Netprospex has produced an interesting graphic ranking the top companies leveraging social media in business.
Here's a sneak peak -
Friday, August 12, 2011
PCI SSC Issues Tokeninzation Guidelines
The Payment Card Industry Security Standards Council has issued guidelines for tokenization of credit card data in card-not-present transaction processing which confirm that a retailer can be "out of scope" if tokens are implemented properly.
To keep the merchant out of scope, the tokenization process must not be "reversed" for any reason, such as processing chargebacks or refunds, updating a credit card expiration date, or for marketing or analysis purposes, loyalty program management, and so on.
The report summarizes characteristics of a tokenization system that meets PCI DSS requirements as follows:
1. The tokenization system does not provide PAN [Primary Account Number] in any response to any application, system, network, or user outside of the merchant’s defined CDE [Card Data Environment]. All tokenization components are located on secure internal networks that are isolated from any untrusted and out-of-scope networks.
3. Only trusted communications are permitted in and out of the tokenization system environment.
4. The tokenization solution enforces strong cryptography and security protocols to safeguard cardholder data when stored and during transmission over open, public networks.
5. The tokenization solution implements strong access controls and authentication measures in accordance with PCI DSS Requirements 7 and 8.
6. The tokenization system components are designed to strict configuration standards and are protected from vulnerabilities.
7. The tokenization solution supports a mechanism for secure deletion of cardholder data as required by a data-retention policy.
8. The tokenization solution implements logging, monitoring, and alerting as appropriate to identify any suspicious activity and initiate response procedures.
To keep the merchant out of scope, the tokenization process must not be "reversed" for any reason, such as processing chargebacks or refunds, updating a credit card expiration date, or for marketing or analysis purposes, loyalty program management, and so on.
| Data Tokenization Flowchart |
1. The tokenization system does not provide PAN [Primary Account Number] in any response to any application, system, network, or user outside of the merchant’s defined CDE [Card Data Environment]. All tokenization components are located on secure internal networks that are isolated from any untrusted and out-of-scope networks.
3. Only trusted communications are permitted in and out of the tokenization system environment.
4. The tokenization solution enforces strong cryptography and security protocols to safeguard cardholder data when stored and during transmission over open, public networks.
5. The tokenization solution implements strong access controls and authentication measures in accordance with PCI DSS Requirements 7 and 8.
6. The tokenization system components are designed to strict configuration standards and are protected from vulnerabilities.
7. The tokenization solution supports a mechanism for secure deletion of cardholder data as required by a data-retention policy.
8. The tokenization solution implements logging, monitoring, and alerting as appropriate to identify any suspicious activity and initiate response procedures.
The Council points out that "An important consideration when evaluating a tokenization solution is whether the token itself can be used in lieu of cardholder data to perform a transaction. Tokens that can be used as payment instruments (sometimes called "high-value tokens") could potentially be monetized or used to generate fraudulent transactions, and may therefore have the same value to an attacker as the data they are intended to replace. Tokenization solutions which support these types of tokens should have additional controls in place to detect and prevent attempted fraudulent activities. Additionally, tokens that can be used to initiate a transaction might be in scope for PCI DSS, even if they cannot directly be used to retrieve PAN or other cardholder data; merchants should therefore consult with their acquirer and/or the Payment Brands directly to determine specific requirements for tokens that can be used as payment instruments."
Labels:
Data Security,
PCI-compliance,
Tokenization
Wednesday, August 10, 2011
VISA to Waive PCI Testing With Chip&Pin Terminals
Network World - VISA today announced plans that will let qualifying merchants in the US eliminate annual validation of their PCI compliance if they are using point-of-sale (POS) terminals that support the chip-based EMV payment-processing technology (instead of magnetic-stripe cards) as well as support the wireless standard called Near Field Communication (NFC) for mobile payments.
VISA says its incentive program will help prepare the nation's payment infrastructure for the arrival of NFC-based mobile payments by building the necessary infrastructure to accept and process chip transactions that support a PIN at point of sale.
For more information, see VISA's Information Bulletin.
VISA says its incentive program will help prepare the nation's payment infrastructure for the arrival of NFC-based mobile payments by building the necessary infrastructure to accept and process chip transactions that support a PIN at point of sale.
For more information, see VISA's Information Bulletin.
Labels:
Payment Processing,
PCI-compliance
Transair Implements Elucid
Sanderson, a publicly-owned supplier of multi-channel retail software solutions, has recently implemented their Elucid solution at Transair, the largest and most respected supplier of pilot flight equipment and aviation accessories in Europe.
Transair manages a successful mailorder operation, a rapidly expanding eCommerce channel, a wholesale distribution division, and four retail stores at Shoreham Airport, Gloucestershire Airport, Wycombe Air Park and Cambridge Street, London.
Following a review of their IT infrastructure, Transair recognized the need to replace their existing system and began searching for an IT solution to support their expanding and complex organization. The Elucid multi-channel retail solution from Sanderson was chosen for its functionality and flexibility to support multiple sales channels, underpinned by an integrated back-office system.
The first phase of the project focused on implementation of Elucid back-office at the Transair head office and warehouse facilities, closely followed by the roll-out of EPOS at their four stores. The final phase of the implementation was the launch of the new Trainsair eCommerce site, ensuring a seamless multichannel operation.
Transair is experiencing a number of company-wide benefits since implementing the Sanderson single integrated system – increased visibility across sales channels, more accurate stock levels, better customer information, and improved communication across the company. Elucid provides detailed customer profiling and analysis to drive marketing campaigns and equips Transair with essential management information for monitoring performance in key areas such as warehousing, procurement and finance.
