The Impact of PCI Compliance on DVR and NVRsby Dave Nieweg, 3xLOGIC posted on Aug 01, 2008
Surveillance vendors who sell to retail merchants have undoubtedly heard about PCI compliance, but may not understand exactly what it is and how it impacts the security industry. My company, 3xLogic, recently successfully completed a comprehensive PCI compliance audit for our DVR/NVRs. This report shares what we learned and how we achieved this. For more information on how PCI compliance may affect retailers, see our whitepaper on PCI compliance.
At first glance, PCI compliance appears to be an issue between the payment card companies such as VISA and the merchants who accept credit cards. However, as merchants are being required to comply, they are passing some of the impact down to the vendors whose systems sit on their network.
What the merchants aren’t saying is what they want the surveillance vendors to specifically do. We often hear, “We need your system to be PCI compliant before we can put it on the network”, but offer little assistance in defining exactly what PCI compliance means for the surveillance vendor.
In fact, a visit to the PCI Council’s website does little more than to confuse the issue further since it primarily deals with the responsibilities of software companies who provide payment applications and the merchants who accept credit cards. Any attempt to find information about non-payment systems leaves one with a very unclear understanding of a course of action.
WHAT IS PCI?
Simply put, the Payment Card Industry – Data Security Standards (PCI-DSS) is one of a set of requirements designed to help safeguard credit card data from being stolen through network breaches and ineffective IT security practices. Recent high-profile cases including TJX and Hannaford have served to highlight the need for merchants to take some measure of responsibility in protecting cardholder data.
Originally most card providers such as Visa and MasterCard had established their own proprietary rules regarding the handling of credit card data by merchants. Concern and confusion by the merchants over varying and overlapping requirements by the rival card companies prompted the card issuers to create an independent organization and standard for protecting credit card data. This entity is known as the PCI Security Council and while there are actually several standards, the most applicable to our industry is the PCI-DSS.
The PCI-DSS provides a variety of actions that must be taken by both payment software vendors (such as POS applications that handle credit cards) and the merchant themselves in how they configure and protect the network that the payment systems are connected to. The main issue is that any device or application that sits on the merchants’ network could in effect be a potential entry point into the protected network and lead to a compromise of cardholder data.
It is this need to secure the merchants entire network as well as the devices and software attached to the network that creates the demand for video surveillance vendors to meet PCI requirements, or more specifically, to provide solutions which are secure enough that they do not compromise the merchants network security plan.
So how does a video surveillance vendor (or any other manufacturer for that matter) comply with this request to become PCI compliant?
Be aware that there is no process or standard offered by the PCI Council which allows a non-payment application or network equipment provider to become certified as being PCI compliant. It simply does not exist. Yet, we have merchants who think that they are doing the right thing by asking their vendors to get PCI certification, an impossible task. The answer is in both the details of what we are trying to accomplish and using the proper words when discussing PCI requirements.
What the merchant really wants is to:
1. Build and maintain a secure network
2. Ensure than any solution added to the network does not introduce an insecurity
3. Ensure that added solutions do not break their PCI compliance efforts
4. Have the solution vendor give them some form of validation that the solution is secure, can be maintained in a secure manner, and adheres to industry best practices and standards
5. Have the vendor pick up some of the liability if the network is found not to be secure either through a breach or audit.
So let’s cover each of those five bullets briefly to further understand the impact to surveillance vendors.
The merchant needs to build and maintain a secure network
This should be a basic requirement any vendor seeks to achieve yet the truth is that while the security industry as a whole may be great at physical security, we historically lack the required skill set when it comes to network security. But let’s face it, our solutions are now on the network and therefore we need to learn how to provide secure solutions.
Ensure than any solution added to the network does not introduce an insecurity
There are two issues here that impact surveillance vendors.
This first is the inherent or built-in security that the solution has as it leaves the manufacturers back door. Many solutions being shipped today utilize highly vulnerable technologies such as web applications, non-secured operating systems and may even have a wide variety of exploitable technologies built into the product.
