6 steps to meet the deadline for payment card security

Payment processors, along with government agencies and businesses that accept credit and debit cards, are under pressure to keep pace with the latest encryption technologies, with some keeping up better than others.

Five years ago, the Payment Card Industry Security Standards Council (PCI SSC) suggested that organizations in the payment industry could reduce their vulnerability to data breaches by implementing end-to-end encryption. A few in the industry upgraded, switching to encryption at card swipe, but most resisted, saying the change would be too expensive. Whatever the cost, it would have been far less than the expenses incurred by massive point-of-sale payment card data breaches in recent years, which encryption at card swipe may have prevented.

Now, a required change to stronger encryption is on the horizon for every government agency and business that accepts payment cards. Late last year, PCI SSC announced that it had extended the deadline -- from June 2016 to June 30, 2018 -- for organizations that process credit card payments to adopt more secure encryption that will strengthen protections against data theft.

Old SSL (Secure Sockets Layer) and early TLS (Transport Layer Security) encryption technologies still are widely used, but those solutions are an inadequate defense against data breaches. Accordingly, the PCI SSC is requiring upgrades to TLS v1.1 encryption or higher. Though not required, the council is encouraging upgrades to TLS v1.2, because not all implementations of TLS v1.1 are considered secure.

What government agencies need to know

Considering the extended deadline, agencies may be tempted to keep PCI security migration on the back burner. That would be a mistake. Failing to meet the PCI security migration target date could undermine an agency’s ability to conduct business, serve taxpayers and bring in revenue. Besides the need to meet the council’s deadline, the change is important because modern web browsers will begin prohibiting SSL connections in the near future.

Each agency must find out how complex its migration will be, what kinds of disruptions could occur and how much the necessary upgrades will cost. Those and other pertinent questions cannot be answered until the migration planning process gets underway.

Here’s what agencies need to do to meet the June 2018 deadline:

1. Coordinate with IT staff and payment processor. Your IT team --  or a third-party provider if you don’t have internal staff  --  are the experts who should analyze the agency’s hardware, operating systems, applications and browsers to find out whether these internal systems are capable of adopting the higher-grade encryption. Your payment processor’s engagement is important because these service providers must support TLS v1.1 or higher by June 30, 2016, in existing solutions and must disable SSL and TLS v1.0 for all new solutions. If your provider plans to stop supporting the encryption protocol used existing solutions before your agency upgrades, constituents won’t be able to complete transactions. For agencies in the process of acquiring a new payment solution, the impact may be sooner.

2. Create a risk mitigation strategy. Until your agency upgrades to TLS v1.1 or higher, your payment data is vulnerable. While you’re moving toward stronger encryption, put controls in place to reduce the data theft risk connected with SSL and early TLS.

3. Scope out the costs. Depending on the equipment your agency has and how much of it will have to be replaced, costs to transition to TLS v1.1 or higher can vary dramatically. Get your arms around the anticipated capital needs as soon as possible so you don’t face uncertainties at the last minute about how to fund the change. 

4. Create a migration plan. To make sure your agency crosses the finish line on time, create a timeline that prioritizes each step that must be accomplished to meet the PCI deadline. Set aggressive deadlines to complete the conversion well in advance of June 2018.

5. Engage relevant staff members. Work with employees in formulating the plan and hold them accountable for completing their assigned responsibilities by the established deadlines.

6. Alert your constituents and business partners. Businesses and citizens who interact online with your agency may not realize that they, too, may need to make technology upgrades. If their existing desktop computers and browsers only support the older encryption protocols, they won’t be able to get to certain websites, including yours, after you’ve migrated to TLS v1.1 or higher.

As mentioned above, some industry experts believe that some implementations of TLS v1.1 already are considered insecure. As your agency goes through the security migration process in the months ahead, it’s in your agency’s -- and your constituents’ -- best interests not just to meet the PCI SSC’s minimum requirements but to upgrade now to the strongest encryption available.