SAN ANTONIO -- As quick-service restaurant (QSR) Chick-fil-A became yet another retail chain to report at least the potential of either data breach or payment-card fraud, the issue of data security for the industry becomes more palpable.
Editors at CSP magazine have decided to focus on data security as the cover story for the upcoming February issue. To help retailers of varying resource levels start or reinvigorate their approaches to data security, editors interviewed Phil Schwartz, manager of information systems at Valero Payment Services Co., San Antonio, Texas, for CSP Daily News. Here are his thoughts:
Q: What's the best way for retailers to become more proactive about data security?
A: Ignorance is not really bliss. The more you know, the more you understand where the points of vulnerability are and what you can do to mitigate the risk. It's never going to be 100% secure. In a previous career, I worked in nuclear security. Even then we knew we could not provide 100% security, but we made sure [thieves] had to work hard to get at it, so it's not worth the effort.
Q: What are some of the best strategies?
A: You've got Europay MasterCard Visa (EMV), the payment card industry (PCI) standards, point-to-point encryption, tokenization … they all make monetization of data difficult to do. For me personally, the ideal is to have no data at all or make the data valueless. There are a number of strategies to do that. In the short term, a layered security—or employing many options--can make [data theft] more difficult …
Q: Would you suggest a tangible list of strategies?
A: When you look at PCI compliance, there's almost 400 line items. Oh my gosh, I have a hard time getting through them. But Conexxus, the technology department of NACS, did a risk-mitigation checklist. It's eight steps that address the biggest vulnerabilities. People can visit www.conexxus.org. It's not compliance, but it should help people sleep a little easier.
Q: What would you say is the c-store channel's biggest vulnerability?
A: Currently our biggest one is skimming. It doesn't mean there's no hacking [of corporate servers or point-of-sale registers] and more advanced threats, but it's pretty evident our biggest threat is still skimming. It's where we have our biggest losses. That's one of the reasons to take pictures of the inside and outside of your pumps so you know when they're clean.
Q: Do you have other suggestions?
A: Look out for someone parked for hours outside the store and doesn't move. Maybe they're going through a deck of white cards emptying storage tanks or downloading credit cards from a Bluetooth skimmer. Employees should be trained to tell [management] if they see something. They're your first line of defense. Some POS [point-of-sale] devices will let you know if a CRIND [card reader in dispenser] head gets opened. But you still have to train your staff to think about security on a day-to-day basis.
Q: And things are always evolving.
A: Yes. Today, you have 3-D printers making exact duplicates of keyboards and making them fit perfectly so they look just like the original. The threats are getting more sophisticated. In that case, our awareness of them has to get more sophisticated as well.
For more on data security, watch for the February issue of CSP magazine.
Members help make our journalism possible. Become a CSP member today and unlock exclusive benefits, including unlimited access to all of our content. Sign up here.