Manufacturers first need to understand the most current threats and then need to evaluate and adapt their architectural design to provide maximum inherent security.
One method to accomplish this is by having a valid and effective Software Development Lifecycle (SDLC) program in place which adheres to industry best practices, meets secure software development standards and has security activities and awareness built-in throughout the process.
The second way that network insecurity can be introduced into the merchants’ network is in how the product is deployed, configured and maintained. Many vendors feel that at this point it is out of their hands, but new pressures on the merchant from the PCI requirements are causing them to push back at the manufacturer.
Simply put, without the manufacturer’s assistance, training and documentation, the merchant and their IT teams have little idea what security issues or potential exploits await your product. They best they can do is to bolt on after the fact security in an effort to isolate the product from the network. The issue is further compounded by the fact that many manufacturers provide solutions which the IT staff cannot maintain the same way that they maintain their other network resources. For these reasons it will become increasingly valuable for manufacturers to develop programs which will assist the merchants in securely deploying and maintaining their products.
Ensure that added solutions do not break their (the merchants) PCI compliance efforts
Merchants are hard at work to meet the requirement of the PCI-DSS and other standards. If manufacturers of products do not fully understand the requirements that need to be met, they may provide a configuration, which although secure, may in fact conflict with the PCI-DSS and therefore render the merchants efforts useless.
By fully understanding the merchants needs, more specifically the governance requirements that the IT staff is trying to meet, the merchant will be more likely to trust that the manufacturer has provided a solution that will enhance and not break their compliance efforts.
Have the solution vendor give them some form of validation that the solution is secure, can be maintained in a secure manner, and adheres to industry best practices and standards
Trust is a great thing and manufacturers who have earned their clients trust are in an enviable position, but today, merchants need more. They need authentic validation that what you say about the security of your product is not only true, but that it can be demonstrated to the entities that they have to answer to. Specifically, these are the auditors and the card companies that are enforcing the PCI standards. Merchants are no longer being taken at their word, and they will no longer take you at yours.
There may be several ways to demonstrate your security and compliance with the standards, but the best by far is to engage in the same type of audit that your clients are subject to which is performed by a certified CISP-compliant auditing firm. You won’t get a certification, but you can ask for a Letter of Conformance, meaning that your processes and products were found by the auditor to comply with the PCI requirements.
The results of the audit give the merchant something they can point to in the event an auditor questions the security or configuration of your product on the network. It may not remove 100% of the concern and there may in fact be further action required by the manufacturer, but it provides the auditor and the merchant with a documented understanding of the actions you took as a manufacturer.
Admittedly, the primary problem faced by manufacturers when seeking out an audit, is exactly what standard the auditor needs to measure against. One way it to utilize the existing PCI-DSS for any issue that applies to the manufacturers’ solution. Obviously there are many sections that only apply specifically to payment applications that will need to be disregarded, but overall will provide a solid starting point.
The next step will be to submit to a full scan by an approved scanning vendor (ASV) with a product configured exactly as deployed. A proper scan will expose commonly exploited vulnerabilities which will need to be mitigated by the manufacturer.
Lastly, the manufacturer will need to fill in the gaps with methods of their choosing, to demonstrate that they have adhered to all applicable development best practices. This can extremely challenging and costly and will vary by the manufacturers client demographic.
Have the vendor pick up some of the liability if the network is found not to be secure either through a breach or audit.
Ironically, if a manufacturer has performed all of the above steps, they will have certainly exposed themselves to a certain amount of liability. After all, the audit has served to document a certain level of security built into your process and product, but should your product fail to perform as stated and even worse, become the primary entry point for a breach, all fingers will point back to the audit. If the manufacturer has provided inaccurate documentation or performance, they will most certainly be liable to some extent.
