PCI-Compliance for small business

[Brother D]

Friends small business I occasionally help has had a note saying they must be PCI-compliant...

Currently they have two hand-held terminals connected to their own dedicated DMZ firewall that is soley for the card machines, this DMZ FW sits behind the main public-facing router/firewall with both firewalls blocking any incoming connections.

They are using SMB/consumer grade firewalls for both DMZ and external.

Reading through what is being asked it looks like quite a task to be fully compliant even althought there is no data stored on site or Customer not present transactions.

Would I be correct in thinking they could 'get around' this buy just having the terminals connected only via the phone line? Or what have people's experience been in getting a small shop compliant

[bitchstewie]

I don't know PCI but I thought that given there are literally TV adverts targeting mobile hairdressers or whatever with devices like this:

https://sumup.co.uk/business-guide/sumup-the-most-...

https://www.zettle.com/gb/payments/security

That PCI for small shops had got a lot easier with the appliance maker taking on a lot of responsibility?

[Chimune]

I agree with your thinking. Why involve the shops own it infra at all?
Connect to phone line and everything technical Inc support stays with processor Co.

Just need to train the end users to not read all the card numbers out when taking phone payments ffs!

[akirk]

PCI compliance is usually handled by the card processor who stores the details - so unusual for a small business to have any need to think about it

They should talk to their provider - whoever they use for taking card details

[Alex Z]

There is no legal requirement to be PCI compliant, and the large retailer I worked at wasn’t meeting the requirements of the standard. What is important is to meet the requirements that your bank asks for.

For most businesses, as long as there is end to end encryption of all data that goes between the PED and processing institution, that’s sufficient.

What exactly have they been asked to do, and by who?

[Griffith4ever]

Brother D said:

Friends small business I occasionally help has had a note saying they must be PCI-compliant...

Currently they have two hand-held terminals connected to their own dedicated DMZ firewall that is soley for the card machines, this DMZ FW sits behind the main public-facing router/firewall with both firewalls blocking any incoming connections.

They are using SMB/consumer grade firewalls for both DMZ and external.

Reading through what is being asked it looks like quite a task to be fully compliant even althought there is no data stored on site or Customer not present transactions.

Would I be correct in thinking they could 'get around' this buy just having the terminals connected only via the phone line? Or what have people's experience been in getting a small shop compliant

I take cards online (and on a web virtual card terminal if needed). Sagepay (now Opayo), with Elavon as the mechant bank behind it.

Once a year I have to go through PCI compliance. I get an email from Elavon which takes me to a website that I have to click a gazillion boxes with yes or no etc.

The first time I did it, I clicked yes to most things, then no, with reasons entered, or maybe's etc, where relevant. At the end it told me I had "x" outstanding issues. ALL of the issues are where I didn't tick "yes" and in all events, it told me the error was that I'd not ticked "yes". I went back and changed them to yes and all was good.

Now, every year, and it's been around 7 now, PCI compliance takes me around 5 minutes of clicking yes , yes, yes, yes ,yes, yes to absolutely everything. The level of detail they ask is absurd, particularly bearing in mind I don't keep customer card data, and it's all processed on Saygepay webforms, so nothing local. They ask things like having standardised firewall procedures. yada yada yada.

Just agree with it all and it goes away for another year :-)

[Griffith4ever]

Alex Z said:

There is no legal requirement to be PCI compliant, and the large retailer I worked at wasn’t meeting the requirements of the standard. What is important is to meet the requirements that your bank asks for.

For most businesses, as long as there is end to end encryption of all data that goes between the PED and processing institution, that’s sufficient.

What exactly have they been asked to do, and by who?

It's not about the law. If you don't complete the PCI DSS certification they (Elavon) fine you around £35 a month.

[Brother D]

Griffith4ever said:

Alex Z said:

There is no legal requirement to be PCI compliant, and the large retailer I worked at wasn’t meeting the requirements of the standard. What is important is to meet the requirements that your bank asks for.

