PCI Affects Your Customer Payments

No Comments » Written on April 8th, 2012 by
Categories: Uncategorized

Chances are that if your business accepts payment from customers using a credit card, you’re affected by rules and regulations that require you to be “PCI compliant”. But you probably don’t know what that means.

This term is heard more and more frequently these days as data breaches at merchants like TJX (TJ Maxx), and payment processors Heartland Payment Systems and RBS WorldPay land millions of card records in the hands of hackers.  Criminals are using the data to make purchases and withdraw money from accounts of unsuspecting victims who did nothing wrong; they just owned a card.

It’s a huge and growing problem.  More than 80 percent of data stolen in breaches is payment card (credit card) data, according to the 2009 Verizon Business Data Breach Report.

More than likely, if your business accepts credit cards, you are using a terminal to swipe cards, entering credit card information into a “virtual terminal” (on a computer), or jotting down customer credit card data on a slip of paper or receipt.  This credit card information is then transmitted electronically, by phone or Internet, to your credit card merchant for processing.  A short time later, the monies are deposited into your business bank account.

To help protect consumers against credit card fraud, it’s likely that your credit card merchant is, or will be, required to follow the requirements of the PCI (Payment Card Industry) Security Standards Council very soon.  This can drastically impact the way your business handles credit card transactions.

How PCI Will Affect Your Business

When your credit card merchant tells you they are becoming PCI-compliant, you will be notified that you must perform a comprehensive audit of your internal and external payment handling processes, electronic cardholder data transmission systems, software, and computer network in order to ensure that you are compliant.  Failure to meet compliance standards can result in fines from credit card companies and banks, and even the loss of the ability to process credit cards.

You can expect to be required to meet requirements in six categories of PCI standards:

Network Security

This standard refers to the actual network that cardholder data is exposed to. In the case of an online business, the most obvious vulnerability for this standard is the Web server. Luckily, most hosting companies take responsibility for ensuring the security of their networks. However, there is more to this standard than meets the eye. Do you keep cardholder data (even just customer names) on a laptop that you use on public networks? Does your office network have a firewall installed and reasonable security measures in place?

In short, whenever any personal information about a cardholder is stored on a computer (which is also connected to a network), that computer is behind a firewall and all reasonable measures have been taken to protect that particular network.

Protection of Cardholder Data

This category focuses on how cardholder data is stored and transmitted. Business owners that choose to store cardholder information have an obligation to protect that data. Protecting information means that not everyone can access that it. Businesses that store actual credit card numbers will often store them as encrypted data, so that even if someone got access to the database they still could not decipher the information in it.

Ecommerce businesses need to be especially critical of the way that cardholder data is transmitted. When a customer makes a purchase on a website, his/her cardholder information is sent across the Internet. During that transmission, cardholder data must be encrypted with at least a 128 bit SSL certificate in order to meet this standard.

Maintain a Vulnerability Management Program

This one is relatively simple, and translates to keeping up to date with your systems. Vulnerability exposure can be minimized by regularly updating computer hardware, operating systems and software. Keeping up to date anti-virus software, as well as running regular virus scans, is another requirement to meet this standard if your systems are susceptible to such vulnerabilities.

Implement Strong Access Control Measures

The most exploited breach in security is the human element, which is harder to protect. Part of meeting PCI compliance means limiting access to cardholder data to only those persons that need to use it. In addition to restricting physical access to cardholder information, business owners are also responsible for assigning a unique identification to each person that does have access.

Regularly Monitor and Test Networks

Networks that store cardholder data must be monitored and tested regularly. Regular scans of security measures and processes, monitoring and tracking of network access to cardholder data are required to satisfy this standard. Consider signing up for a security testing and auditing service, which can help you to identify and fix potential security problems as they arise.

Maintain an Information Security Policy

Considering that humans are generally the easiest part of a system to hack, and also that ignorance does not relieve liability, it’s important to draft and implement a company-wide information security policy. Make sure that your employees know and understand their responsibilities with regards to cardholder data before it becomes an issue.

The first step in PCI compliance is to meet the above standards. Credit card companies and financial institutions validate that vendors are abiding by the regulations, giving them ratings based on their volume of transactions. The rating that a company receives determines the process that they must go through in order to be validated.

Contact To Solution at 262-737-4774 or point your Web browser to www.tosolution.com to get in touch with our experts to know more about how you can meet your company’s PCI audit requirements.

Extended Hours in 2012

No Comments » Written on December 31st, 2011 by
Categories: Company News

We are happy to announce that we will be expanding our business hours. Our updated support business hours will be Monday-Friday 7am to 5pm CST. Our on-call techs will now be available on our SupportDesk (262) 737-4774 option 1 between these hours.

As always, thank you for your continued trust and confidence. Happy New Year, and we are looking forward to serving you in 2012!

