The Impact of PCI Compliance on DVR and NVRsAuthor: Dave Nieweg, Published on Aug 01, 2008
Surveillance vendors who sell to retail merchants have undoubtedly heard about PCI compliance, but may not understand exactly what it is and how it impacts the security industry. My company, 3xLogic, recently successfully completed a comprehensive PCI compliance audit for our DVR/NVRs. This report shares what we learned and how we achieved this. For more information on how PCI compliance may affect retailers, see our whitepaper on PCI compliance.
At first glance, PCI compliance appears to be an issue between the payment card companies such as VISA and the merchants who accept credit cards. However, as merchants are being required to comply, they are passing some of the impact down to the vendors whose systems sit on their network.
What the merchants aren’t saying is what they want the surveillance vendors to specifically do. We often hear, “We need your system to be PCI compliant before we can put it on the network”, but offer little assistance in defining exactly what PCI compliance means for the surveillance vendor.
In fact, a visit to the PCI Council’s website does little more than to confuse the issue further since it primarily deals with the responsibilities of software companies who provide payment applications and the merchants who accept credit cards. Any attempt to find information about non-payment systems leaves one with a very unclear understanding of a course of action.
WHAT IS PCI?
Simply put, the Payment Card Industry – Data Security Standards (PCI-DSS) is one of a set of requirements designed to help safeguard credit card data from being stolen through network breaches and ineffective IT security practices. Recent high-profile cases including TJX and Hannaford have served to highlight the need for merchants to take some measure of responsibility in protecting cardholder data.
Originally most card providers such as Visa and MasterCard had established their own proprietary rules regarding the handling of credit card data by merchants. Concern and confusion by the merchants over varying and overlapping requirements by the rival card companies prompted the card issuers to create an independent organization and standard for protecting credit card data. This entity is known as the PCI Security Council and while there are actually several standards, the most applicable to our industry is the PCI-DSS.
The PCI-DSS provides a variety of actions that must be taken by both payment software vendors (such as POS applications that handle credit cards) and the merchant themselves in how they configure and protect the network that the payment systems are connected to. The main issue is that any device or application that sits on the merchants’ network could in effect be a potential entry point into the protected network and lead to a compromise of cardholder data.
It is this need to secure the merchants entire network as well as the devices and software attached to the network that creates the demand for video surveillance vendors to meet PCI requirements, or more specifically, to provide solutions which are secure enough that they do not compromise the merchants network security plan.
So how does a video surveillance vendor (or any other manufacturer for that matter) comply with this request to become PCI compliant?
Be aware that there is no process or standard offered by the PCI Council which allows a non-payment application or network equipment provider to become certified as being PCI compliant. It simply does not exist. Yet, we have merchants who think that they are doing the right thing by asking their vendors to get PCI certification, an impossible task. The answer is in both the details of what we are trying to accomplish and using the proper words when discussing PCI requirements.
What the merchant really wants is to:
1. Build and maintain a secure network
2. Ensure than any solution added to the network does not introduce an insecurity
3. Ensure that added solutions do not break their PCI compliance efforts
4. Have the solution vendor give them some form of validation that the solution is secure, can be maintained in a secure manner, and adheres to industry best practices and standards
5. Have the vendor pick up some of the liability if the network is found not to be secure either through a breach or audit.
So let’s cover each of those five bullets briefly to further understand the impact to surveillance vendors.
The merchant needs to build and maintain a secure network
This should be a basic requirement any vendor seeks to achieve yet the truth is that while the security industry as a whole may be great at physical security, we historically lack the required skill set when it comes to network security. But let’s face it, our solutions are now on the network and therefore we need to learn how to provide secure solutions.
Ensure than any solution added to the network does not introduce an insecurity
There are two issues here that impact surveillance vendors.
This first is the inherent or built-in security that the solution has as it leaves the manufacturers back door. Many solutions being shipped today utilize highly vulnerable technologies such as web applications, non-secured operating systems and may even have a wide variety of exploitable technologies built into the product.
Manufacturers first need to understand the most current threats and then need to evaluate and adapt their architectural design to provide maximum inherent security.
