iPad based Point-Of-Sale

We just completed a PCI-DSS gap analysis and were told that not only were these devices not PCI compliant, they were not secure.

Thanks to everyone for the comments. FYI: One thing that Revel provides that Square, I think, does not is some inventory control along with historical reporting. They also provide hardware that ties into a cash drawer so they can take and track cash as well as credit.  It sounds like not too many of you all are doing much in this area, are we out there on the bleeding edge on this? I have to say that the main place I’ve seen these things in use is at crafts fairs where the vendors don’t take advantage of the fancier capabilities.

- Mark

--

Mark Berman, Chief Information Officer
Siena College
515 Loudon Road
Loudonville, NY  12211
(518)782-6957,  Fax: (518)783-2590

Siena College is a learning community advancing the ideals of a liberal arts education, rooted in its identity as a Franciscan and Catholic institution.

CONFIDENTIALITY NOTICE: This e-mail, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure, or distribution is prohibited. If you received this e-mail and are not the intended recipient, please inform the sender by e-mail reply and destroy all copies of the original message.

Mark,

According to our consultant, there are wireless POS terminals that are PCI compliant.  However, you will need to take precautions because they place your wireless network “in scope”.  The devices, according to the PCI Council document, “Accepting Mobile Payments with a Smartphone or Tablet”, May 2012, states that “Validated P2PE solutions ensure that cardholder data is encrypted before it enters a mobile device.”  Devices, like Square, do not meet this standard.

If you use a validated device for P2PE from your acquirer and take the required precautions for your network, you may be okay.  However, I would recommend you check with your acquirer or payment card vendor.  You may be required to fill out a P2PE self-assessment questionnaire as part of your annual PCI-DSS evaluation.

Regards,

Tim

Tim Carroll

Assistant Vice President, Information Technology

Roane State Community College

-----Original Message-----
From: The EDUCAUSE CIO Constituent Group Listserv [mailto:CIO@LISTSERV.EDUCAUSE.EDU] On Behalf Of Berman, Mark
Sent: Tuesday, October 09, 2012 6:47 AM
To: CIO@LISTSERV.EDUCAUSE.EDU
Subject: Re: [CIO] iPad based Point-Of-Sale

Tim,

Do you know on what basis they said the security was lacking? Revel is offering their PCI compliance certification.

- Mark

From: "Carroll, Tim" <Carrolltd@ROANESTATE.EDU<mailto:Carrolltd@ROANESTATE.EDU>>

Date: Monday, October 8, 2012 9:01 AM

Subject: Re: iPad based Point-Of-Sale

We just completed a PCI-DSS gap analysis and were told that not only were these devices not PCI compliant, they were not secure.

Regards,

Timothy D. Carroll

Timothy D. Carroll

Assistant Vice President, Information Technology Roane State Community College

[cid:image001.jpg@01CDA533.79172ED0]

From: The EDUCAUSE CIO Constituent Group Listserv [mailto:CIO@LISTSERV.EDUCAUSE.EDU] On Behalf Of Dutcher, James M

Sent: Friday, October 05, 2012 3:19 PM

To: CIO@LISTSERV.EDUCAUSE.EDU<mailto:CIO@LISTSERV.EDUCAUSE.EDU>

Subject: Re: [CIO] iPad based Point-Of-Sale

Good points Dennis....here are some reference links from both sides:

http://creditcardprocessingadvice.com/squareup-and-pci-compliance/

https://squareup.com/security/levels

Regards,

Jim

James M. Dutcher - Chair - SUNY Council of CIOs

SUNY Cobleskill - CIO: PMP, CISSP, SCP/Security+, CISA

Dennis Michaels <dmichaels@NIAGARACC.SUNY.EDU<mailto:dmichaels@NIAGARACC.SUNY.EDU>> wrote:

I recently attended a conference where a PCI vendor was doing a presentation.  He stated that currently there are no PCI compliment mobile POS.  He stated that if you use something like Square the swipe process is compliment but where the breakdown is if the credit card cannot be swiped.    The systems will allow you to manually type the credit card on the device, which then bypasses the encryption.

By no means am I an expert, just passing some information to think about.

Dennis Michaels

Chief Information Officer

Niagara County Community College

716.614.6744