Tokenization: What Is It, Why It Matters to Your Business
If during the last four years you reserved a room at a Sheraton, Westin or any of the Starwood chain of hotel properties, you have received or soon will receive a 3,296-word “Dear Valued Guest” email with the news that your reservation information may have been included in the much publicized breach of what could be as many as 500 million guest records.
Here’s what we know. Marriott discovered the breach on September 8, when it received an alert from an internal security tool regarding an attempt to access the Starwood guest reservation database. Marriott further announced that they learned during the investigation that there had been unauthorized access to the Starwood network since 2014.
The accessed information included encrypted payment card numbers and payment card expiration dates. There are two components needed to decrypt the payment card numbers; at this point, Marriott has not been able to rule out the possibility that both were stolen.
Marriott seems to suggest the reservation system was breached. Industry experts have suggested it is unlikely this system would have had 500 million records.
Experts believe it’s more likely the breach occurred in the “data warehouse,” which would contain the booking records for several prior years. It clearly could contain 500 million records.
While this security breach may have been an exploitation of a platform weakness, most commonly, breaches occur when someone obtains an administrative password by deception, enabling them to log into the system and install software to extract data and manipulate the system.
Because Marriott suggests that the primary encryption key was also exposed, internal staff may have been involved. One security expert believes it is almost impossible to imagine a scenario in which an external hacker is able to gain access to the primary encryption keys.
Marriott is not the only mega corporation facing major security issues. This week, Google announced it is shutting down its beleaguered social network sooner than expected in the wake of a new security issue that affected 52.5 million users.
If companies like Google and Marriott, with their extensive resources, are this vulnerable, what can a small manufacturer who accepts credit cards do? We asked BASYS Processing—one of our supplier members—for some practical advice.
LINKS TO CREDIT CARD PROCESSING SECURITY TIPS
- Tokenization: What Is It? Why Does It Matter To Your Business?
- Easy Step to Protect your Customers’ Data .
- Too Much Security? There’s No Such Thing .
- 10 Ways to Stay Secure when Accepting Credit Cards Online .
- 4 Tips to Protect Your Business from Credit Card Processing Scams
While the company provided us with links to more detailed information, the executive said the bottom line is this: They can’t steal what you don’t store.
Tokenization is when the card data is submitted—at the moment it is swiped, inserted or typed in manually at a terminal. When data is tokenized, the information is replaced with a token, which is a random set of numbers, letters and symbols.
The original information is stored in a data vault. The data vault is a digital vault that securely stores and matches the token to the correct customer’s actual information. When the token is presented in the place of actual card information, the data vault matches that token to your customer’s live card information, and then applies the payment to your business account.
Tokenization means that no live customer data is available to be intercepted—only tokens. Even if someone gained access to tokens, they couldn’t do anything with it unless they have also had access to the token data vault. That matters to your business for 2 reasons.
1. Reduced Risk to the Business. As a merchant, tokenization greatly reduces your risk of exposure when handling customers’ card data. For the longevity and security of your business, lower risk is a great benefit.
2. Reputation. You don’t want your business to be known for suffering a data breach. An event like that will make customers unsure about engaging with your business, and that will hinder growth.
In addition to the link provided earlier to BASYS security tips, you can contact Derek Wiedenmeyer at the company at dwiedenmeyer@basyspro.com.