One method to accomplish this is by having a valid and effective Software Development Lifecycle (SDLC) program in place which adheres to industry best practices, meets secure software development standards and has security activities and awareness built-in throughout the process.
The second way that network insecurity can be introduced into the merchants’ network is in how the product is deployed, configured and maintained. Many vendors feel that at this point it is out of their hands, but new pressures on the merchant from the PCI requirements are causing them to push back at the manufacturer.
Simply put, without the manufacturer’s assistance, training and documentation, the merchant and their IT teams have little idea what security issues or potential exploits await your product. They best they can do is to bolt on after the fact security in an effort to isolate the product from the network. The issue is further compounded by the fact that many manufacturers provide solutions which the IT staff cannot maintain the same way that they maintain their other network resources. For these reasons it will become increasingly valuable for manufacturers to develop programs which will assist the merchants in securely deploying and maintaining their products.
Ensure that added solutions do not break their (the merchants) PCI compliance efforts
Merchants are hard at work to meet the requirement of the PCI-DSS and other standards. If manufacturers of products do not fully understand the requirements that need to be met, they may provide a configuration, which although secure, may in fact conflict with the PCI-DSS and therefore render the merchants efforts useless.
By fully understanding the merchants needs, more specifically the governance requirements that the IT staff is trying to meet, the merchant will be more likely to trust that the manufacturer has provided a solution that will enhance and not break their compliance efforts.
Have the solution vendor give them some form of validation that the solution is secure, can be maintained in a secure manner, and adheres to industry best practices and standards
Trust is a great thing and manufacturers who have earned their clients trust are in an enviable position, but today, merchants need more. They need authentic validation that what you say about the security of your product is not only true, but that it can be demonstrated to the entities that they have to answer to. Specifically, these are the auditors and the card companies that are enforcing the PCI standards. Merchants are no longer being taken at their word, and they will no longer take you at yours.
There may be several ways to demonstrate your security and compliance with the standards, but the best by far is to engage in the same type of audit that your clients are subject to which is performed by a certified CISP-compliant auditing firm. You won’t get a certification, but you can ask for a Letter of Conformance, meaning that your processes and products were found by the auditor to comply with the PCI requirements.
The results of the audit give the merchant something they can point to in the event an auditor questions the security or configuration of your product on the network. It may not remove 100% of the concern and there may in fact be further action required by the manufacturer, but it provides the auditor and the merchant with a documented understanding of the actions you took as a manufacturer.
Admittedly, the primary problem faced by manufacturers when seeking out an audit, is exactly what standard the auditor needs to measure against. One way it to utilize the existing PCI-DSS for any issue that applies to the manufacturers’ solution. Obviously there are many sections that only apply specifically to payment applications that will need to be disregarded, but overall will provide a solid starting point.
The next step will be to submit to a full scan by an approved scanning vendor (ASV) with a product configured exactly as deployed. A proper scan will expose commonly exploited vulnerabilities which will need to be mitigated by the manufacturer.
Lastly, the manufacturer will need to fill in the gaps with methods of their choosing, to demonstrate that they have adhered to all applicable development best practices. This can extremely challenging and costly and will vary by the manufacturers client demographic.
Have the vendor pick up some of the liability if the network is found not to be secure either through a breach or audit.
Ironically, if a manufacturer has performed all of the above steps, they will have certainly exposed themselves to a certain amount of liability. After all, the audit has served to document a certain level of security built into your process and product, but should your product fail to perform as stated and even worse, become the primary entry point for a breach, all fingers will point back to the audit. If the manufacturer has provided inaccurate documentation or performance, they will most certainly be liable to some extent.
The challenge to manufacturers of course is how to best mitigate or limit the liability created by meeting these new client requirements. The most direct method of course is to simply provide secure products and programs, but this is not as easy as it seems. Most manufacturers do not currently have these processes and programs in place, and putting them in place can take years. In the case of imported products, it may be highly unlikely that foreign manufacturers will offer the required transparency into their software development practices and create the type of relationship needed to mitigate built-in security issues.
So where does this leave surveillance vendors? The answer may be “in the dark” since there is no clarity and direct solution for this issue. The largest governance our industry had been subjected to in the past was UL certification for which we had a defined process and result. PCI compliance and the mitigation of network security issues is nothing like obtaining a UL certification.
