6 Vulnerabilities

of the Retail Payment Ecosystem

A complex and highly vulnerable process that is only as strong as its weakest link. Know where you’re vulnerable and how you could be risking customer’s transaction and personal data.

Retail Payment Ecosystem Retail Payment Ecosystem Data Stream Intercepting Transaction Data Intercepting Transaction Data Manipulating Software Updates Manipulating Software Updates Exploiting Weak Passwords Exploiting Weak Passwords Attacking Data At Rest Attacking Data At Rest Attacking Data At Rest Intercepting Data In Motion Intercepting Data In Motion Intercepting Data In Motion Capturing Intra-bank Network Payments 6 Vulnerabilities of the Retail Payment Ecosystem Capturing Intra-bank Network Payments Point of Interaction Point of Interaction Point of Interaction Software Vendor Software Vendor Point of Sale Point of Sale Point of Sale Point of Sale Retailer Database Retailer Database Retailer Database Retailer Database Retailer Database Retailer Database Retailer Database Retailer Database Retailer Database Retailer Database Payment Gateway Payment Gateway Financial Institution Financial Institution Financial Institution Financial Institution

6 Vulnerabilities

of the Retail Payment Ecosystem

A complex and highly vulnerable process that is only as strong as its weakest link. Know where you’re vulnerable and how you could be risking customer’s transaction and personal data.


Learn more about security stakeholders
and retail vulnerability points.

Security Stakeholders Navigation Retail Vulnerability Points Navigation

LEARN MORE about security stakeholders
and retail vulnerability points.

Vulnerabilities in

Retail Payment Ecosystems



The Retail Payment Ecosystem is complex and highly vulnerable to attack. There are 6 main points of vulnerability throughout the ecosystem, each with their own attack, security stakeholders and prevention method. Each piece of the ecosystem plays a specific role in the overall security of customer transactions, personal information, and purchasing behavior and preferences. The strength of the ecosystem is only as strong as the weakest link, and each security stakeholder needs to ensure that not only transaction details are protected, but the devices, applications, networks, datacenters being used as well.

Intercepting Transaction Data

Downloadable Assets 

When one of your customers uses their credit card during a transaction, the card data enters a complicated payment ecosystem where devices and applications of differing levels of security are trusted to ensure that payments reach the intended party. This process begins when a payment card is swiped through a card reader and the card reader captures the data. From there, the data moves through the ecosystem, starting at the card reader and ending at the payment gateway. The data is encrypted and decrypted multiple times throughout this process, briefly exposing it and leaving it vulnerable to attack. Adding to this complicated process is the fact that the various elements of this ecosystem may be owned by multiple vendors.

How can you be sure that this already complicated process is secure, when you may not be in control of the security standards at each step?
Point-to-point encryption (P2PE) offers a solution to this problem. With P2PE, the payment card data is encrypted as soon as the card is swiped at the card reader. After use, the highly secure one-time use key used to encrypt the data is destroyed. The card information remains in its encrypted state as it moves onto the point of sale terminal and through the local server where the data is securely decrypted for further processing. The decryption keys are stored in an isolated hardware security module, or HSM, that lives at the payment gateway.

P2PE is the best way to ensure credit card data remains in a consistent state of encryption throughout the entire payment process, keeping you, and your customer’s data, safe and secure.



Hardware Device Manufacturers

From PIN entry systems to payment terminals to card readers, hardware device manufacturers play a critical role in the retail payment ecosystem. According to the 2013 Verizon report, payment systems are a main target for hackers with 97% of attacks caused by tampering of payment systems. Most hackers were able to gain access using simple methods like guessing passwords as many companies are not changing the default passwords of the devices. Hardware device manufacturers need to be aware of these attacks, and protect their devices from malware and hacking.

Manipulating Software Updates

Downloadable Assets 

Two of the weakest points in the retail payment ecosystem are the card readers, or point of interaction, and the point of sale systems. These devices and applications are highly susceptible to the threat of malicious code injection. With stolen keys and certificates, hackers could send malicious code in a way that makes it appear to be trustworthy to the end devices. This would enable the injection of malware into the devices and applications, providing the attacker a means to access and reroute customer and transaction data.

