PCI in Practice: Payment Security in China

During the PCI Community meeting in Sydney, Australia on the 18th and 19th of November 2014, atsec (Beijing) Information Technology Co.,Ltd (hereafter “atsec China”)* invited payment security experts from China to give a presentation on the topic of “payment security in China.”

The study focused on policies, regulations and standards related to payment security and risks in China. The presentation also included the experience and methodology for how atsec China performs PCI assessment in China, and a case study regarding Air China’s experience with PCI compliance.

This document includes an abstract of the study paper to share with the industry.

* atsec China is a Joint Venture between Mr. Yan Liu, Managing Director of atsec China and atsec information security GmbH, the atsec holding in Munich Germany. atsec GmbH is the majority shareholder of atsec China.

Disclaimer

atsec China is an independent lab specializing in IT security evaluations.

The presentation was given by Yan Liu, Managing Director of atsec China Operations and Senior Consultant (atsec China), Gary Gu, Vice President (99Bill), and Tao Chen, PCI Project Manager (Air China).

The authors do not represent any Chinese government agency or Chinese government-controlled lab. All information used for this presentation is publicly available on the Internet, though most of the material is in Chinese.

The presentation consists of background, challenges, approach and summary.

Background

China’s electronic payment space is currently growing rapidly. According to recent investigation, there are about 270 non-financial payment organizations in China, and this number continues to grow. The e-payment penetration rate keeps rising, Internet retail volume is growing rapidly, and the e-payment sector remains highly concentrated. There are different payment innovation patterns with underlying risk factors (e.g. Mobile POS, Biometric technology, etc.) The payment risk profile trends include, but are not limited to: security risk around mobile payment becoming increasingly critical, surge of CNP risk hitting domestic and cross-border e-commerce, data leakage protection continuing as a challenge to the industry, and cybercrime becoming more organized and sophisticated. The security risk management focus areas include product security, data security, transaction security, and fund security.

Starting in 2008, some of the payment service providers in China considered becoming PCI compliant because of the requirements of global payment business and branding. Currently about 80% of service providers in China who are supporting payment from global card brands are already PCI compliant. In 2012, the first bank’s credit card center passed PCI compliance for their acquiring business. ICBC (Industrial and Commercial Bank of China Limited) attained PCI compliance in 2013. ICBC has one of the largest and most complex cardholder data environments (CDE).

99Bill is one of the service providers that attained PCI compliance early, in 2009. The assessment was performed by atsec China QSA lab, and PCI DSS is the first data security standard 99Bill followed. In addition, 99Bill is currently compliant with some of other national and global programs including ISO/IEC 27001, classified security protection level-3 certification issued by the Ministry of Public Security, ADSS (Account Date Security Standard) issued by China UnionPay, and the license of a non-financial organization’s payment system issued by the People’s Bank of China.

The key national security standards in China include GB 17859-1999, “Classified Criteria for Security Protection of Computer Information System” and GB/T 20271-2006, “Information Security Technology - Common Security Technology Requirements for Information Systems”. Both standards are used for classified security protection certification. The standards classify the security protection capability of Computer Information Systems into five levels: Level 1 - Discretionary Protection, Level 2 - System Audit Protection, Level 3 - Security Flag Protection, Level 4 - Structure Protection, and Level 5 - Access Verification Protection. They outline the incremental requirements for each security protection level from security functions in ten aspects including Discretionary Access Control, Mandatory Access Control, Labels, Identification, Object Reuse, Audit, Data Integrity, Covert Channel, Trusted Path, and Trusted Recovery. In addition, GB/T 18336.1-2008, GB/T 18336.2-2008, and GB/T18336.3-2008 are the Chinese translations of Common Criteria Part 1, 2 and 3.

