Will Your Payment Processing Break Due To Mandatory Security Update? – 2017 Deadline Approaching for TLS 1.2 Requirement
The PCI Security Council has mandated that online merchants who accept credit cards must upgrade from the older SSL and early TLS security protocols, to the newer TLS 1.2 protocol. The required implementation dates to remain in compliance have changed multiple times, causing merchant confusion. To further this confusion, individual gateways and processors have their own implementation timelines for TLS 1.2 support.
Due to recent high profile attacks, some vendors have decided to expedite the transition to TLS 1.2 and completely end support of the older, less secure protocols. This was primarily done because of the known risks of the older security protocols and the PCI Security Council’s assessment of the risk to merchants. The PCI Security Council has stated, “The vulnerabilities within SSL and early TLS are serious and left unaddressed put organizations at risk of being breached.” Because of these known risks, payment technology vendors have become more aggressive in their implementation timeframes and are in the process of deprecating the older protocols beginning in 2017.
One such company is PayPal. PayPal just recently turned off support of the older protocol for test environments and will completely stop supporting the older protocols by June 30, 2017. FOR MERCHANTS USING A PAYPAL PAYMENT GATEWAY WHO HAVE NOT UPGRADED THEIR SYSTEMS TO SUPPORT TLS 1.2, CREDIT CARD PROCESSING SERVICES WILL NO LONGER WORK AFTER THAT DATE.
Dates to know:
- PCI Security Council original date of TLS 1.2 compliance was 2016
- PCI Security Council new date of TLS 1.2 compliance is June, 2018
- PayPal testing environment ended support of older protocols on February 15, 2017
- PayPal production environment ends support of older protocols on June 30, 2017
How do you ensure you will be able to accept credit card payments after the June 30, 2017 deadline? The first thing merchants should do is contact their systems providers to determine all of the payment gateway connections their solution employs. Merchants should then verify that their solution has been upgraded to support the TLS 1.2 protocol. This often times reveals a spider web of connections. Many solution providers support a variety of gateways to reach a particular processing platform.
In the example of PayPal, merchants may be unaware that their payment acceptance solution could utilize technology from PayPal even if they do not accept PayPal as a form of payment. PayPal Holdings, Inc. has acquired various payment technologies and companies (i.e. PayFlow Pro, BrainTree, Venmo, etc.) that many payment solutions employ in the background. If a merchant’s solution utilizes a PayPal gateway and hasn’t been upgraded to support TLS 1.2, it will stop functioning after the June 30, 2017 date.
To avoid credit card acceptance interruption and protect yourself against malicious attacks, you should:
- Upgrade your systems to support the latest security protocol TLS 1.2
- Start your upgrade process today. System upgrades take time and a backlog is already forming with many vendors. This will result in many merchants unable to accept credit card payments after June 30, 2017
- Nodus customers should contact Nodus Support to discuss their upgrade options and ensure that the software versions they are using support TLS 1.2
- Migrating from SSL & Early TLS webinar by PCI Security Standards Council
- Date Change for Migrating from SSL and Early TLS
- PayPal TLS 1.2 and HTTP/1.1 Upgrade Microsite
- Nodus TLS 1.2 Security Update
Chester Ritchie is the President of Nodus Technologies (http://www.nodus.com). Nodus is a certified Microsoft Gold Level Partner for payment software within the Microsoft Dynamics family of accounting systems. Nodus products allow users of Great Plains (GP), Solomon (SL), and AX to accept electronic payments inside of the accounting system. Accounting entries related to payments are automated and cash flow is increased.
The holidays are approaching which means a time for cheer and presents—which means more money is being spent—which means more credit card fraud. With millions of card numbers already stolen this year, it is only a matter of course that much more will be stolen with the increased shopping of the holiday season.
Hackers who work on the good side of the law, investigating security breaches, have found even their own stolen information many times. In fact, Bryan Sartin of Verizon’s forensic computer tech team remembers finding a desk mate’s credit card information in two out of three cases, and when it wasn’t there, found his wife’s! With this amount of fraud going on, it’s unnerving to think that some merchants are not implementing any improved practices that will help secure their customers information during this holiday season. The last thing anyone wants is to deal with is credit card fraud when they could be spending quality time with family and friends.
A reason Sartin mentions about why the U.S. is so prone to credit card data security breaches is the way they are being processed. Credit card information goes through multiple systems, flying through the internet, and continues to travel to complete the transaction even after returning an accepted or declined message.
Mallory Duncan, general counsel at the National Retail Federation, proposes tokenization as a potential solution. With tokenization, the card information is taken to the gateway, and a token is returned. This token has no credit card data behind it—so even if it is stolen, it would be meaningless to the hacker.
Nodus provides the option of tokenization with all its products. Our solutions are PCI PA-DSS certified and we are always improving our solutions to help your business become more secure. Improve your processes to keep your customers’ credit card data safe during this holiday season and let the holidays get back to meaning joy and comfort.
To learn more about tokenization and securing your payment processing systems, schedule a free demo with us today at http://www.nodus.com/schedule_demo.html
Source: npr: National Public Radio
Electronic payment processing has become an integral part of most business models because of its increasing popularity among the customers. The boom in the online retail arena has made it essential for almost all business organizations to opt for online payment processing services. The most significant advantage, which electronic payment holds over the traditional mode of payment is the enormous increase in the level of convenience to both the buyer and the seller. It has made it possible for people to buy anything online and pay over the internet without having to step out of their home or office. Almost all the leading online retailers use extremely secure electronic payment processing
services, which have advanced encryption technology for protecting the payers from fraudulence.
Now, people living in remote regions can also buy almost anything from the online retailers and pay through the internet. The electronic payments have also helped the retailers in cutting down on the cost of bill management and payment which ultimately cut down on the overall costs. Easily process credit and debit cards online, swipe cards for in-person transactions, convert paper checks to electronic bank deposits and stay connected to your website’s shopping cart. With our virtual terminal you can provide recurring billing to your customers, print and send customizable receipts and have 24-7 access to free reporting. However, both the buyers and the sellers need to remain ever watchful about the various malicious practices such as credit card frauds to avoid these risks. Thus, maintaining a little care can help both online shoppers and retailers to benefit from the various advantages of electronic payments.
Credit card processing solutions have become an integral part of most business concerns. However, with a large number of such services available in the market, it can become a bit tricky to find the right one that will justify its hiring. Therefore, companies need to ponder over several factors, which will help them in finding just the right credit card processing solution for their business. Companies first need to find out about the average approval rating of any credit card processing service. This must include the percentage of approved applicants against the total number of applicants and the average speed of processing. An effective credit card processing service will enable a maximum number of approvals at minimum processing time and without charging any additional fees. Apart from the processing time and efficiency, the cost of availing the service every month is going to be an important determinant. A low monthly charge will help in bringing down the overhead costs considerably.
The initial cost need to be affordable, as well. It should not cost too much to open any new merchant account or payment getaway. The efficiency in setting up a new business account is important in determining which credit card processing service to opt for. Accessible and prompt customer service should be available while hiring any credit card processing service because it is an important aspect of boosting customer satisfaction. The customer service needs to be prompt and provide useful information. The number of internet-based features such as providing more than one type of virtual terminals needs to be a part of the deciding factors. The credit card processing service comes helpful in providing customers with greater flexibility and options regarding payment. Thus, it is possible to choose the right credit card processing service to maximize any business. Keeping these factors in mind can help business concerns in selecting the right one for them.