How can you prevent malicious code from entering your systems and protect your data from being compromised?
As an essential element for any system that distributes or receives software updates, code signing verifies who the publisher of a specific set of code is, and attests to the fact that it has not been modified since being signed. Certificates are delivered along with the software updates as a way for users to determine that the new code has originated from a legitimate source before installing.

In particular, retailers should be focused on working with vendors that utilize a code signing infrastructure and leverage hardware security modules to protect keys and certificates. This helps to protect the integrity of the code signing process, and ensures that all software and firmware updates are legitimate, protecting card readers and point of sales systems from attack.


Software Application Providers

Software application providers are highly vulnerable to attacks as updates are sent from the software vendor to the point of interaction or point of sale devices. Hackers can disguise themselves as the vendor, and issue malicious code to steal transaction details and personal information. As breaches become more and more relevant within the retail industry, software application providers need to ensure that they are not the cause. Code signing is a critical prevention method needed to ensure that customer information is protected.

Exploiting Weak Passwords

Downloadable Assets 

According to the 2014 Verizon Data Breach Investigation Report, the use of stolen credentials as a threat to data has risen since 2009, and was the #1 type of attack in 2013. Hackers scan the internet for point of sale systems, which are generally protected with weak or default passwords. Once a hacker has access to a vendor provided password, they can attack other customers using the same vendor and consequently, the same generic password. From there, the attacker can simply access the system and install malware to collect and export customer information.

How can you protect your passwords, and ensure that customer data living in your systems is secure?
There are a few different ways to protect your devices and applications from this type of attack. First and foremost, make sure that your vendor distributed passwords are unique to you and are not used across multiple customers. Additionally, make sure that you are not using the default password from the vendor, and are instead creating strong passwords for accessing your systems. Second, consider implementing strong authentication to protect your customer information through greater control over who within your organization can access certain types of data, or any data at all.

With multi-factor authentication, you can essentially render stolen passwords useless, protecting your customers’ data and your reputation.




The results of a recent survey on customer loyalty show that 65% of adult consumer respondents are very unlikely to do business with companies that experience a data breach of financial information. While retailers are not necessarily responsible for implementing security solutions through each step of the payment ecosystem, they need to be aware of the types of attacks that their vendors could face. Ultimately, when security breaches happen, all eyes are on the retailer and they are the stakeholders facing the greatest struggle in maintaining customer loyalty following a breach. “Data breaches are not just breaches of security. They’re also breaches of trust between companies and their customers, and can result in not only negative publicity but lost business, lawsuits, and fines that can threaten the viability of business,” explain SafeNet’s chief strategy officer Tsion Gonen. Retailers need to do all that they can to protect customer data. Being aware of the threats and attacks throughout the payment ecosystem is the first step.

Retail Breaches By The Numbers

million records
In just the top 10 retail breaches
of 2014
records stolen
by malicious outsiders in Q2 of 2014 were retail
of top ten
retail breaches were from U.S.
respondents feel
companies take customer data protection seriously
SURVEYED WOULD avoid companies
that have a financial data breach

Attacking Data At Rest

Downloadable Assets 

Security Stakeholders

Your organization’s sensitive data resides in more places than ever before. From file, database, application, and web servers, to network attached storage (NAS), both structured and unstructured data-at-rest is attractive and easily targeted due to its volume and relevance. In addition, insider threats are prevalent, as privileged accounts have unprecedented access to data. The traditional perimeter no longer exists, and breaches are inevitable. In the event an unauthorized user accesses your data where ever it lives, your organization’s sensitive data becomes an easy target if not secured.

How can you protect your data, even in the event of an internal or external breach?
The only way to fully protect your organization’s sensitive information is to apply encryption to the data itself. Determine where your high value structured and unstructured data-at-rest resides, whether on premise, in traditional or virtualized data centers or in the cloud. Then implement a strong data encryption strategy that will render files containing sensitive data useless in the event of a breach, misuse or hijacking of privileged accounts, physical theft of servers, and other potential threats.

