Methods and systems for performing security risk assessments of internet merchant entities

• US 20040073445A1
• Filed: 06/30/2003
• Published: 04/15/2004
• Est. Priority Date: 07/01/2002
• Status: Active Grant

• Current Assignee: First Data Corporation (Fiserv Incorporated)
• Original Assignee: First Data Corporation (Fiserv Incorporated)
• Inventors: Degen, Robert G., Mellinger, Philip T.
• Granted Patent: US 7,930,753 B2
• Time in Patent Office: Days
• US Class Current: 705/1
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 30/0282 Rating or review of business operators or products
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: G06Q 50/184 Intellectual property management
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Methods and systems are provided for assessing a security risk for a merchant entity having connectivity to a shared network. Information describing characteristics of the merchant entity are received from the merchant entity. A determination is made which test requirements of a security test scheme are to be used in assessing the security risk for the merchant entity. The security test scheme includes a set of test requirements whose satisfaction by the merchant entity is sufficient to ensure compliance with a multiple sets of security requirements defined by multiple payment-processing organizations. The security test scheme is executed with a security compliance authority server in accordance with the determined test requirements.

Claims

1. A method for implementing a security risk assessment for a merchant entity having connectivity to a shared network, the method comprising:

receiving, from each of a plurality of payment-processing organizations, a set of security requirements defining protocols for implementing commercial transactions over the shared network using instruments identified with the payment-processing organization;

developing a security test scheme having a set of test requirements whose satisfaction by the merchant entity is sufficient to ensure compliance with the sets of security requirements defined by each of the plurality of payment-processing organizations; and

performing a remote scan of a network site maintained by the merchant entity on the shared network in support of shared-network commercial transactions with a security compliance authority server, the remote scan implementing at least a subset of the set of test requirements to evaluate compliance by the merchant entity.

2. The method recited in claim, 1 further comprising transmitting a questionnaire to the merchant entity with the security compliance authority server, the questionnaire including queries whose truthful response identifies a level of compliance with at least some of the test requirements.

3. The method recited in claim 1 further comprising scheduling an on-site audit at the merchant entity with the security compliance authority server, the on-site audit being structured to follow a prescribed methodology for identifying a level of compliance with at least some of the test requirements.

4. The method recited in claim 1 wherein a satisfaction level of the test requirements required for compliance with the test requirements is dependent on a characteristic of the merchant entity.

5. The method recited in claim 4 wherein the characteristic comprises a shared-network transaction volume processed by the merchant entity over the shared network.

6. The method recited in claim 1 wherein a frequency of performing the remote scan is dependent on a characteristic of the merchant entity.

7. The method recited in claim 6 wherein the characteristic comprises a shared-network transaction volume processed by the merchant entity over the shared network.

8. The method recited in claim 1 further comprising receiving information describing characteristics of the merchant entity from the merchant entity to limit parameters of the remote scan.

9. The method recited in claim 1 further comprising generating a report summarizing a level of compliance by the merchant entity with the set of test requirements as determined from performing the remote scan.

10. The method recited-in claim 1 wherein the merchant entity comprises an Internet merchant.

11. The method recited in claim 1 wherein the merchant entity comprises an Internet merchant gateway.

12. A method for assessing a security risk for a merchant entity having connectivity to a shared network, the method comprising:

receiving information describing characteristics of the merchant entity from the merchant entity;

determining which test requirements of a security test scheme to use in assessing the security risk for the merchant entity, wherein the security test scheme includes a set of test requirements whose satisfaction by the merchant entity is sufficient to ensure compliance with a plurality of sets of security requirements defined by a plurality of payment-processing organizations; and

executing the security test scheme with a security compliance authority server in accordance with the determined test requirements.

13. The method recited in claim 12 wherein executing the security test scheme comprises performing a remote scan of a network site maintained by the merchant entity on the shared network in support of shared-network commercial transactions with the security compliance authority server.

14. The method recited in claim 12 wherein executing the security test scheme comprises scheduling an on-site audit at the merchant entity with the security compliance authority server, the on-site audit being structured to follow a prescribed methodology for identifying a level of compliance with at least some of the test requirements.

15. The method recited in claim 12 wherein executing the security test scheme comprises transmitting a questionnaire to the merchant entity with the security compliance authority server, the questionnaire including queries whose truthful response identifies a level of compliance with at least some of the test requirements.

16. The method recited in claim 12 wherein determining which test requirements of the security test scheme to use in assessing the security risk for the merchant entity is dependent on a characteristic of the merchant entity.

17. The method recited in claim 16 wherein the characteristic comprises a shared-network transaction volume processed by the merchant entity over the shared network.

18. The method recited in claim 12 further comprising generating a report summarizing a level of compliance by the merchant entity with the set of determined test requirements as evaluated from executing the security test scheme.

19. The method recited in claim 12 wherein the merchant entity comprises an Internet merchant.

20. The method recited in claim 12 wherein the merchant entity comprises an Internet merchant gateway.

21. A computer-readable storage medium having a computer-readable program embodied therein for direction operation of a security compliance authority server including a communications system, a processor, and a storage device, wherein the computer-readable program includes instructions for operating the security compliance authority server to assess a security risk for an merchant entity having connectivity to a shared network in accordance with the following:

receiving, with the communications system, information describing characteristics of the merchant entity;

determining, with the processor, which test requirements of a security test scheme to use in assessing the security risk for the merchant entity, wherein the security test scheme is stored on the storage device and includes a set of test requirements whose satisfaction by the merchant entity is sufficient to ensure compliance with a plurality of sets of security requirements defined by a plurality of payment-processing organizations; and

executing, with the processor, the security test scheme in accordance with the determined test requirements.

22. The computer-readable storage medium recited in claim 21 wherein the instructions for executing the security test scheme comprise instructions for performing a remote scan of a network site maintained by the merchant entity on the shared network in support of shared-network commercial transactions.

23. The computer-readable storage medium recited in claim 21 wherein the instructions for executing the security test scheme comprise instructions for scheduling an on-site audit at the merchant entity.

24. The computer-readable storage medium recited in claim 21 wherein the instructions for executing the security test scheme comprise instructions for transmitting a questionnaire to the merchant entity.