Cover Story      Transaction Security:

Industry consultants and participants agree that there will be a new focus on security and privacy of all types following the September 11 disasters at the World Trade Center in New York and at the Pentagon.

Among the concerns when the twin towers collapsed was the integrity of financial records, particularly because financial firms were the primary tenants of both towers - a major reason that stock trading was halted for nearly a week after the tragedy.

ISOs are likely questioning data integrity themselves and are likely to receive plenty of related questions from current and prospective customers. Though concern is understandable, the financial payments system, including banks, credit card processors and the card associations are among the most protected systems in the world in terms of backup systems to ensure data integrity, according to consultants.

Visa, Mastercard and the major processors all have "redundancy upon redundancy," according to James Accomando, president of Accomando Consulting, Fairfield, CT. These companies have backup data centers to warehouse information in the event of a man-made or natural disaster. A data center is much more likely to be threatened by a fire, flood or a construction worker cutting electric lines with a backhoe than losses from other disasters.

Security
"I've been to Visa and other data processing centers. The data centers at major processors are like fortresses," Accomando added. "They have generators upon generators and are built with concrete and steel, are very low to the ground and are contained in very non-descript buildings."

There are no signs on the exteriors of these buildings to help prevent the possibility of a planned man-made disaster. The construction materials and designs are such that these centers can withstand the most powerful hurricanes, tornadoes and other natural disasters.
Every backup system has a backup system and contingency systems are tested continually to ensure they never lapse.

Visa's four data centers worldwide provide multiple layers of redundancy. These centers are located on the East and West coasts, in the United Kingdom and in Japan and include real-time backup. A single U.S. data center can support the entire global transaction load in the event of multiple system failures. All of Visa's centers are mirrored with identical transaction data.

To ensure physical security, guards are often stationed at facilities, each of which have their own sophisticated alarm systems.

However the Pentagon was, and perhaps still is, considered one of the buildings best fortified against natural and manmade disasters. But that still wasn't enough protection on September 11.

Though Visa and Mastercard didn't have any data centers at the buildings that were destroyed, the entire American Express headquarters was demolished. Even so, cardholders could still use their American Express cards across the country, said John Grund, partner with First Annapolis Consulting, Linthicum, MD.

The disasters will prompt companies to revisit data protection methods, Grund added. Bank/processor agreements include clauses for data protection/data integrity and disaster recovery. He expects these clauses to be reviewed and, perhaps, tightened.

For most companies inside and outside the transaction processing industry, the review of contract agreements and procedures is nothing new. Most of them did something similar two years ago as part of their Y2K preparations.

"Re-evaluation of systems is going on throughout the financial services industry," concurred Sara Garrison, Senior Vice President of Systems, Development and Customer Service for Visa U.S.A, San Francisco, CA. "We're looking at everything from physical security of the buildings to backup systems. After the events of September 11, we're hearing more about the potential of cyber attacks."

Consultants agreed that the integrity of the financial payments system is critical to maintaining business as usual (or as close to usual as possible) in wake of the terrorist attacks that have occurred or could still occur.

So other financial services companies, including the processors, will be looking at their systems as well, even though many already offer backup systems and mirroring capabilities on or off-site.

"We're here to support the processor in the event that a network component goes down," Garrison said. "We offer double and triple redundancy at all endpoints."

Additionally, most processors, especially the largest ones, have a host of redundant systems themselves, including backup power supplies, backup equipment and remote and redundant data centers. A certain level of redundancy is required by regulators or by the card associations. The largest processors tend to have the most thorough backup systems, some surpassing the requirements of law and of the credit card associations.

McLean, VA-based Network 1, for example, has redundant power supplies and storage centers so even the combination of most man-made (i.e., power outage) and natural (i.e., tornado) disasters wouldn't destroy the data. If one center partially or totally fails, another can still operate, said CEO Bill Wade. This is also true in the case of a regional disaster because one center is in Texas and one is in Virginia, so even a regional problem, such as the downed telephone lines in New York that affect more than lower Manhattan, would not disrupt service at both locations.

Small processors tend to outsource their work to larger companies, so security of these firms is also state-of-the-art. However, mid-level processors, many of which continue to handle everything in house, to date may not have taken as many security precautions as the larger firms.

Eye on Terminals
There are few credit card terminals that offer much in terms of backup potential, according to Matthew Hanis, executive vice president for Centrics Technology, a St. Louis, MO-based merchant and credit card processing consulting firm. Many of the point-of-sale cash registers, on the other hand, offer internal battery backups that provide about one hour of power.

Therefore, ISOs should advise merchants to have their own backup power supplies for terminals and other critical systems. Telephone lines can go down as well, so ISOs should advise merchants to have some traditional paper credit card slips as well, Hanis added.
"Using the paper credit card slips is more expensive [for merchants] than electronic transactions, but it's better than losing sales when EDC is not available," Grund says.

ISO Backups
The backup of information is no less important to ISOs than it is for merchants or for other types of businesses. Without these backups you can be out of business for hours or days (in the case of power or telephone outages) or lose business information (records needed for IRS or for customers in the case of computer failures) that could hurt or wipe out the business.

So ISOs should take lessons from the above and from much of the advice that was offered to companies prior to Y2K.

First outline the business to determine what information is "mission critical" and what information can be duplicated or recovered easily in the event of equipment failure (for whatever reason).

This will enable you to plan backup strategies and buy the necessary equipment or services in the order in which you need them. It will also help determine how much money you should spend.

As mentioned above, the most likely interruption is a power outage. As electric companies continue to cut back on maintenance personnel, these outages are likely to increase. For a small ISO, a backup generator for the business and a backup power supply for computers will help keep the business going during the outage.

Why both? The backup power supply on each computer, available for a small sum from companies like APC, provides power for the short time it takes the generator to go on. The backup power supplies also help protect against power surges and drops that can wipe out a computer and all of its memory.

A larger ISO might invest in a larger, natural gas-powered generator that is more expensive, but can provide more power and will go on immediately after a power drop - a complete loss of power isn't necessary.

A backup telephone is just as critical. Wireless phones are so inexpensive today that some people have eliminated landline connections. But remember that high cellular traffic sometimes means you can't get through on the wireless phone. So you'll want to have a landline backup too.

With an increasing amount of information on the computer (PCs or servers), it's also imperative that these systems be backed up. There are several different choices. PC and server information can be backed up on computer tape at the ISO facility or, especially for larger ISOs, at a remote facility. Data storage needs can also be outsourced to a number of companies that specialize in this service. Most of these data storage service companies have "industrial strength" backup systems, though you should examine any agreement to make sure what you're getting.

back to articles