Hotel PCI Compliance Guide

The Payment Card Industry Data Security Standard (PCI DSS) is a detailed set of regulations for businesses managing payment card data to follow. It was established by the Payment Card Industry Security Standards Council (PCI SSC), an alliance of the five major credit card companies: Visa, MasterCard, American Express, Discover, and JCB. The guidelines ensure that a minimum set of security requirements are met in order to protect cardholder data and accommodate emerging payment methods.

If your hotel accepts, stores, processes, or transmits cardholder data – regardless of transaction amount and volume – then you’re expected to comply with PCI DSS.

Fraudsters looking for easy points of entry find hotels to be particularly vulnerable and therefore easy targets, increasing the number of attacks occurring in the hospitality industry.

The five common areas hotels are vulnerable to attacks are:

• Corporate/Internal Network
• eCommerce
• Point-of-Sale
• Physical Attacks
• Interconnected Systems

When a security breach occurs, you:

• Become liable to lawsuits by your guests
• Risk your reputation
• Can lose guest loyalty and business
• Suffer fees from the PCI SSC

Penalties for non-compliant hotels can be anywhere in the range from $5,000 to $100,000 per month.

Your guests need to feel that their credit card information is safe with your hotel. One way you can put your guests at ease is by letting them know that you’re PCI compliant. It should be immediately obvious that you’re compliant whether a guest is on your website or at your front desk. Something as simple as including a verification seal at the front desk or online when a guest makes a reservation goes a long way to ensuring your guest’s trust.

When a breach occurs, it can take a business an extended period of time to detect and resolve it, during which the affected data records remain exposed. According to a report by Trustwave, a data breach, from the day of the initial intrusion to the day the breach is contained, can be broken down into three categories:

• Intrusion: the date the hacker gained unauthorized access to the victim’s systems.
• Detection: the date when the victim or another party identifies a breach occurred.
• Containment: the date when the hacker no longer has access to the victim’s systems and the records are no longer exposed.

Overall, it takes an average of 46 days to resolve a cyberattack and costs a total of $973,130. For a mega breach (breaches of more than 1 million records), the average time to detect and resolve the breach is 365 days.

Multifactor authentication is one of the simplest and most effective methods to defend against breaches. Companies should make sure this is something they are implementing in their everyday business processes.

PCI Compliance

PCI compliance is a set of requirements that serve as guidelines for businesses to operate safely while managing customer data, and has become the standard for accepting, storing, processing, and transmitting credit cards. Compliance is achieved by consistently adhering to the requirements set by the PCI SSC. While PCI compliance is not legally mandated, and therefore businesses who fail to become compliant won’t face criminal charges, if a breach occurs and you're not compliant, you could face steep fines and other fallout.

PCI compliance is achieved by completing a self-assessment questionnaire that states that your company is following all the necessary guidelines and that the proper requirements are being met. Typically, attaining compliance takes less than a month; however, maintaining PCI compliance involves the development and daily maintenance of cardholder data protection policies and procedures.

PCI compliance is a necessity when it comes to keeping your customers’ data safe from hackers and fraudsters. When you’re PCI compliant, your customers know that you have taken the steps to help protect their data.

Core requirements for PCI compliance includes the following:

• Build and maintain a secure network and systems
• Protect cardholder data
• Maintain a vulnerability management program
• Implement strong access control measures
• Regularly monitor and test networks
• Maintain an information security policy
  
  

PCI Certification

PCI certification refers to the comprehensive process by which a full-scale audit of a company is conducted to ensure the business is in fact following the proper procedures to protect data. The assessment is much the same as the one conducted in the self-assessment; however, to reach PCI certification, the audit must be performed by a third-party, trusted qualified security assessor (QSA). The QSA will review and validate all aspects of your business that touch cardholder data.

Achieving PCI certification is an intensive process, lasting up to six months and examining and authenticating hundreds of aspects of a business, including:

• How the software was developed
• How the developers are trained
• Technical and procedure controls

Ensuring you're not only PCI compliant but also PCI certified adds an extra layer of trust for your customers. The investment shows not only your dedication and commitment to protecting your customers but how much you value them and appreciate their trust in your company.

1) Install and maintain a firewall configuration to protect cardholder data. Properly configure a firewall to restrict incoming and outgoing network traffic through rules and criteria configured by your organization.

2) Do not use vendor-supplied defaults for system passwords and other security parameters. Use unique settings since default settings are simple to guess and may even be published online.

3) Protect stored cardholder data. Ensure all card data is either encrypted using industry-accepted algorithms, truncated, tokenized, or hashed.

4) Encrypt transmission of cardholder data across open, public networks. Always know where card data is sent from and where card data will be received.

5) Use and regularly update anti-virus software or programs. Ensure all systems and devices that staff may use to access the system, both locally and remotely, have an anti-virus software installed on them.

6) Develop and maintain secure systems and applications. Deploy critical patches in a timely manner.

7) Restrict access to cardholder data on a need-to-know basis. Implement the ability to allow or deny access to cardholder data systems.

8) Assign a unique ID to each person with computer access. Do not use shared or group usernames and passwords.

9) Restrict physical access to cardholder data. Implement video cameras and electronic access to monitor entry and exit doors of physical locations, such as a data center.

10) Track and monitor all access to network resources and cardholder data. Ensure all the systems have correct audit policy set and send the logs to centralized syslog server. These logs must be reviewed at least daily to look for anomalies and suspicious activity.