For most businesses, as long as there is end to end encryption of all data that goes between the PED and processing institution, that’s sufficient.

What exactly have they been asked to do, and by who?

It's not about the law. If you don't complete the PCI DSS certification they (Elavon) fine you around £35 a month.

Elavon are the ones asking. I've started the process for them and just waiting for the pet-test results to come back in. Also can I ask what FW your businesses are using? In other large offices we have Fortigates, but seems a bit of overkill for a small biz if it's blocking all inbound traffic on both external and the DMZ router.

Edited by Brother D on Friday 22 April 19:06

[Durzel]

Griffith4ever said:

Just agree with it all and it goes away for another year :-)

Until you get audited and are asked to produce the logs you say you're keeping, and the staff training material you say you're providing, etc.

Although having said that I've never been actually asked for this, but like GDPR stuff there is always a possibility.

With a regular card machine (PDQ) and presumably taking card details over the phone, etc you are responsible for the security of the card information as it is being received. You should not be storing it at all, anywhere, unless you want to have to deal with a much higher PCI DSS level. In my experience the biggest problem is drumming it into staff not to write down people's card info on bits of paper, "to process later because the website was being slow", or whatever.

Zettle, SumUp, etc handle the PCI compliance for you if you use one of their devices. That is generally not the case with a "dumb" PDQ, the internet or phone connection is uses needs to be hardened, staff that have access to use it and who take payments have minimal privileges etc.

In reality in a small business I suspect none of this ever actually happens, and PCI compliance becomes a box ticking exercise as Griffith4ever said.

[dapprman]

akirk said:

PCI compliance is usually handled by the card processor who stores the details - so unusual for a small business to have any need to think about it

They should talk to their provider - whoever they use for taking card details

This. ^

PCI is all about card data and its protection. If the store has no access to that data then they have no need for PCI DSS compliance. Net result, if using a 3rd party card reader, such as World Pay, Square, etc then they are fine. As soon as any record of the card number touches them then they will need compliance and a lot of cash to provide it. We are not talking simply putting a firewall in place, but isolation of servers, tokenisation, etc.

While PCI DSS compliance may not be a 'legal' requirement, it is a big grey hole of mitigation and interpretation which has become easier/lighter, not harder over time. Key thing is, if you are not PCI compliant and do not have suitably backed (legally supportable) mitigation in place, then a data breach will result in fines that will kill small to medium businesses and seriously hurt big ones, plus almost certainly cost the job of who ever signed off the mitigation (oh and there is also the reputation hit).

I know of one US based retailer with a large UK presence who literally brought in a 3rd party to run their credit card auth systems in the provider's own cloud environment, thus removing the need for them to have any PCI DSS requirements. I know the large retailer I was working for also looked at this.

[Brother D]

Cheers for the comments everyone.

I'll get them to speak to environ next week, as logically this isn't any different to using square to take a payment or a card machine with a sim card as the encryption is between the unit and the card processor (and no kind of transparent proxy is present to decrypt/encrypt data) and nothing card related is stored on site.

Anyway I don't think it's going to hurt keeping the card units on their own DMZ behind a second firewall.

Thanks

[Griffith4ever]

Brother D said:

Elavon are the ones asking. I've started the process for them and just waiting for the pet-test results to come back in. Also can I ask what FW your businesses are using? In other large offices we have Fortigates, but seems a bit of overkill for a small biz if it's blocking all inbound traffic on both external and the DMZ router.

Edited by Brother D on Friday 22 April 19:06

I'm a lone operator, based at home. My firewall Is my tplink router ! And Windows firewall .

All of the card stuff is handled on the web, not even on my own site. When you go to pay it is handed off to a Sagepay web form, hosted by them. I chose that way for simplicity, and, to avoid storing customer card data. On the rare occasion I manually process a card over the phone it's done again, on a Sagepay website, and after keying it in, I can't ever see the card details again, only the transactions. My phone calls are not recorded either.

Only thing I store is their contact details, which are on my remote web hosts site. Therefore avoiding data storage issues locally. I purge customer accounts frequently too. They are almost always one off purchase.