There are quite a few surveillance and authority organizations in China, and some of them are briefly introduced in this paper. First, the People‘s Bank of China (PBC) was established on December 1, 1948. In September 1983, the State Council decided to have the PBC function as a central bank. Starting from September 2010, the PBC issued licenses for payment organizations in China after an assessment (including requirements regarding information security, but also business, performance, etc.) according to the “non-financial institutions payment service management measures” (the Chinese name is 非金融机构支付服务管理办法). The list of licensed organizations can be found at: http://www.pbc.gov.cn/publish/zhengwugongkai/3580/index.html. Under the schemas, there are a few laboratories performing the testing and two major certification bodies for certification. Payment & Clearing Association of China (PCAC) was founded on May 23, 2011, upon the approval of the State Council and the Ministry of Civil Affairs of China. Registered at the Ministry of Civil Affairs as a national non-profit organization, PCAC serves as a self-regulatory body of the payment and clearing service industry of China, and operates under the business guidance and oversight from the People’s Bank of China. On February 28, 2014, PCAC, VISA China and atsec China held a payment security conference in Beijing. The conference materials can be found at (some of the information is in Chinese): http://www.atsec.cn/cn/news--361.html

The global card brands in China facilitate collaboration with industry and build a more secure and trusted payment network in China. For example, Visa’s qualified service provider (QSP) program was started on April 1, 2013. A list of who has passed the QSP certification by VISA can be found at: http://www.visa.com.cn/merchants/riskmanagement/accountsecurity.shtml. PCI QSA validation is one of the requirements for QSP. In addition to that, VISA will perform audits with respect to the requirements related to business operation, risk management and GBPP, etc. VISA acts as an additional oversight layer to acquirer due diligence. China UnionPay issued the Account Date Security Standard (full Chinese name of the standard: 银联卡收单机构账户信息安全管理标准) initially in 2008.

Currently more and more merchants are pursuing PCI compliance, including airlines, e-commerce companies, etc. Let’s take a look at Air China’s PCI compliance as a case study. Air China is the only airline with the National Flag marking on her planes. The business handles not only the transport of international and domestic passengers and goods, but also the task of state leaders’ official visits. As of October 2014, Air China has 512 aircraft, 323 air routes, and is open to 32 countries and regions in the world. In 2014, passenger volume is up to 77.974 million. The amount of e-ticket transactions was 874 billion Chinese Yuan last year.

There are six factors driving the need to achieve PCI DSS compliance.

1. The transformation of commercialized e-business. With the development of e-business in China, Air China completed the quick transformation in ticket booking from agent selling to e-tickets.
2. The sensitive payment data or information that needs to be collected during payment.
3. The importance of reliability and data. With the ongoing growth of e-tickets, management began paying more attention to payment reliability and data security.
4. Air China conducts e-business through multiple channels.
5. With the high level of attention to information security, government regulations and industrial requirements are becoming increasingly strict.
6. Our business partners, who have already achieved PCI compliance, are requesting it. Meanwhile, Air China is required to ensure the security of payment information during transmission.

Due to the business and compliance requirements mentioned above, Air China began to cooperate with atsec China on PCI compliance officially in November 2013.

Challenges

Looking forward, there are different challenges faced by the China payment sector: new rivals (domestic and abroad), product innovation, talent, compliance, the legal system, risk management, technology, and operational efficiency.

The PCI standards family was developed globally and smoothly. Nevertheless, due to quite a few differences between regions, it would not be easy and convenient for some Chinese organizations to understand and learn the standards requirements efficiently. On the other hand, it would also be a challenge for the world outside of China to understand the payment industry, and its surveillance requirements, regulations, etc. in China. As the global brand focusing on independent security assessment and evaluation, atsec China aims to be the bridge between China and the rest of the world for the information security industry. atsec China helps Chinese organizations to understand, apply and promote international standards (such as PCI, Common Criteria, CC, and FIPS 140) while assisting experts across the world to understand China. In addition to PCI QSA, ASV, PFI and PA QSA of atsec China, globally atsec offers evaluation and testing services leading to formal certification of information security technology, including evaluations under Common Criteria schemes in the U.S., Germany, and Sweden. The atsec U.S. organization also operates a Cryptographic and Security Testing Laboratory accredited under the Cryptographic Module Validation and the Cryptographic Algorithm Validation Programs of the National Institute of Standards and Technology (NIST) in the U.S. and Communications Security Establishment Canada (CSEC) in Canada for validating cryptographic modules under the FIPS 140-2 standard. atsec China achieved the China National Accreditation Service for Conformity Assessment (CNAS) and the China Metrology Accreditation (CMA) laboratory accreditations in order to ensure that the laboratory is competent to perform testing and produce reliable data.

