New Scoring System Protects Credit Card Transactions

Nov 08, 2007
New Scoring System Protects Credit Card Transactions
NIST image, photos copyright Shutterstock.

As this year’s holiday season approaches, your credit card transactions may be a little more secure thanks to standards adopted by the payment card industry.

The latest incarnation of these standards include the Common Vulnerability Scoring System (CVSS) Version 2 that was coauthored this year by researchers at the National Institute of Standards and Technology and Carnegie Mellon University in collaboration with 23 other organizations.

When you make an electronic transaction—either swiping a card at a checkout counter or through a commercial Web site—you enter personal payment information into a computer. That information is sent to a payment-card “server,” a computer system often run by the bank or merchant that sponsors the particular card. The server processes the payment data, communicates the transaction to the vendor, and authorizes the purchase.

According to NIST’s Peter Mell, lead author of CVSS Version 2, a payment-card server is like a house with many doors. Each door represents a potential vulnerability in the operating system or programs. Attackers check to see if any of the “doors” are open, and if they find one, they can often take control of all or part of the server and potentially steal financial information, such as credit card numbers.

For every potential vulnerability, CVSS Version 2 calculates its risks on a scale from zero to 10, assesses how the vulnerability could compromise confidentiality (exposing private information such as credit card numbers), availability (could it be used to shut down the credit card system?) and integrity (can it change credit card data?). The CVSS scores used by the credit card industry are those for the 28,000 vulnerabilities provided by the NIST National Vulnerability Database (NVD), sponsored by the Department of Homeland Security.

To assess the security of their servers, payment card vendors use software that scans their systems for vulnerabilities. To promote uniform standards in this important software, the PCI (Payment Card Industry) Security Standards Council, an industry organization, maintains the Approved Scanning Vendor (ASV) compliance program, which currently covers 135 vendors, including assessors who do onsite audits of PCI information security.

By June 2008, all ASV scanners must use the current version of CVSS in order to identify security vulnerabilities and score them. Requiring ASV software to use CVSS, according to Bob Russo, General Manager of the PCI Security Standards Council, promotes consistency between vendors and ultimately provides good information for protecting electronic transactions. The council also plans to use NIST’s upcoming enhancements to CVSS, which will go beyond scoring vulnerabilities to identify secure configurations on operation systems and applications.

To learn more, see:

CVSS Web site: www.first.org/cvss
National Vulnerability Database: nvd.nist.gov

Source: NIST

Explore further: Computer scientists can predict the price of Bitcoin

add to favorites email to friend print save as pdf

Related Stories

Plastic nanoparticles also harm freshwater organisms

39 minutes ago

Organisms can be negatively affected by plastic nanoparticles, not just in the seas and oceans but in freshwater bodies too. These particles slow the growth of algae, cause deformities in water fleas and impede communication ...

Atomic trigger shatters mystery of how glass deforms

42 minutes ago

Throw a rock through a window made of silica glass, and the brittle, insulating oxide pane shatters. But whack a golf ball with a club made of metallic glass—a resilient conductor that looks like metal—and the glass not ...

US company sells out of Ebola toys

9 hours ago

They might look tasteless, but satisfied customers dub them cute and adorable. Ebola-themed toys have proved such a hit that one US-based company has sold out.

UN biodiversity meet commits to double funding

9 hours ago

A UN conference on preserving the earth's dwindling resources wrapped up Friday with governments making a firm commitment to double biodiversity aid to developing countries by 2015.

Recommended for you

Nokia turnaround since handset unit sale continues

1 hour ago

Nokia appears to have turned around its fortunes after the sale of its ailing cellphone unit to Microsoft, reporting a third-quarter net profit of 747 million euros ($950 million), from a loss of 91 million euros a year earlier. ...

Yahoo CEO defends strategy in face of criticism

1 hour ago

Signaling her reign has reached a pivotal juncture, Yahoo CEO Marissa Mayer is trying to convince restless shareholders that the long-struggling Internet company is heading in the right direction.

Sk Hynix logs all-time high Q3 earnings

2 hours ago

SK Hynix, the world's second-largest memory chip maker, reported Thursday a record high quarterly net profit for the three months to September on strong sales and currency earnings.

User comments : 1

Adjust slider to filter visible comments by rank

Display comments: newest first

HarryStottle
not rated yet Nov 19, 2007
and they would be a hundred times more secure for a fraction of the cost, if they simply implemented optional two factor authentication. You register your mobile phone with the credit card account. Every time you use your card (in a "live" transaction), they send a random 4 digit pin to your phone. You either key that in yourself or give the number to the checkout operator. (Doesn't matter if you're overheard, it's a one time key)

Thereafter, you have to lose both your card and your mobile phone in order to be ripped off. Report phone stolen. Network disables it. Cheap. Efficient. Available for 90% of all transactions on and offline.