I believe vendors will take two approaches to this issue with one side deciding this is not an issue that should be dealt with by the surveillance industry. My thoughts are that if it is a client issue, it is a vendor issue and vendors who choose not to address their client’s concerns may find their product is less desirable. There is a large amount of competitive infiltration by complementary industries that do understand the governance requirements of the merchant and this may simply assist them in their marketing efforts.
On the other side we will have the manufacturers who will most certainly recognize the need to provide secure products for a variety of reasons including proprietary and confidential company information on the network. They will work toward putting the processes and procedures in place, although this may take years to accomplish primarily due to the fact it will require significant changes to the way most companies develop, sell and deploy their products. Comments?
By David Nieweg, Marketing Director, 3xLogic, Inc.
3xLogic, Inc., is a manufacturer of the Vigil line of video surveillance products and is based in Victoria, British Columbia with offices in the US and abroad.
Other Reports on Retail
Security As A Profit Center: Extorting Shoplifters? on Mar 10, 2015
If you can't beat 'em, join em. Many lament that security is a cost center. Now, a tech startup ...
Retail Surveillance Bandwidth Solution? on May 20, 2014
Watching video surveillance from retail stores remotely is both essential and problematic. Bandw...
The Spinning Camera Mount Reviewed on Sep 06, 2013
It is often said that necessity is the mother of invention. Not long ago, Canadian integrator Lan...
Smart Small Public View Monitor on Aug 01, 2013
Putting surveillance in the face of thieves. That's the aim of a new Public View Monitor (PVM). W...
Sued For Not Having Enough Surveillance on Apr 05, 2013
When someone is attacked on private property, how responsible is the venue? In past US cases, dec...
Illegal Retail Surveillance on Jan 15, 2013
Canada's national public broadcaster has a critical report on widespread illegal video surveillan...
7 New Retail Security / Surveillance Products on Jul 23, 2012
A number of promising new retail security and surveillance products are available. In this note, ...
Retail Webinar Recorded on Jun 28, 2012
Over 60 Members joined us live for a webinar on "What's New in Retail" where we discussed sweethe...
Best and Worst in Retail Surveillance - NRF 2012 on Jun 24, 2012
Perhaps the biggest and most important conference in retail security just concluded last week. IP...
How Far Can Security Go to Stop Shoplifters? on Jun 27, 2010
Can stores post images of suspected shoplifters on their store walls and demand significant fines...
Most Recent Industry Reports
Axis Is In Denial About HD Analog on Feb 08, 2016
For more than a decade, Axis' #1 argument against analog has been no HD. This, of course, is no...
Surveillance Commissioning / Install Checklist on Feb 08, 2016
This 60+ point checklist helps end users, integrators and consultants verify that installation is...
Favorite Camera Manufacturers 2016 on Feb 08, 2016
The market has changed significantly since 2014, where our previous Favorite Camera Manufacturer ...
Mega Chinese Electronics Manufactuer Xiaomi Yi Camera Tested on Feb 05, 2016
Xiaomi's revenue is 4 to 5 times larger than Hikvision's. Only in business for 5 years, Xiaomi ha...
Trade Mag Admits 84% Prefer Online Over Print on Feb 05, 2016
Some say the industry is so old and conservative that print is still important. Well, even a pri...
Hikvision Video Analytics Tested on Feb 04, 2016
We tested Hikvision's video analytics on six Hikvision models, ranging from entry level to high e...
Last Chance - IP Networking Course on Feb 04, 2016
Our most popular course starts next week (February 9th), with all new training of network securit...
Add Your Preferred Camera Manufacturer to the Calculator on Feb 03, 2016
One of the most popular features of our Camera Calculator is choosing specific models. Indeed, me...
Axis vs Avigilon vs FLIR vs Hikvision vs Samsung Camera Pricing on Feb 03, 2016
The 'race to the bottom' is a big issue, with average prices dropping sharply over the past few y...
Network Security for IP Video Surveillance Guide 2016 on Feb 03, 2016
Keeping surveillance networks secure can be a daunting task, but there are several methods that c...