The challenge to manufacturers of course is how to best mitigate or limit the liability created by meeting these new client requirements. The most direct method of course is to simply provide secure products and programs, but this is not as easy as it seems. Most manufacturers do not currently have these processes and programs in place, and putting them in place can take years. In the case of imported products, it may be highly unlikely that foreign manufacturers will offer the required transparency into their software development practices and create the type of relationship needed to mitigate built-in security issues.
So where does this leave surveillance vendors? The answer may be “in the dark” since there is no clarity and direct solution for this issue. The largest governance our industry had been subjected to in the past was UL certification for which we had a defined process and result. PCI compliance and the mitigation of network security issues is nothing like obtaining a UL certification.
I believe vendors will take two approaches to this issue with one side deciding this is not an issue that should be dealt with by the surveillance industry. My thoughts are that if it is a client issue, it is a vendor issue and vendors who choose not to address their client’s concerns may find their product is less desirable. There is a large amount of competitive infiltration by complementary industries that do understand the governance requirements of the merchant and this may simply assist them in their marketing efforts.
On the other side we will have the manufacturers who will most certainly recognize the need to provide secure products for a variety of reasons including proprietary and confidential company information on the network. They will work toward putting the processes and procedures in place, although this may take years to accomplish primarily due to the fact it will require significant changes to the way most companies develop, sell and deploy their products. Comments?
By David Nieweg, Marketing Director, 3xLogic, Inc.
3xLogic, Inc., is a manufacturer of the Vigil line of video surveillance products and is based in Victoria, British Columbia with offices in the US and abroad.
Most Recent Industry Reports
Hikvision Darkfighter Camera Tested on Aug 31, 2015
Can Hikvision beat Axis and Samsung in pure low light? The Chinese mega-manufacturer has made a name for itself as a low-cost leader, popularizing $100 HD cameras with integrated IR. However, mos...
List of Security Manufacturer Representatives on Aug 31, 2015
Below is a list of 120+ Security Manufacturer Representative Firms. These companies partner with manufacturers to represent them in specific regions. Typically, a 'rep firm' will represent one manu...
HD Analog Four Way Cameras Tested on Aug 28, 2015
One camera that delivers AHD, HDCVI, HDTVI and 960H, all for as little as $15 a camera. Both on price and claimed support, that is pretty outstanding. And we are hearing from people all over the w...
The Prox Reader Shootout on Aug 27, 2015
In this report, we put eight readers of the popular 125 kHz contactless format head to head and see which one rises to the top. Over a third of integrators call 125 kHz 'favorite', and tens of t...
Axis WDR Zipstream Low-Cost M1125 Tested on Aug 26, 2015
Axis has been busy promoting speciality devices like IP horns and video intercoms. However, they have quietly released a new series of low-cost HD cameras with true WDR and Zipstream support, spec...
IPVM Launches Live Chat Room on Aug 24, 2015
Now you can get help or talk with colleagues any time with IPVM's new Live Chat. Chat is as old as AOL chat rooms and as hot as mega-startup Slack. Benefits of Chatting Ask a question anytime,...
SMB Market Video Surveillance Guide on Aug 20, 2015
This 13-page guide explains the key uses, design factors, and players in the small-medium business surveillance market. A global group of 90 integrators responded, each offering insigh...
The $100 Intrusion System Korner Tested on Aug 18, 2015
Multi-year contracts at $30 per month are the norm. Now a startup is offering an intrusion system for $59 up front and just ~$3 monthly. The company, Korner, has billed itself as the "Home S...
Panasonic 4K / 12MP Camera Tested on Aug 17, 2015
We bought the new Panasonic 4K / 12MP WV-SFV781L dome camera and tested it against the: Axis P1428E Bosch NBN-80122 Dahua IPC-HFW4800E In this in-depth report, we tested: ...
Testing Petzi, The Pet Cam That Shoots Treats on Aug 14, 2015
Do you love dogs? Do you love the Internet of Things? Then we have a product for you. Half camera, half remote-controlled pet treat dispenser, Petzi lets you shoot treats at your dog. That'...