d Recent findings of “Shadow IT” within Padgett-Beale properties have been
shocking discovery. Micro payments using unauthorized payment card and said
processing of such transactions are not authorized in the organization’s IT
policy. All properties issuing payment cards with property name is to be cease
the activity immediately. The technology and the implementation must meet
Padgett-Beale’s IT device and software approval process prior to
implementation of said technologies. Unsecure payment methods and
processing violates Payment Card Industry Data Security Standard, otherwise
PCI-DSS, an industry wide standard that protects customer data and
minimizing serious breaches and major losses of confidentiality.
PCI-DSS, by no means is law, it is part of the contractual relationship between
merchant and card company. Some states may write laws modeling the PCI
DSS (Willis, 2019). d There are several factors required for compliance with
PCI-DSS, which is not met by the unauthorized micro payment systems that are
tied to customers’ credit cards. These factors include installing and maintaining
a firewall to protect data in transmission and at rest. Changing vendor supplied
login credentials and using secure communication ports and protocols.
Encrypting of data in transit and data at rest. As well as having access control
to the credit card data collected by the business. In its current state, the
micropayment that’s been illicitly installed on some Padgett-Beale had not been
documented to follow any of the mentioned examples that would bring it to
compliance with PCI-DSS. Padgett-Beale is expose to penalties from card
brands and banks in the case of a breach. This will severely affect the
confidence in the business, and the bottom line of the organization will be
negatively affected (Willis, 2019).
d d d d d d d d d d One of the most concerning parts of the rogue micropayment process
installed at Padgett-Beale is the connection to customer credit card information.
This information needs to be secure in several ways. First, all IT devices that
are part of the payment system must be scanned for vulnerabilities.
Vulnerabilities discovered should be closed or mitigated by working with the
suppliers of the IT devices that are part of the payment processing. Open
vulnerabilities are some of the easiest ways for outside threats to expose and
steal sensitive customer data (Wilder, 2020). Firewalls to protect all network
connected payment process devices must be enabled, for added layers of
security. These firewalls cannot allow any traffic not authorized or required by
the payment processing systems. Securing the data in transit by encryption and
using secure protocols is a must in deterring any main in the middle attacks
from deciphering the information being captured if an attack were to occur.
Data that are stored in the organization’s servers must also be encrypted and
protected through proper firewall, patching vulnerabilities, and proper access
control for need to know only.
d d d d d d d d d d In the current state, unauthorized micropayment processing that’s been
installed on Padgett-Beale does not comply with the organization’s IT
governance nor follows PCI-DSS compliance. Therefore, the micropayment
processing system at our facilities should be suspended until security is in place
to bring it in to compliance with PCD-DSS. This will ensure the protection of
customer payment information from being stolen, resulting in sever penalties
that may fall on Padgett-Beale for negligence and non-compliance. It is
important that IT devices and software are secured, validated, and approved
before connected to the enterprise network. With proper hardening and due
diligence, Padgett-Beale can provide safe, secure, and easy payment systems
for its customers.
References
Kossman, S. (2021, December 17). 8 FAQs about EMV credit cards.
CreditCards.Com. https://www.creditcards.com/education/emv-faq-chip-cards-
answers-1264/
Wilder, J. (2020, August 6). The 2019 PCI Compliance Annual Plan. PCI
Compliance Guide. https://www.pcicomplianceguide.org/2019-pci-compliance-
annual-plan/
Willis, L. (2019, January 3). The Payment Card Industry Data Security
Standard. American Bar Association.
https://www.americanbar.org/groups/litigation/committees/minority-trial-
lawyer/practice/2019/the-payment-card-industry-data-security-standard/
less
