August 2009 release of best practice doc, PCI_skimming_prevention_form.pdf, directed at skimming attacks. Illustrates how exposed terminals in POS are targeted by criminals. Wires, connections, ceilings, boxes, cameras and staff problems. It's a good document though worth noting that we find it ironic that the council would provide best practice guidelines for download as a Microsoft doc file. Historically and functionally that is one of the most dangerous files to download and have a user open. Guidelines also include self-assessment forms which are useful.
Chapter 1: Overview
The primary mission of the Payment Card Industry Security Standards Council (PCI SSC) is to ensure the security of payment data and the security of the payment infrastructure that processes that data. PCI SSC is committed to build trust in the payment process and payment infrastructure for the benefit of all constituents. As the threats and vulnerabilities of fraud evolve, payment constituents can and should expect the emergence of further security standards and requirements for terminal types, terminal infrastructure, payment devices, and payment process.
This document was created to assist and educate merchants regarding security best practices associated with skimming attacks. Though currently not mandated by PCI SSC, guidelines and best practices documents are produced to help educate and create awareness of challenges faced by the payment industry. The guidelines are the result of industry and law enforcement understanding of the current and evolving threat landscape associated with skimming. In addition we have incorporated known best practices, currently conducted by many merchants, to mitigate skimming attacks taking place in their respective point-of-sale environments. .
This document contains a non-exhaustive list of security guidelines that can help merchants to:
· Be aware of the risks relating to skimming.
· Be aware of the vulnerabilities inherent the use of point-of-sale terminals and terminal infrastructure.
· Be aware of the vulnerabilities associated with staff that has access to consumer payment devices.
· Prevent or deter criminal attacks against point-of-sale terminals and terminal infrastructure.
· Identify any compromised terminals as soon as possible and notify the appropriate agencies to respond and minimize the impact of a successful attack.
Additional security can--and must--be provided by merchants to enhance the security provided y the current PCI SSC standards and payment terminal vendors. Merchants have an obligation to ensure their respective payment systems and infrastructure are secure.
Merchants are the firstline of defense for POS fraud and are involved in the execution of the vast majority of controls suggested or required by PCI SSC. Merchants can achieve appropriate security and trust levelsat the point of sale by considering all the factors that can influence overall security in their terminal environment and taking the necessary countermeasures detailed in this document to ensure an appropriate level of security.