Securing Non-Credit Card, Sensitive Consumer Data: Consumer Data Security for the Retail Sector

As a result of payment card industry standards and a strong understanding of the value of valid credit card information in the black market, the retail industry has already invested in security mechanisms to protect credit card data, also referred to as cardholder data. However, this cardholder data is not the only valuable consumer information that is transmitted and stored by retailers. Other data that can be personally identifiable and is transmitted and stored in this ecosystem includes but is not limited to: consumer purchasing habits (including geographical locations, preferences, search history), date of birth, home or business address, phone number, email address, user id, password, IP addresses, and Social Security Number. As seen following high-profile data breaches in the healthcare sector, personally identifiable information (PII) is valued at up to 20 times more than credit card data, with a single credit card number sold at $1 and the average individual’s PII sold at $20. In collaboration with stakeholders in the retail and commercial payment ecosystem, the NCCoE has identified that implementing data masking and tokenization, coupled with fine grained access control such as Attribute Based Access Control2, may significantly improve the security of PII transmitted and stored during commercial payment transactions, as well as PII shared internally within a retail organization and externally with business partners. Building on this collaboration with the business community and vendors of cybersecurity solutions, the NCCoE will explore methods of effectively masking and tokenizing PII during commercial payment transactions and develop an example solution composed of open-source and commercially available components to address these real-world business challenges. This project will produce a NIST Cybersecurity Practice Guide—a publically available description of the solution and practical steps needed to implement practices that more effectively secure the handling of non-credit card, sensitive consumer data.