PeepSafe Order Entry
Does your organization:
-
Take cardholder data over the phone?
-
Receive cardholder data by fax?
-
Receive cardholder data in email?
-
Store, process or transmit cardholder data?
If the answer is YES to any of these questions, then you are required to be PCI DSS compliant. What does this mean…?
The organization must comply with the Payment Card Industry Data Security Standard (PCI-DSS) for everything that is “In Scope”
PCI-DSS is a GLOBAL standard and requires that organizations handling payment card data:
- Build and maintain a secure network
- Protect cardholder data
- Maintain a vulnerability management program
- Implement strong access control measures
- Regularly monitor and test networks
- Develop and maintain an information security policy
Any system that — or any system that is connected to a system that — stores, processes or transmits cardholder data is considered to be “In Scope”.
In the scenario below, e-mails and faxes are being received and data is being stored on the local network. In this scenario, the entire network is in scope, EVEN when your payment gateway is PCI DSS Level 1 compliant.
With PeepSafe all orders are delivered directly into the hosted portal and the merchant logs into the portal over an encrypted SSL tunnel. They can then view their files, read their messages and securely connect to their payment gateways with only a bitmap representation of their session ever reaching their local machine. Any card data entry is performed using an on screen keyboard or keypad thereby removing their local keyboard buffer from scope. During their session, the local keyboard numbers are de-activated to enforce the use of the on screen keyboard. In this scenario, the entire corporate network is removed from scope.
Key PeepSafe Features
Secure Portal
All PeepSafe functionality is hosted behind an encrypted portal, accessible via an encrypted SSL tunnel. The portal provides multiple layers of security including secure role and access management, audit trails and full integration with a large number of applications and authentication directories and single sign on capabilities. There are additionally a large range of optional security enhancements including two factor authentication and one time passwords and each portal user is identified by their IP address to prevent access from insecure locations such as airports and internet cafes.
Secure Encrypted Email
PeepSafe users are able to access their individual accounts within a fully secured, encrypted, audit enabled messaging system which is housed and managed within the portal. Non-portal users are able to send emails into the secure system which are encrypted before they are stored. The system can auto provision non-users with time limited, guest accounts to receive responses to their emails A built in web form can be used to collect customer data and forward it to the merchant’s secure account. The merchant can additionally send their customers an introductory email from within the secure system,thereby carrying out the entire communication within the messaging system and not the customers unsecure corporate email system.
Secure Fax
Secure Fax is a simple, secure encryption alternative to traditional fax machines and eliminates the need for stringent physical, logical and procedural controls within the corporate office. The secure fax is encrypted upon receipt and then transferred transparently to your secure mailbox.
Secure Vault
Secure Vault stores cardholder data encrypted at the source to prevent data from multiple cards from being displayed at any one time. Secure Vault capabilities include a full audit trail of activities, two factor authentication, secure email notifications, credential masking, alerts and reporting.
Secure File Upload
The secure file upload capability allows any file type to be uploaded and saved instantaneously into an encrypted directory on a portal hosted encrypted file share.
Remote Desktop
Each PeepSafe user has a terminal session to a customizable remote desktop where they can view and manipulate files and access payment gateways to enter credit card and other customer information. Virtual keyboards and PIN pads, secure printing to local devices and many other features are available from the desktop. Data Loss Prevention technology can detect any card data within the print queue and either redact the fields or forward the print jobs to a quarantined environment for review. The user sees only a bitmap representation of their remote desktop and therefore none of the session ever enters the local computer cache. The remote desktop does not interfere with any of the other applications on the customers computer, and therefore provides no disruption to usual activities.