[bitchstewie]

Brother D said:

Cheers for the comments everyone.

I'll get them to speak to environ next week, as logically this isn't any different to using square to take a payment or a card machine with a sim card as the encryption is between the unit and the card processor (and no kind of transparent proxy is present to decrypt/encrypt data) and nothing card related is stored on site.

Anyway I don't think it's going to hurt keeping the card units on their own DMZ behind a second firewall.

Thanks

Surely they're doing more than most small businesses already do?

My local chippy takes cards and Apple Pay and they just have a handheld payment machine.

They won't have a clue what a firewall or a DMZ is.

[lizardbrain]

Unless you have a specific reason to be directly handling customer card data, there shouldn’t be a reason for a small business to need PCI compliance.

To get around it, we switched payment processors to stripe and let them handle anything sensitive offsite.

We may have lost some minor functionality but nothing we missed.

Or am I reading this wrong? Why do you need to handle the data?

[Griffith4ever]

lizardbrain said:

Unless you have a specific reason to be directly handling customer card data, there shouldn’t be a reason for a small business to need PCI compliance.

To get around it, we switched payment processors to stripe and let them handle anything sensitive offsite.

We may have lost some minor functionality but nothing we missed.

Or am I reading this wrong? Why do you need to handle the data?

They still make me do it - though I can take payments over the phone (via a virtual terminal). I don't even have a card machine. Saying that, most of the PCI questions are about the web side. There really ought to be a box that you tick that says "I don't host my card handling web form", and then all the other boxes disappear. I'll be doing mine perhaps today, I'll post some screenies of the kind of stuff they ask.

They did a short-term PCI with me over the phone not long ago when I incorporated my company - had to be re-done. To most questions the woman said, "you don't host your card processing do you?", and then just kept skipping whole sections - much like when I fill it in online :-) Took less than 5 mins on the phone.

[Brother D]

lizardbrain said:

Unless you have a specific reason to be directly handling customer card data, there shouldn’t be a reason for a small business to need PCI compliance.

To get around it, we switched payment processors to stripe and let them handle anything sensitive offsite.

We may have lost some minor functionality but nothing we missed.

Or am I reading this wrong? Why do you need to handle the data?

It's a restaurant and they have handheld terminals that are connected to their network so technically encrypted card data does traverse their network, but obviously no card data is stored on site. As for no reason for PCI compliance, what they have in place can't hurt general IT security.

Just as an update after the pen-test from Environ they are classed as now being in complicance - but still have the paperwork etc to complete.

Again no bad thing as the paperwork goes over making sure staff are aware of schemes like an 'engineer' turning up and saying they need to "replace the handheld device" or install "equipment" in a comms room etc.

[wombleh]

Get card machines that talk directly to the payment processor, don’t store any card holder data yourself and let the processor worry about PCI compliance. I’ve done it for banks and can’t imagine it’s financially feasible for many small businesses to go through PCI compliance.

It’s not a legal requirement but if you’re no longer able to take payment via VISA then you’re going to struggle.

[crmcatee]

Reading this with interest.

My dealing with PCI has been limited but I understood that if you were running it on your own network (i.e. wifi/wired) using network card readers you needed to provide some form of firewall as your own network is untrusted, however if the card reader connected to the public telephone network it was trusted and therefor you don't need to jump through all the hoops. Answering the questions is also easier.

Is that correct ?

Edited by crmcatee on Sunday 24th April 08:44

[eeLee]

This seems insane and overkill. They clearly are not storing any PANs on their network so why should they need to be PCI-DSS compliant?`

Dealing with bank requirements (avoiding storing PANs like the plague) and a credit card company on this as part of daily business, I cannot see how some restaurant with service provider terminals on their network needs to be compliant.

What exactly was the pentest?

[Griffith4ever]

My mate is a pub landlord, with again, Elavon. Card machines only. He has to go through PCI every year too - as we both grumble about it. His machines use his wifi. It's no cost to do it though, you just have to answer questions.