network segmented from all other systems and that no card data is stored electronically [4].
Segmentation has to be proved, not assumed. If it is used to reduce scope, penetration testing must confirm that it works (PCI DSS requirement 11.4.5) [4].
The outcome
Each organisation reached PCI DSS compliance with the card-handling area reduced to the payment equipment and the payment process itself. The main network, everyday business systems and call recordings were kept out of scope, which kept the compliance work, and the cost of keeping it up each year, in proportion to the business.
If we did it today
- PCI DSS v4.0.1. The current version of the standard puts more weight on ongoing security, such as targeted risk analysis and stronger authentication. A smaller scope makes those requirements easier to meet.
- Point-to-point encryption. Terminals in a listed point-to-point encryption (P2PE) solution encrypt card data inside the device, which can reduce scope further.
- Telephone payments that agents never hear. Pausing the recording relies on someone remembering to press pause. Handing the call to the payment provider, or keypad masking where the customer types their card number and the tones are hidden from the agent and the recording, keeps card data out of the call without relying on that [3].
Lessons for a firm of 500 to 2,000 people
- Draw the map first. List every place card data is taken, sent or kept, including phones, email and spreadsheets.
- Isolate before you secure. Moving terminals into their own zone is usually cheaper than bringing the whole network up to PCI DSS.
- Train for where card data must not go, not only for how to take a payment.
- Check the call recordings. They are the most common place card data turns up unexpectedly.
- Test the isolation every year, and after any network change.
- Treat PCI DSS and UK GDPR as one risk. The regulator will look at how card data was protected, not at which standard it fell under.
Glossary
| Term | Meaning |
|---|---|
| Cardholder data environment (CDE) | The people, processes and systems that store, process or transmit card data, and anything connected to them. |
| PCI DSS | The Payment Card Industry Data Security Standard, set by the PCI Security Standards Council and required by the card brands for anyone who accepts card payments. |
| PCI zone | The isolated part of the network, and the processes, that handle card data. Everything outside it is out of scope. |
| Point-to-point encryption (P2PE) | Encryption of card data inside the payment terminal, so it cannot be read until it reaches the payment provider. |
| Scope | The systems and processes PCI DSS applies to, and which an assessment must cover. |
| Segmentation | Separating the card-handling systems from the rest of the network so they cannot communicate except where allowed. |
| Self-assessment questionnaire (SAQ) | The form a merchant completes to confirm PCI DSS compliance. Different SAQs apply to different ways of taking payments. |
Table 4. Terms used on this page (alphabetical). Who the standards body is: see the PCI Security Standards Council on our references page.
Further reading
From CyberCQR
- Secure mobilisation at scale. Our case study on moving tens of thousands of users to cloud identity and Zero Trust access.
- Foundation: Cyber Essentials and compliance. How we keep baseline controls and certifications current.
References
- [1]PCI Security Standards Council, Information Supplement: Protecting Telephone-Based Payment Card Data.
https://listings.pcisecuritystandards.org/documents/protecting_telephone-based_payment_card_data.pdf - [2]PCI Security Standards Council, Guidance for PCI DSS Scoping and Network Segmentation, version 1.1, May 2017.
https://listings.pcisecuritystandards.org/documents/Guidance-PCI-DSS-Scoping-and-Segmentation_v1_1.pdf - [3]PCI Security Standards Council, Industry guidance on accepting telephone payments securely, 27 November 2018.
https://blog.pcisecuritystandards.org/industry-guidance-on-accepting-telephone-payments-securely - [4]SecurityMetrics, Performing an SAQ B-IP version 4.0 self-assessment.
https://www.securitymetrics.com/blog/performing-an-saq-b-ip-version-40-self-assessment - [5]PCI Security Standards Council, At a glance: the role of the PCI Security Standards Council.
https://listings.pcisecuritystandards.org/documents/At_a_Glance_Role_of_the_PCI_SSC.pdf - [6]Information Commissioner's Office, Penalty notice: British Airways, 16 October 2020.
https://ico.org.uk/media2/migrated/2618421/ba-penalty-20201016.pdf - [7]Hunton Andrews Kurth, ICO fines Ticketmaster £1.25 million for security failures, November 2020.
https://www.hunton.com/privacy-and-cybersecurity-law-blog/ico-fines-ticketmaster-1-25-million-for-security-failures
Security is the outcome, not a solution.
CyberCQR is a UK cyber security advisory practice. We help organisations keep compliance in proportion to the business, without vendor commissions or product resale.