The Impact of PCI Compliance on DVR and NVRsby Dave Nieweg, 3xLOGIC posted on Aug 01, 2008
Surveillance vendors who sell to retail merchants have undoubtedly heard about PCI compliance, but may not understand exactly what it is and how it impacts the security industry. My company, 3xLogic, recently successfully completed a comprehensive PCI compliance audit for our DVR/NVRs. This report shares what we learned and how we achieved this. For more information on how PCI compliance may affect retailers, see our whitepaper on PCI compliance.
At first glance, PCI compliance appears to be an issue between the payment card companies such as VISA and the merchants who accept credit cards. However, as merchants are being required to comply, they are passing some of the impact down to the vendors whose systems sit on their network.
What the merchants aren’t saying is what they want the surveillance vendors to specifically do. We often hear, “We need your system to be PCI compliant before we can put it on the network”, but offer little assistance in defining exactly what PCI compliance means for the surveillance vendor.
In fact, a visit to the PCI Council’s website does little more than to confuse the issue further since it primarily deals with the responsibilities of software companies who provide payment applications and the merchants who accept credit cards. Any attempt to find information about non-payment systems leaves one with a very unclear understanding of a course of action.
WHAT IS PCI?
Simply put, the Payment Card Industry – Data Security Standards (PCI-DSS) is one of a set of requirements designed to help safeguard credit card data from being stolen through network breaches and ineffective IT security practices. Recent high-profile cases including TJX and Hannaford have served to highlight the need for merchants to take some measure of responsibility in protecting cardholder data.
Originally most card providers such as Visa and MasterCard had established their own proprietary rules regarding the handling of credit card data by merchants. Concern and confusion by the merchants over varying and overlapping requirements by the rival card companies prompted the card issuers to create an independent organization and standard for protecting credit card data. This entity is known as the PCI Security Council and while there are actually several standards, the most applicable to our industry is the PCI-DSS.
The PCI-DSS provides a variety of actions that must be taken by both payment software vendors (such as POS applications that handle credit cards) and the merchant themselves in how they configure and protect the network that the payment systems are connected to. The main issue is that any device or application that sits on the merchants’ network could in effect be a potential entry point into the protected network and lead to a compromise of cardholder data.
It is this need to secure the merchants entire network as well as the devices and software attached to the network that creates the demand for video surveillance vendors to meet PCI requirements, or more specifically, to provide solutions which are secure enough that they do not compromise the merchants network security plan.
So how does a video surveillance vendor (or any other manufacturer for that matter) comply with this request to become PCI compliant?
Be aware that there is no process or standard offered by the PCI Council which allows a non-payment application or network equipment provider to become certified as being PCI compliant. It simply does not exist. Yet, we have merchants who think that they are doing the right thing by asking their vendors to get PCI certification, an impossible task. The answer is in both the details of what we are trying to accomplish and using the proper words when discussing PCI requirements.
What the merchant really wants is to:
1. Build and maintain a secure network
2. Ensure than any solution added to the network does not introduce an insecurity
3. Ensure that added solutions do not break their PCI compliance efforts
4. Have the solution vendor give them some form of validation that the solution is secure, can be maintained in a secure manner, and adheres to industry best practices and standards
5. Have the vendor pick up some of the liability if the network is found not to be secure either through a breach or audit.
So let’s cover each of those five bullets briefly to further understand the impact to surveillance vendors.
The merchant needs to build and maintain a secure network
This should be a basic requirement any vendor seeks to achieve yet the truth is that while the security industry as a whole may be great at physical security, we historically lack the required skill set when it comes to network security. But let’s face it, our solutions are now on the network and therefore we need to learn how to provide secure solutions.
Ensure than any solution added to the network does not introduce an insecurity
There are two issues here that impact surveillance vendors.
This first is the inherent or built-in security that the solution has as it leaves the manufacturers back door. Many solutions being shipped today utilize highly vulnerable technologies such as web applications, non-secured operating systems and may even have a wide variety of exploitable technologies built into the product.
Manufacturers first need to understand the most current threats and then need to evaluate and adapt their architectural design to provide maximum inherent security.
One method to accomplish this is by having a valid and effective Software Development Lifecycle (SDLC) program in place which adheres to industry best practices, meets secure software development standards and has security activities and awareness built-in throughout the process.
The second way that network insecurity can be introduced into the merchants’ network is in how the product is deployed, configured and maintained. Many vendors feel that at this point it is out of their hands, but new pressures on the merchant from the PCI requirements are causing them to push back at the manufacturer.
Simply put, without the manufacturer’s assistance, training and documentation, the merchant and their IT teams have little idea what security issues or potential exploits await your product. They best they can do is to bolt on after the fact security in an effort to isolate the product from the network. The issue is further compounded by the fact that many manufacturers provide solutions which the IT staff cannot maintain the same way that they maintain their other network resources. For these reasons it will become increasingly valuable for manufacturers to develop programs which will assist the merchants in securely deploying and maintaining their products.
Ensure that added solutions do not break their (the merchants) PCI compliance efforts
Merchants are hard at work to meet the requirement of the PCI-DSS and other standards. If manufacturers of products do not fully understand the requirements that need to be met, they may provide a configuration, which although secure, may in fact conflict with the PCI-DSS and therefore render the merchants efforts useless.
By fully understanding the merchants needs, more specifically the governance requirements that the IT staff is trying to meet, the merchant will be more likely to trust that the manufacturer has provided a solution that will enhance and not break their compliance efforts.
Have the solution vendor give them some form of validation that the solution is secure, can be maintained in a secure manner, and adheres to industry best practices and standards
Trust is a great thing and manufacturers who have earned their clients trust are in an enviable position, but today, merchants need more. They need authentic validation that what you say about the security of your product is not only true, but that it can be demonstrated to the entities that they have to answer to. Specifically, these are the auditors and the card companies that are enforcing the PCI standards. Merchants are no longer being taken at their word, and they will no longer take you at yours.