Sincerely,

Your To Solution Team

Intrusion Detection, Managed Security, Advanced Persistent Threats…or in layman’s terms…Viruses

No Comments » Written on December 28th, 2011 by
Categories: Email Protection, Network & Desktop Security
Tags:

Lately we’ve noticed a rise in virus (including malware, trojan, and spyware) activity with many of our clients. Some of the discussions that have taken place since then have helped us realize that there needs to be much more education on this problem and the possible solutions. We’ll attempt to do that in this month’s newsletter. Read the rest of this entry »

What Does Technology Cost Per User?

Wouldn’t you love to have an answer to that question?  As a business owner or manager, you know that technology is an important part of your business.  And for many industries, technology is the cornerstone of the revenue stream.  But what does it really cost to give an employee the computer and tools they need to do their job?

Foremost technology research company, the Gartner Group, has released a number of studies over the years on this subject. A number of years ago these studies showed costs per user at over $10K per user. The good news is that these figures have come down significantly since then. Read the rest of this entry »

HP Ditches Plan to Spin Off PC Unit

No Comments » Written on October 28th, 2011 by
Categories: Uncategorized
Tags: ,

In case any of you with upcoming hardware decisions missed this we thought we’d provide this piece of news from Reuters:

Hewlett-Packard Co ditched a plan to spin off its personal computers unit, a month after the ouster of CEO Leo Apotheker whose idea would have cost billions of dollars in expenses and lost business.

“This is the most pragmatic decision and allows them to continue to leverage the end-to-end supply chain benefits,” said Gartner analyst Mark Fabi, adding that it also showed Whitman’s decisiveness as CEO.”

Email Addresses Tell Who You Are

How you use the Web tells others quite a bit about you.  In particular, your domain name and email address says a lot about who you are as an individual or company.  Successful people know the pitfalls to avoid.

Rules for Email Addresses

  1. Always use the company’s domain name!
  2. Always use the company’s domain name!
  3. See rule #1 and #2

Using your company’s domain name not only looks professional, but reinforces your Website address.  Free email accounts (gmail.com, yahoo.com, hotmail.com) should be avoided because:

  1. They are often perceived as unprofessional and the address tells customers your company can’t afford a Web account tied to the company domain name.
  2. Free email addresses are used by scammers because…well…they’re free!
  3. Because they are used by scammers, free email addresses often trigger fraud alerts.

So, if you care about how you and your business come across to potential and existing customers, make sure your email address uses your company’s domain name.

These days, having your own company domain name isn’t really a choice – it’s become a necessity.  The first step for your business is to have a short, easy-to-remember, domain name registered.  The next step is to have a centralized email system (like Microsoft Exchange, Zimbra, etc.) for your company and have all of your employees use the company email address.

Easy SharePoint Migration – Using File/Folder Views

Migrating to SharePoint allows your users to share, find, and collaborate on information much more quickly. Transitioning to SharePoint 2007 or 2010 is easier than you might think. Using file and folder views in SharePoint will allow you migrate users to SharePoint, all while they continue to work in the traditional file/folder view that they are used to. Read the rest of this entry »

How SSL and CAs Work

Each time you visit an SSL-secured Website, you get the “green bar”/lock and your computer recognizes that the certificate is valid because it already has a copy of a certificate authority’s (CA) root certificate in its “Trusted Root Certification Authorities” certificate store.  For example, by default, when you install a fresh XP/7 machine, there are over 50 root CAs pre-installed.  Among them are: Thawte, Verisign, StartSSL, Microsoft, etc.  These are some of the de facto “big players” in the SSL market, and Microsoft has made the decision for you (when you install the OS) that these root certificates will be installed and, therefore, trusted. Read the rest of this entry »

Keep Your Free Email Accounts Safe

No Comments » Written on March 4th, 2011 by
Categories: Email Protection
Tags: , , , ,

When dealing with email security one can never be too safe.  It is absolutely imperative that you change your password often and for every account you have.

One of the most important yet overlooked things to remember when attempting to keep an email account safe and secure is the strength of the password.  It can’t be over-emphasized how incredibly important it is to use a secure password for your email account (especially a free account such as Yahoo or Gmail!). Read the rest of this entry »

Floppy Drives – Will Tape Drives Soon Follow?

No Comments » Written on January 24th, 2011 by
Categories: Data Backup & Recovery
Tags: , ,

When is the last time you heard someone say, “I’ll just throw that file on a floppy drive for you”?  Floppies enjoyed nearly three decades as the ubiquitous form of data storage and data transfer from the mid 1970s to the late 90s.  At one point or another, we were all at the point where we used floppy drives and praised their usability because, frankly, there was no other solution which was as cost effective or reliable. Read the rest of this entry »