Let’s zoom in on Air China’s challenges encountered during the beginning of PCI compliance. There are several payment channels and these businesses are run in different systems according to the initial analysis. In addition, the cardholder data is also located in different systems, which made it necessary to segment the network. All of these factors made PCI compliance rather complicated. Therefore, the first principle is simplicity.

We noted that the key payment process is the integrated e-payment platform. It is the core of all the payment information transmission and storage. After consideration, discussion and decision, a project implementation plan was created.

Initial compliance will focus on the core platform, and then extend to other payment channels. The goal of Air China is to achieve PCI compliance on all the payment systems, and enhance overall security. Last August, Air China completed initial compliance for the core platform, and will continue the work with atsec China to complete PCI compliance for the e-business website and call center system soon.

Approach

An initial readiness assessment is always important for any security assessment or evaluation project. The scope definition and detailed gap analysis for the cardholder data environment were completed during the beginning of the project. The general project process is diagrammed in the following image.

It is also very important for the assessed entity to assign a Project Manager who understands the standard itself, and who will also push forward the implementation within the organization. Especially within large-scale organizations, communication and coordination between different internal departments (e.g. security team, system administrators, developers, and operators) are always key for success of the compliance implementation.

The PCI implementation of Air China started with data optimization. The business departments were led to recognize the confidential payment data, meanwhile helping them review business procedures regarding when sensitive data should be deleted. Practical solutions were provided, so as to achieve business sustainability and reduce conflict from the business departments to the greatest extent.

During the establishment of new technical measures and business, Air China combined the existing ISO/IEC 27001, the information security protection procedure and the technical requirements, and took advantage of current regulation and technical measures to integrate the multi-security system. PCI requirements are the foundation for improving secure data protection in Air China as a whole. In this way, an established and stable payment environment is available for compliance with various standards.

That is also atsec China’s methodology on establishing an integrated and unified management system. Payment organizations could consider using PCI standards as the baseline for data protection. In addition, national or local standards and regulations should be met. ISO/IEC 27001 could be established for high-level information security management systems, Common Criteria could be used for secure development and risk management, FIPS 140-2 could be referenced as a best practice on cryptography, and O-TTPS could be considered as the supply chain security practice to mitigate maliciously tainted and counterfeit products, and so on. Overall, the management system serves the organization’s own operation, business and culture; different standards and regulations could be compliant respectively.

Remarks and Summary

In addition to the protection of the cardholder data environment, Air China plans to use the standard requirements as a best practice to all data control and management within Air China’s IT system, not just for a certificate. According to the three-year plan for data security construction made by Air China, it will continue and extend PCI compliance, and apply the experience to wider data security construction in Air China. Combined with the PCI standard, Air China will take two steps and carry it out in five phases in order to achieve the whole data lifecycle management. As a result its business can benefit from reliable data security. A diagram explaining the plan for after Air China’s initial compliance is shown below.

In general, the values of security compliance are summarized below.

1. Meet the mandatory requirements defined by external cooperating organizations like card brands and related customers.
2. Increase confidence during business cooperation with:
1. Surveillance organizations or authority organizations;
2. Customers, partners, suppliers; and
3. Internal organizations or departments.
3. Further improve internal management and control by:
1. Improving security management, and integrating high level policy into the business process efficiently;
2. Establishing measurable methods for management and technology;
3. Enhancing the assurance of security control within the organization;
4. Enhancing the security awareness, and benefit for corporate culture; and
5. Enhancing the investment confidence.
4. Reduce costs by:
1. Reducing the cost and investment for security incidents and risks; improving processes on risk management, business continuity, and incident response;
2. Reducing the cost on the audit or assessment in other areas, like due diligence;
3. Reducing the insurance cost;
4. Clarifying the security roles and responsibility;
5. Improving competitiveness; and
6. Establishing trust and recognition globally.

