SkyWire, Inc. Presents
PCI Compliant VS
Point-to-Point Encryption
Tips for using POS Systems:
• Target’s loss of customer information resulted in major fees, lost
sales, and a negative public image because of a security breach in
their system.
• Out-dated operating systems like Windows XP will make your
business vulnerable to attacks similar to what Target experienced.
• The number of POS Systems that run on XP are staggering.
If your business has one of these operating systems, it is
recommended to invest in more secure options to protect
your customers.
Your Customer’s Security is Top Priority
To understand Point-to-Point Encryption you must first understand what it means to
be compliant with PCI Data Security Standards (PCI-DSS). The PCI Security Stan-
dards Council (PCI-SSC) is the governing body that oversees the ongoing develop-
ment, enhancement, storage, dissemination and implementation of security standards
for account protection.
What does that mean to you? PCI-DSS imposes regulations on a merchant to ensure
all credit cards are handled in a safe and secure manner. For any merchant responsible
for processing credit cards, this can become overwhelming. Servers need to be
upgraded regularly, network security needs to be tightened down, and policies need
to be in place for handling credit cards. Any systems that may store, process, or
transmit card holder data are considered in PCI scope. The cardholder data
environment (CDE) extends to any system connected to the processing environment
(even if it is not directly connected). To limit the scope of the PCI-DSS assessment,
many companies will look to limit access to the processing server by segmenting their
network. While this keeps the remaining network Out-of-Scope, it in most cases
limits productivity.
What Does PCI Compliant Mean?
If a security breach was to occur, and the merchant was found to have a non-PCI-
DSS compliant environment, the merchant would be held accountable. At that point
the merchant may be subjected to fines, card replacement costs, forensic audits, etc.
Many merchants are seeking to implement a Point-to-Point Encryption solution
where system components that simply process and transmit encrypted data, are
adequately isolated from the encryption and decryption environments, and have no
ability to decrypt the data be excluded from the scope of a PCI-DSS review.
Fig. 1
The PCI-SSC has previously clarified that encrypted data is out of scope if, and only if, it
has been validated that the entity that possesses encrypted cardholder data does not have the
means to decrypt it.
Since the Magnetic Strip Reader’s are pre-injected with the processor’s key, and the keys do
not reside on the POS, it is considered Out -of -Scope. However, if an entity can validate
that the encryption and decryption environments and methods used meet industry best
practices included in the Validation Requirements for Point-to-Point Encryption, then an
entity may consider their CDE reduced to the encryption and/or decryption environments,
subject to validation.
So, can P2PE really simplify the PCI-DSS process?
In short, Yes.
P2PE is a great solution for merchants who have been faced with unclear Self-Assessment
Questionnaires (SAQ) or costly PCI audits by Qualified Security Assessors (QSAs). P2PE,
if deployed in a compliant manner, can reduce if not eliminate your business from PCI-DSS
scope. Leaving the merchant to concentrate on their business and ease the burden of
PCI-DSS compliance.
What is Point-to-Point Encryption (P2PE)?
Yes. The beauty of SkyWire POS is not only the Windows 8 Industry platform and
easy to use cutting-edge software. It’s the fact that our credit card processor uses point-
to-point encryption.
Without going into too many boring technical details on what point-to-point means,
the gist is that your customer’s credit card information never gets stored to be at risk in
the first place.
All credit card info is sent directly and securely to the credit card processor or bank.
For a demo of SkyWire POS or to see how we can get you secured for a fraction of the
cost call now. 866.514.5888
Does SkyWire POS offer P2PE?
www.skywire.com