There may be several ways to demonstrate your security and compliance with the standards, but the best by far is to engage in the same type of audit that your clients are subject to which is performed by a certified CISP-compliant auditing firm. You won’t get a certification, but you can ask for a Letter of Conformance, meaning that your processes and products were found by the auditor to comply with the PCI requirements.
The results of the audit give the merchant something they can point to in the event an auditor questions the security or configuration of your product on the network. It may not remove 100% of the concern and there may in fact be further action required by the manufacturer, but it provides the auditor and the merchant with a documented understanding of the actions you took as a manufacturer.
Admittedly, the primary problem faced by manufacturers when seeking out an audit, is exactly what standard the auditor needs to measure against. One way it to utilize the existing PCI-DSS for any issue that applies to the manufacturers’ solution. Obviously there are many sections that only apply specifically to payment applications that will need to be disregarded, but overall will provide a solid starting point.
The next step will be to submit to a full scan by an approved scanning vendor (ASV) with a product configured exactly as deployed. A proper scan will expose commonly exploited vulnerabilities which will need to be mitigated by the manufacturer.
Lastly, the manufacturer will need to fill in the gaps with methods of their choosing, to demonstrate that they have adhered to all applicable development best practices. This can extremely challenging and costly and will vary by the manufacturers client demographic.
Have the vendor pick up some of the liability if the network is found not to be secure either through a breach or audit.
Ironically, if a manufacturer has performed all of the above steps, they will have certainly exposed themselves to a certain amount of liability. After all, the audit has served to document a certain level of security built into your process and product, but should your product fail to perform as stated and even worse, become the primary entry point for a breach, all fingers will point back to the audit. If the manufacturer has provided inaccurate documentation or performance, they will most certainly be liable to some extent.
The challenge to manufacturers of course is how to best mitigate or limit the liability created by meeting these new client requirements. The most direct method of course is to simply provide secure products and programs, but this is not as easy as it seems. Most manufacturers do not currently have these processes and programs in place, and putting them in place can take years. In the case of imported products, it may be highly unlikely that foreign manufacturers will offer the required transparency into their software development practices and create the type of relationship needed to mitigate built-in security issues.
So where does this leave surveillance vendors? The answer may be “in the dark” since there is no clarity and direct solution for this issue. The largest governance our industry had been subjected to in the past was UL certification for which we had a defined process and result. PCI compliance and the mitigation of network security issues is nothing like obtaining a UL certification.
I believe vendors will take two approaches to this issue with one side deciding this is not an issue that should be dealt with by the surveillance industry. My thoughts are that if it is a client issue, it is a vendor issue and vendors who choose not to address their client’s concerns may find their product is less desirable. There is a large amount of competitive infiltration by complementary industries that do understand the governance requirements of the merchant and this may simply assist them in their marketing efforts.
On the other side we will have the manufacturers who will most certainly recognize the need to provide secure products for a variety of reasons including proprietary and confidential company information on the network. They will work toward putting the processes and procedures in place, although this may take years to accomplish primarily due to the fact it will require significant changes to the way most companies develop, sell and deploy their products. Comments?
By David Nieweg, Marketing Director, 3xLogic, Inc.
3xLogic, Inc., is a manufacturer of the Vigil line of video surveillance products and is based in Victoria, British Columbia with offices in the US and abroad.
Most Recent Industry Reports
Uniview Chinese Camera Tested on Apr 28, 2015
The company claims $263 million in 2013 revenue and to be the third largest Chinese surveillance manufacturer (after Hikvision and Dahua). Despite being owned by American investment firm Bain Capi...
Google Maps Camera Calculator Released on Apr 27, 2015
The new IPVM Google Maps Camera Calculator empowers surveillance professionals to plan and design systems like never before. Whatever project you are working on, enter the address and start mappin...
Gain / AGC for Video Surveillance Guide on Apr 23, 2015
Gain control is a critical, though often overlooked, factor in low light surveillance video. It is generally only noticed when the negative side effective of aggressive gain levels are seen, namely...
Testing Honeywell HQA HD-CVI on Apr 22, 2015
HD analog support continues to expand, with Honeywell now releasing its own HD-CVI offering, awkwardly named "High Quality Analog" (HQA), offering up to 1080p video via analog. The big appeal is g...
Testing Axis Zipstream on Apr 13, 2015
Has Axis found its breakthrough differentiator? Can they demand a premium for this? Axis claims Zipstream can "lower bandwidth and storage requirements by an average 50% or more." We upgrade...
New Products Spring 2015 on Apr 12, 2015
After very poor new releases in 2014 (see Spring 2014 and Fall 2014 directories), 2015 is already much better. Here are new products being announced in 2015: Avigilon First to Demo 7K Cameras ...
FLIR FX Tested on Apr 08, 2015
FLIR is going after the home / consumer surveillance market with their FLIR FX. A few of the notable competitive features offered: Video analytics for search (RapidRecap) Built-in Battery Buil...
IP Network Setup Guide for Surveillance on Apr 06, 2015
In this guide, we teach the fundamentals of setting up an IP video surveillance network, taking factory default cameras through to a fully configured and ready to run network. We explain these topi...
Testing Messoa 3MP LPC Camera on Apr 02, 2015
License plate recognition has historically required specialized cameras with limited general surveillance use. Messoa is aiming to change that with the LPR606, a higher resolution 3MP claiming sce...
Security Integrator Finder Released on Apr 01, 2015
The new Security Integrator Finder's goal is to list every integrator in the world, overlaid on Google Maps. Here's how you benefit: Integrators can more easily be found by end users and manufa...