In addition, protecting sensitive customer data is a key element of PCI compliance mandates. With strong encryption and key management solutions in place, you can ensure that your customers’ personal information is secured and your organization is PCI DSS compliant.


Financial Institutions

With transaction details being the main target for many security breaches, financial institutions need to be especially aware of the vulnerabilities throughout the retail payment ecosystem. As hackers monitor networks to capture, reroute or change transaction data, financial institutions need to be vigilant that details are coming from and going to the right places. Whether through encrypting data in motion or using time-stamping, financial institutions need to protect transaction data to maintain their PCI DSS compliance.

Intercepting Data In Motion

Downloadable Assets 

Security Stakeholders
As data moves from one location to another it is highly vulnerable to attacks, such as fiber tapping. As the data travels across the network, hackers can attach an evanescent fiber coupling device to the cable without detection. The hacker records all activity that runs across the network, and your data is captured and stolen without your knowledge. If that’s not enough, this type of attack can also be used to change data, and has the potential to override the controls on the entire system.

How can you protect your data even when it leaves your control?
Encrypting your data in motion ensures that your sensitive information is protected, and stays that way. Through encryption, you can prevent hackers from reading or viewing the document, including the metadata, as it moves across networks. Whether data, voice, video or all of the above, your sensitive data and metadata should be encrypted to protect not only your organization, but your customers and employees as well.

Don’t wait to be breached. Protect your data in motion.



PCI DSS: The Gap between Compliance and Security

Retailers are subject to a myriad of compliance requirements around how to handle customer data and handle transactions. Compliance with the Payment Card Industry Data Security Standard (PCI DSS) requires the protection of sensitive payment account data — such as primary account number (PAN), magnetic strip data, CVV, and PIN — by any company that processes, stores, and transmits such data. One of the key challenges merchants, banks and payment processors face is the implementation of data encryption to comply with the PCI security requirements in an efficient and cost-effective manner.

With the current breach climate that retailers, financial institutions and other players within the payment ecosystem are facing, being PCI DSS compliant is more important than ever. In a recent survey on customer loyalty, SafeNet uncovered that half of respondents do not feel that companies take the protection and security of customer data seriously enough. Even more frightening for these security stakeholders is that 65% of our respondents said they were very unlikely to do business with companies that experience a data breach of financial information.

The implications are clear – for retailers and financial institutions alike – it’s time for companies to start thinking about protecting customer’s personal and transaction data with strong encryption and multi-factor authentication. Checking off the box of being PCI DSS compliance is no longer enough. Companies need to focus on providing a secure solution for retail transactions, or risk losing customers to competitors who will.

Capturing Intra-bank Network Payments

Downloadable Assets 

Security Stakeholders

Hackers will stop at nothing to get their hands on your transaction data. Another tactic they have is to monitor networks in an attempt to capture, reroute or change transaction data as it moves between the issuing and acquiring banks.

How can you make sure that your transaction data is protected, and ends up where it’s supposed to?
Ensuring the integrity of the consumer data and transaction details is essential to the operations of intra-bank network payments, check clearing, mobile payments and credit card transactions. Organizations must establish trust to secure the integrity of digital applications and transactions. High speed network encryptors are used to ensure the protection of the information being transmitted, to ensure that the correct data is transmitted to the right parties, and only those authorized are able to access the data. Furthermore, organizations should utilize transaction verification, such as time stamping, for further confirm that data was not interfered with while in transit.

The key is for organizations to build a secure cryptographic foundation in order to fully leverage the benefits and opportunities afforded by their digital applications, while consistently safeguarding integrity and trust in their environment.



Fill out this form to access all vulnerability assets


6 Vulnerabilities of the
Retail Payment Ecosystem



All fields required.
What is the company's industry?
Which vulnerability most concerns you?

By clicking submit, you agree to receive email communications from SafeNet Data Protection division. You will have the opportunity to change your email preferences at any time. We will never share your email address with third parties.

   We Value Your Privacy

There were errors on the form,
please make sure all fields are filled out correctly.