Hacking Point of Sale: Payment Application Secrets, Threats, and Solutions

Conclusion

If he wrote it he could get rid of it. He had gotten rid of many things by writing them.

— Ernest Hemingway

This is the end of the book, but not the end of the story. For many payment security technologies, our time is just a beginning. So what's next? You now know that current POS systems are extremely vulnerable. You know how such vulnerabilities can be exploited, and how to prevent many such exploitations. You know that current security standards fail to help prevent exploitations. This is demonstrated by the fact that, despite huge investments in security, the number of data breaches is not declining but growing. Is there any way to stop it? Everything made by men can be broken by men. That's probably true, but at least we can try to build secure systems. Here is my opinion on what should be done.

Merchants' customer-facing environments, such as retail stores, should be freed of any obligation to implement PCI DSS controls and pass PCI DSS audits. Payment application providers should be exempted from PA-DSS validations. Instead, both merchants and software vendors should be required to implement P2PE solutions. Not just any P2PE, but Hardware P2PE. In lieu of wasting money on badly configured firewalls and useless log reviews, merchants should be investing in real, robust security technologies. Without hardware encryption, sensitive cardholder data should never touch the merchants' territory. In conjunction with EMV, tokenization, mobile payments, and other emerging ...