Finally, the recommendations are emphasized as follows:

1. Harmonization with national standards and global standards;
2. Further industry collaboration including governments, authority agencies, standards organizations, certification bodies, and especially the card brands, banks, service providers, and merchants in the payment industry.
3. CDE Scope and implementation plans are important for the initial implementation of PCI DSS compliance.
4. A risk-based approach is suggested for security technology implementation and management.

The presentation slides “Payment security in China” during PCI SSC 2014 AP community meeting can be downloaded at:
http://www.atsec.cn/downloads/pdf/PCISSC_2014CM_PaymentSecurityInChina_20141109_v7Sub_YanLiu_atsec_Final_released.pdf

References

1. PCI SSC: https://www.pcisecuritystandards.org/
2. atsec: www.atsec.cn
3. VISA: http://www.visa.com.cn/index.shtml
4. The People’s bank of China: http://www.pbc.gov.cn/
5. MPS information classified security protection: http://www.cspec.gov.cn/web/
6. UnionPay: http://cn.unionpay.com/

They Don't Sleep at Night - Computer Imps

by Jeff Jilg

I recently saw a neat painting at the 2011 PCI Community Meeting.

The subject of the painting was computer hacking, and the rendering showed a mythical imp with pointy ears. He was bound by cuffs labeled "PCI" and was reading a book on hacking. The artist got it right, and a lot of attendees liked the painting.

Yep, the artist is right. Hackers don't sleep at night. Hackers don't have a time slot to break down computer defenses. They couldn’t care less about when or where the assets are stored. For all they know, they could be hacking into a computer in the same town, or a computer in another country.

And that's the real problem. It's tough to fight such resilient criminals. Technology has made it easy for them to have plenty of potential assets for them to prey upon. The PCI standards do a pretty good job of setting up compliance standards to help stave off the bad guys. As a consumer I feel a bit safer with credit card processing getting more scrutiny.

As many industry pundits have said, "the motivation of the hackers is directly proportional to the assets being protected". atsec supports the PCI standards and atsec is a qualified security assessor company. We like to think we are helping too.

So far I haven't seen any real computer imps. I wonder if they really have pointy ears or not…

The Call of the Conference

by Andreas Fabis

We attend conferences for a variety of reasons. First of all, atsec consultants frequently speak at IT security conferences (e.g. we are presenting four papers at the 2011 ICCC). We want to stay on top of current developments in our field of expertise. Secondly, conferences are a good way to connect with our current and future customers in a personal manner.
If you attend any of the following conferences, we would like an opportunity to talk to you about your IT security, upcoming projects, and the ways we can help you meet your IT security testing, evaluation, compliance, or training needs:

• PCI SSC Community Meeting
  September 21 - 22 2011
  Scottsdale, AZ
• ICCC 2011
  September 27 - 29 2011
  Kuala Lumpur, Malaysia
• LASCON 2011
  October 28 2011
  Austin, TX
• MILCOM 2011
  November 7 - 10 2011
  Baltimore, MD
• ACSAC 2011
  December 5 - 9 2011
  Orlando, FL
• RSA 2012
  February 27 - March 3 2012
  San Francisco, CA
• SXSW Interactive
  March 9 - 13 2012
  Austin, TX

If you can’t catch us at a conference – don’t hesitate to contact us directly.

Basic Internet Rights - Implies Security

In a recent discussion with a colleague, they mentioned their teenagers consider basic human rights to include cell phone, TV, and internet. Ah, the privileged youth of today! It is easy to see how people could start to equate their tether to electronics and the internet as intimately tied to their rights.

In the same light, one could also see how the general public would assume all internet transactions are secure. After all, such transactions are secure since they are encrypted right? It is a good thing that many web users have the general knowledge of transaction security when they see a picture of a lock on their browser, or when they see that "https" is being used for the transaction.

