Payment data security practices must be improved

©prykhodov via 123RF

Research findings

According to the study on payment data security, over half (54%) of those surveyed said their company had a security or data breach involving payment data an average of four times in the past two years. This is not surprising given the security investments, practices and procedures highlighted by the surveyed respondents:

• 55% said they did not know where all their payment data is stored or located.

• Ownership for payment data security is not centralised with 28% of respondents saying responsibility is with the CIO, 26% saying it is with the business unit, 19% with the compliance department, 15% with the CISO, and 14% with other departments.

• 54% said that payment data security is not a top five security priority for their company with only one third (31%) feeling their company allocates enough resources to protecting payment data.

• 59% said their company permits third party access to payment data and of these only 34% utilise multi-factor authentication to secure access.

• Less than half of respondents (44%) said their companies use end-to-end encryption to protect payment data from the point of sale to when it is stored and/or sent to the financial institution.

• 74% said their companies are either not fully PCI DSS compliant or are only partially compliant.
Middle East and South Africa key findings

• In the Middle East and South Africa region, around 37% of the companies agree that their company's security personnel has the expertise to effectively protect their payment data.

• Only 42% said the protection of payment data is a top five priority for their organisation.

• Around 36% of the companies believe that the security technologies the company has to protect payment data are effective.

• 30% said that enough resources are allocated to the protection of payment data.

• 66% feel that the new payment methods such as mobile payments, contactless payments and e-wallets are putting payment data at risk.

• 75% agreed that there was a high risk of data loss or theft as a result of not knowing where payment data is stored.

"These research findings should be a wake-up call for business leaders," said Neil Cosser, identity and data protection manager for Africa at Gemalto. "Given what we've seen with traditional payment methods and data security, it's time that companies realise compliance is not enough and fully rethink their security practices.

"In fact, a full one-third of those surveyed said compliance with PCI DSS is not sufficient for ensuring the security and integrity of payment data. The growing financial fallouts from data breaches and damages to corporate reputation and customer relationships can now carry even greater potential risk as newer payment methods gain adoption," added Cosser.

New payment methods

According to the study, acceptance of new payment methods such as mobile, contactless and e-wallets will double over the next two years. While respondents say mobile payments account for just 9% of all payments today, in two years they expect this to increase to 18% of all payments.

Given the threats companies have faced in securing payment data accepted through traditional methods, companies are likely to face even more difficulties in securing new payment methods. In fact, the study found that nearly three quarters (72%) of those surveyed believe these new payment methods are putting payment data at risk and 54% do not believe or are unsure their organisation's existing security protocols are capable of supporting these platforms.

"Looking forward, as companies move to accept newer payment methods, their confidence in their ability to protect that data is not strong. The majority of respondents felt protection of payment data wasn't even a top priority at their companies, and that the resources, technologies and personnel in place are insufficient.

"Despite the trend to implement newer payment methods, those in the 'IT security trenches' don't feel their organisations are ready. It is critical for companies to look for and invest in solutions to close these data protection gaps expeditiously," concluded Cosser.

To read the entire study and country-specific data findings, click here.