11) Regularly test security systems and processes. Test regularly to ensure security is maintained.

12) Maintain a policy that addresses information security for all personnel. Implement and maintain an information security policy for staff and other relevant parties. Ensure users read and acknowledge the policy yearly.

Cybersecurity laws are continuously changing to accommodate the evolving landscape of hotel technology and cybercriminal activity. However, the laws can only react and keep up, not predict and proactively defend. Hoteliers need to rely on their own skills and team members to remain protected and safe.

If you aren’t yet PCI compliant, you can use our checklist to get started. Here are some tips to keep in mind:

1. Perform a formal risk assessment and determine what weaknesses your hotel may have.
2. Review what resources you already have available and look for outside solutions that can provide better security for your hotel.
3. Reduce the risk of a breach by implementing a security awareness training program for your employees on the importance of data security and PCI compliance.
4. Know which individuals in your business have access to critical systems and keep access limited to a trusted few using the principle of least privilege.
5. Create a cyber incident response plan and make sure your employees are aware of what to do in various situations and respond as efficiently as possible.
6. Implement the necessary security systems and test them frequently to ensure effectiveness against a multitude of attacks, and consider implementing monitoring systems to alert you of potential breaches.
7. Install security patches on all applicable systems within a month of release to prevent breaches.
8. Regularly review your PCI compliance status and make sure your validation is still current.
9. Run periodic penetration tests and vulnerability scans to detect weaknesses and exploits in your critical systems.
10. Remediate all weaknesses and exploits found in the penetration tests and vulnerability scans and double down on securing your infrastructure.

If you haven’t already, work toward implementing EMV chip readers at your property. EMV (Europay, Mastercard, and Visa) is a global standard for cards equipped with computer chip technology, as well as the terminals used to authenticate chip card transactions.

EMV chip readers are better suited at preventing criminals from using “skimmers” to replicate cardholder data and create false credit cards. Skimmers can be installed easily over existing payment terminals and are used to collect information from the cards used in transactions.  With advances in technology, many skimmers are now Bluetooth enabled and can transmit data without the need to physically extract the information from the device.

To combat this, anyone who works with physical card readers must be trained on what to look for and how to detect a skimmer that’s been installed over the terminal. Additionally, it’s easier to collect data from swipe cards than the more secure chip card, since the magnetic strip on swipe cards holds all the information for the cardholder, including the PAN, name, address, and CVV, and is easily stolen by criminals using a skimmer.

Beginning in 2015, there was a liability shift and merchants who haven’t switched to a chip cards are now liable for fraudulent card use. Previously, the issuing bank was liable.

The shift has had a huge impact (as reported by Visa):

• Counterfeit fraud has dropped by 76% for merchants who completed the chip upgrade.
• Over 2.9 million merchants now accept chip cards, representing 63% of US storefronts.
• In March 2018, 97% of card-present Visa transactions involved EMV cards

However, this doesn’t prevent card-not-present (CNP) fraud. In fact, there has been an increase in CNP because criminals are shifting away from physical transactions due to EMV terminals, and because online systems have no way to tell if it’s a stripe or chip card. To protect yourself against CNP fraud, implement

Merchants like the check-out process to be as seamless as possible, often prioritizing this over data security. This is especially true of the hospitality industry where the guest experience is the highest priority. Many choose not to perform many or any validations at check-out and will take the risk of fraud over the risk of losing a guest.

The EMV liability shift doesn’t protect you from card-not-present (CNP) fraud. However, 3-D Secure (3DS) can.

3DS is a newer security standard you can adopt to secure online payment transactions and reduce the risk of unauthorized charges. The best part: most cardholders are automatically enrolled for 3DS by their card issuer, so taking advantage of 3DS is easy for merchants. 

3DS adds a layer of protection to a payment transaction by requiring cardholders to authenticate their identity before the transaction can be completed. It protects merchants like you, too. That’s because 3DS shifts payment liability back to the card issuer – so if fraudulent chargebacks occur, they’re responsible for mitigating the problem. This is a valuable tradeoff for implementing payment authentication. Chargebacks result in lost revenue and lost time, so fewer chargebacks means spending more time closing business and taking better care of your customers. Plus, you’ll avoid potential chargeback fees.

Aside from increasing revenue, the implementation of a payment authentication step shows that you care about protecting your customers and their information. As e-commerce activity inevitably increases, it’s important to implement the strongest security measures possible, including authentication measures, so your customers find you reliable and trusting.

Local payment methods offer significant improvements in security since the merchant never sees the card information, just a token. Therefore, liability for the merchant is effectively removed.

Not only does this improve your security; it can make your guest's check-in process more convenient. Giving guests the freedom to pay how they want is more important than ever, and something they’ll expect as apps and features, such as PayPal and Apple Pay, become an everyday integration into people’s lives.

Here are some local payment methods to keep in mind:

• Americas: Bancario, Santander, Citibanamex, Apple Pay, Google Pay, PayPal
• Europe & Middle East: Giropay, SEPA, Sofort/Klarna, Paysafecard, IDEAL
• Asia/APAC: WeChat Pay, Alipay, China, UnionPay

It’s important to note that technology is constantly evolving, and as new innovations emerge, the security of these developments should be carefully considered before implementing them in your hotel.