But the unfortunate reality is that encrypted traffic is only part of the overall security equation leading to a secure transaction. We are constantly reminded of the criminal element trying to steal credit cards and credit cardholder data. A case in point is the recent arrest of Vladislav Horohorin, arrested by French authorities through an undercover investigation by the U.S. Secret Service Horohorin was a founder of CarderPlanet, with a primary objective of sharing information on how to commit credit card fraud (theft) using the internet.

It takes determined sophistication to build a secure credit card processing application and configure it on a server so that it will function securely and accurately. Also it is easy to make mistakes since programmers and IT administrators are just human.

The Payment Card Industry (PCI) Security Standards Council has a mission to protect credit card security on the internet. One could think of their mission as protecting our internet credit card rights. It is good to see they are updating the PCI Data Security Standard (DSS) to version 2.0. The PCI DSS is currently used to assess any company which handles credit card data, and many companies have been assessed.

If only the teenagers of today could see what is happening behind the scenes to deliver their basic internet security rights to them! How else could they securely purchase the latest Taylor Swift tune, purchase flowers over the internet, or apply for their drivers license renewal online? If they could only see how life was before the internet....

Jeff Jilg Ph.D.

PCI announce hilights of V2.0 of PCI Co standards

The PCI Security Standards Council have recently announced the highlights of the proposed version 2.0 of the PCI DSS and the PA DSS. Here is a link to their press release.

The press release gives some pointers about what to expect from the new versions. A supplementary document available here gives more details.

Update for "Payment Card Industry Compliance for Large Computing Systems" white paper

An updated version of our white paper titled "Payment Card Industry Compliance for Large Computing Systems" is available on our website.

atsec presents an analysis of the PCI standards in the context of a LCS environment and provides focused guidance to QSAs and their customers on the PCI assessment of such environments and the resources available to support an assessment. Drawing from an extensive knowledge of mainframe and LCS security, coupled with experience as an accredited QSA company, this report provides the necessary insight into LCS security to QSA and other PCI professionals.

For version 1.1.2 of the document a discussion of two-factor authentication has been added.

- Andreas Fabis

Payment Card Industry Compliance for Large Computing Systems: Applying PCI Compliance Standards to Mainframe Environments

Attendees at RSA and Share conferences in March may be interested in a new report from atsec targeted at those working with PCI compliance in Large Computer System environments.

"Payment Card Industry Compliance for Large Computing Systems: Applying PCI Compliance Standards to Mainframe Environments."

Abstract:
Payment Card Industry Compliance for Large Computing Systems, by atsec in association with IBM and other leading Large Computing Systems (LCS) experts, is a report aimed at addressing the need for guidance and information by Qualified Security Assessors (QSA), merchants, and service providers whose card holder data environment is largely based on LCS technology. It may also be of interest to acquirers and card brands demanding compliance with the standards.
Achieving and assessing Payment Card Industry (PCI) compliance in a LCS environment is a challenge as the standards are more focused towards a distributed systems paradigm. A full understanding of the security features and advantages of the complex environment can provide assurance of conformance to the standard but is a very broad and detailed topic.

Drawing from an extensive knowledge of mainframe and LCS security coupled with experience as an accredited QSA company, atsec’s consultants have gained a thorough understanding of the security of these systems at every level, including operating systems, virtualization technology, applications, networking and communication, and mainframe environments. This experience has been gained through Common Criteria evaluation for the US and Europe governments, cryptographic testing and analysis, and mainframe penetration testing for large financial customers on the following systems and applications:

• z/OS
• z/VM
• PR/SM
• System SSL
• DB2
• Oracle
• Multiple Tivoli and third party vendor applications

atsec presents an analysis of the PCI standards in the context of a LCS environment and provides focused guidance to QSA and their customers on the PCI assessment of such environments and the resources available to support an assessment. Drawing from an extensive knowledge of mainframe and LCS security, coupled with experience as an accredited QSA company, this report provides the necessary insight into LCS security to QSA and other PCI professionals.