Every time a purchase is made online the credit card data is vulnerable to multiple attack vectors whether that data is being transmitted, stored or accessed.
Hackers use a range of attacks to steal credit card details including:
- Man-in-the middle attacks to steal credit card data while it is being transmitted between a merchant and payment platform or tokenisation provider
- Network and server attacks to steal credit card data stored by organisations.
What are the risks of common payment platforms?
Massive data breaches and credit card fraud can cause heavy financial losses for customers and the organisations they have trusted with their credit card details.
Organisations that don’t protect customers against fraud also face massive fines and loss of reputation, which in many cases can impact share price and lead to demands for executives to resign.
How does Haventec protect transactions?
Haventec Sanctum addresses the three critical focus points of transmission, storage and access:
(1) Transmitting credit card data
Haventec Sanctum protects credit card data by securing it in a decentralised vault.
Sanctum vaults are heavily encrypted and deconstructed into meaningless fragments of data, so that even if parts of the data are intercepted the attacker cannot reconstruct and exploit the information.
(2) Storing credit data
Many purchasers request a merchant to store their credit card details for future purchases. Yet in many cases when a purchaser does not want the merchant to keep their credit card details on record, the details are in fact kept.
Payment providers need charge back and refund functionality without having to request credit card details from users.
Sanctum offline vaults offer payment providers this flexibility by providing a decentralised secure storage solution which is encrypted, deconstructed and distributed.
(3) Accessing credit card data
Payment platforms and banks often use tokenisation to securely and centrally store credit card details and prevent internal access to that data.
Tokenisation solutions traditionally use expensive Hardware Security Modules (HSM) to manage encryption keys and secure sensitive data on networks. The hardware is expensive to buy, operate and maintain – making it difficult to manage flexibility for business operations.
Haventec Sanctum is a viable software-driven replacement for expensive HSM devices. Haventec takes away the hardware cost and makes securing credit card data operationally sustainable.
Sanctum provides a decentralised vault that encrypts and deconstructs financial data into a distributed cryptographic puzzle. The data is never held in a single location and the individual parts are non-exploitable.
Sanctum’s rolling key technology also enforces single use of the data fragments, providing further protection to the transmission and storage of the data.
Payment Card Industries Data Security Standard
In June 2018 Haventec achieved certification as a PCI DSS 3.2 Level 1 Service Provider.
Payment Card Industry Data Security Standard (PCI DSS) is a proprietary information security standard administered by the PCI Security Standards Council and applies to all entities that store, process, or transmit cardholder data (CHD) or sensitive authentication data (SAD).