Transair manages a successful mailorder operation, a rapidly expanding eCommerce channel, a wholesale distribution division, and four retail stores at Shoreham Airport, Gloucestershire Airport, Wycombe Air Park and Cambridge Street, London.
Following a review of their IT infrastructure, Transair recognized the need to replace their existing system and began searching for an IT solution to support their expanding and complex organization. The Elucid multi-channel retail solution from Sanderson was chosen for its functionality and flexibility to support multiple sales channels, underpinned by an integrated back-office system.
The first phase of the project focused on implementation of Elucid back-office at the Transair head office and warehouse facilities, closely followed by the roll-out of EPOS at their four stores. The final phase of the implementation was the launch of the new Trainsair eCommerce site, ensuring a seamless multichannel operation.
Transair is experiencing a number of company-wide benefits since implementing the Sanderson single integrated system – increased visibility across sales channels, more accurate stock levels, better customer information, and improved communication across the company. Elucid provides detailed customer profiling and analysis to drive marketing campaigns and equips Transair with essential management information for monitoring performance in key areas such as warehousing, procurement and finance.
Labels:
Merchants,
Multichannel Management,
Vendors
Webtrends Acquires Reinvigorate
Webtrends, a global leader in unified mobile, social and Web analytics and engagement, has acquired real-time analytics company Reinvigorate from Media Temple Ventures to round out its analytics portfolio and become the first analytics company to offer real-time, deep historical analytics for mobile, social and Web channels. Reinvigorate’s solution also brings new data visualization technologies (heat maps, link maps and visitor path analysis) to Webtrends’s portfolio, enhancing their analytics solution.
Lands' End Using Demandware for European eComm Site
Demandware, Inc., a leader in on-demand eCommerce, has announced that global multichannel clothing merchant Lands’ End has selected the Demandware Commerce platform to support its multi-country business model in Austria, Germany, France, UK and Sweden.
“We needed an eCommerce partner who would be able to support our immediate business needs and long-term goals,” said Steve Cretney, CIO, Lands’ End.
Proof of Concept
Lands’ End tested the capabilities of Demandware’s on-demand commerce platform by building a proof-of-concept site for the Sweden launch before committing to a global expansion. During the pilot project, Lands’ End evaluated how effective Demandware was in meeting the following criteria:
Reports Cretney, “The launch of our Swedish site proved that the Demandware Commerce platform and the cloud-based model would support and allow for the quick deployments we were looking for to support our business goals. With Demandware, our team is able to easily launch multiple sites.”
“We needed an eCommerce partner who would be able to support our immediate business needs and long-term goals,” said Steve Cretney, CIO, Lands’ End.
Proof of Concept
Lands’ End tested the capabilities of Demandware’s on-demand commerce platform by building a proof-of-concept site for the Sweden launch before committing to a global expansion. During the pilot project, Lands’ End evaluated how effective Demandware was in meeting the following criteria:
- Response time
- Ability to launch by deadline
- Site compatibility with Lands’ End integrations
- Overall user experience
Reports Cretney, “The launch of our Swedish site proved that the Demandware Commerce platform and the cloud-based model would support and allow for the quick deployments we were looking for to support our business goals. With Demandware, our team is able to easily launch multiple sites.”
Labels:
Ecommerce,
Merchants,
Multinational,
Vendors
Thursday, August 04, 2011
Digby & Usablenet Powering mCommerce Sites
Two mCommerce updates:
1) Cabela’s, the world’s largest direct marketer of hunting, fishing, camping and related outdoor merchandise, has used Digby as their strategic partner for an mCommerce site. The mobile optimized Website features such key elements as large rich product images, detailed product descriptions, complete site search, shop by category, store locator, access to Cabela’s CLUB visa and their full ecommerce site, an FAQ, and ratings and reviews. Click here for more information.
2) Aeropostale Inc., a mall-based, specialty retailer of casual apparel and accessories targeting 14 to 17 year-olds, has launched an Android app developed by Usablenet that lets consumers shop their favorite looks no matter where they are across multiple channels, including mobile phones, mobile applications, tablets, Facebook, in-store kiosks, and other platforms. Consumers can shop by category, browse in-store coupons, track orders, find the nearest location and see what’s currently in their cart. Shoppers can also use the search function to look for a specific item. The mobile site uses HTML5 as part of the Usablenet Mobile 2.0 platform.
1) Cabela’s, the world’s largest direct marketer of hunting, fishing, camping and related outdoor merchandise, has used Digby as their strategic partner for an mCommerce site. The mobile optimized Website features such key elements as large rich product images, detailed product descriptions, complete site search, shop by category, store locator, access to Cabela’s CLUB visa and their full ecommerce site, an FAQ, and ratings and reviews. Click here for more information.
2) Aeropostale Inc., a mall-based, specialty retailer of casual apparel and accessories targeting 14 to 17 year-olds, has launched an Android app developed by Usablenet that lets consumers shop their favorite looks no matter where they are across multiple channels, including mobile phones, mobile applications, tablets, Facebook, in-store kiosks, and other platforms. Consumers can shop by category, browse in-store coupons, track orders, find the nearest location and see what’s currently in their cart. Shoppers can also use the search function to look for a specific item. The mobile site uses HTML5 as part of the Usablenet Mobile 2.0 platform.
Subscribe to:
Posts (Atom)
