Global data encryption best practices
Visa announced global industry best practices for data field encryption, also known as end-to-end encryption. The best practices are designed to further the payment industry’s efforts to develop a common, open standard while providing guidance to encryption vendors and early adopters. Data field encryption protects card information from the swipe to the acquirer processor with no need for the merchant to process or transmit card data in the “clear.”
“Given the interest expressed by merchants and processors, guidance from the card brands is a critical determinant in figuring out how to move ahead with encrypting data in transit, especially absent a global standard,” said Avivah Litan, Vice President and Distinguished Analyst, Gartner Inc. “Companies should also be aware that if data is decrypted anywhere in their system, they are still at risk for a data breach.”
Visa’s best practices are designed to help organizations:
- Limit cleartext availability of cardholder data and sensitive authentication data to the point of encryption and the point of decryption.
- Use robust key management solutions consistent with international and/or regional standards.
- Use key-lengths and cryptographic algorithms consistent with international and/or regional standards.
- Protect devices used to perform cryptographic operations against physical/logical compromises.
- Use an alternate account or transaction identifier for business processes that requires the primary account number to be utilized after authorization, such as processing of recurring payments, customer loyalty programs or fraud management.
It’s important to note that sensitive authentication data such as full contents of the magnetic strip, CVV2, PIN/PIN block should not be used for any purpose other than payment authorization and may not be stored after authorization, even if encrypted.
While data field encryption applies after the card is swiped and throughout the merchant’s environment, encryption solutions between acquirer processors and Visa would further reduce the value of card data to criminals. Visa accepts encrypted transaction data from acquirers, third-party processors and merchants directly connected to VisaNet. Visa has offered an authorization and settlement encryption solution since early 2008, and the service is available to direct connect clients.