More on PCI tokenization issues

Email LinkedIn
Tools

The great promise of tokenization in a PCI-DSS environment is that you get the benefits of end-to-end encryption with a technology that in theory is much simpler and cheaper.

As with a lot of technologies, Tokenization adoption has been difficult in part because of a lack of standards. Lots of people were eagerly waiting for the PCI-SSC to come out with guidance on tokenization, and in early August the council did just that, following some previously issued guidance from Visa. It will likely prove valuable for many involved in PCI compliance, as it amounts to best practices document. As long as a certification process remains unavailable, self-defined best practices is about as good as it will get.

Tokenization refers to a process by which an account number is replaced with a surrogate value called a token. De-tokenization is the process of redeeming a token for its associated account number. So the stored account number is really a token, and this can greatly aid in merchant security. There's no need to hang onto an account number after a transaction is consummated.

A key goal of the guide is to help merchants and vendors limit or eliminate system components that process, store, or transmit cardholder data. In general, getting tokenization right can eliminate a lot of PCI-related processes that will be rendered unnecessary. Tokenization ought to be a lot simpler than end-to-end encryption, that's for sure. Then again, some have already invested in such encryption. 

For more:
- here are the guidelines

Related articles:
Will critics be satisfied with PCI-DSS 2.0?
  
Growing pains for the PCI-DSS
  
Time for tokenization?