Global study shows increasing security risks to payment

AMSTERDAM, The Netherlands, Jan. 26, 2016 (GLOBE NEWSWIRE) -- With acceptance of mobile and other new forms of payments expected to double in the next two years, a new global study shows a critical need for organizations to improve their payment data security practices. This is according to a recent survey of more than 3,700 IT security practitioners from more than a dozen major industry sectors independently conducted by the Ponemon Institute on behalf of Gemalto (Euronext NL0000400653 GTO), the world leader in digital security.

Key Findings

According to the independent study on Payment Data Security, over half (54%) of those surveyed said their company had a security or data breach involving payment data, four times in past two years in average. This is not surprising given the security investments, practices and procedures highlighted by the surveyed respondents:

• 55% said they did not know where all their payment data is stored or located.
• Ownership for payment data security is not centralized with 28% of respondents saying responsibility is with the CIO, 26% saying it is with the business unit, 19% with the compliance department, 15% with the CISO, and 14% with other departments.
• 54% said that payment data security is not a top five security priority for their company with only one third (31%) feeling their company allocates enough resources to protecting payment data.
• 59% said their company permits third party access to payment data and of these only 34% utilize multi-factor authentication to secure access.
• Less than half of respondents (44%) said their companies use end-to-end encryption to protect payment data from the point of sale to when it is stored and/or sent to the financial institution.
• 74% said their companies are either not PCI DSS compliant or are only partially compliant.

"These independent research findings should be a wakeup call for business leaders," said Jean-Francois Schreiber, Senior Vice President for Identity, Data and Software Services at Gemalto. "Given what was found with traditional payment methods and data security, companies involved with payment data must realize compliance is not enough and fully rethink their security practices, especially since a full one-third of those surveyed said compliance with PCI DSS is not sufficient for ensuring the security and integrity of payment data. The financial fallouts from data breaches, and the damages to corporate reputation and customer relationships will carry even greater potential risk as newer payment methods gain adoption," added Schreiber.

New Payment Methods on the Rise and So Are Security Concerns

According to the study, acceptance of new payment methods such as mobile, contactless and e-wallets will double over the next two years. While respondents say mobile payments account for just 9% of all payments today, in two years they expect this ratio to increase to 18% of all payments. Given the issues companies IT professionals reported to face in securing payment data accepted today through traditional methods, companies are likely to face even more difficulties in securing new payment methods. In fact, the study found that nearly three quarters (72%) of those surveyed believe these new payment methods are putting payment data at risk and 54% do not believe or are unsure their organization's existing security protocols are capable of supporting these platforms.

"Looking forward, as companies move to accept newer payment methods, their own confidence in their ability to protect that data is not strong. The majority of respondents felt protection of payment data wasn't a top priority at their companies, and that the resources, technologies and personnel in place are insufficient. Despite the trend to implement newer payment methods, those in the 'IT security trenches' don't feel their organizations are ready. It is clearly critical for companies to look for and invest in solutions to close these data protection gaps, expeditiously," concluded Schreiber.

To read the entire study and country-specific data findings, click here.

About the Survey

The survey was conducted by the Ponemon Institute on behalf of Gemalto and surveyed 3,773 IT and IT security practitioners in the United States, United Kingdom, Germany, France, Belgium, Netherlands, Japan, India, Russian Federation, Middle East and South Africa. Industries represented include Communications, Entertainment & Media, Financial Services, Government, Healthcare, Hospitality, IT Services, Retail, Technology, Transportation, and Utilities. All respondents are familiar and involved in their companies approach to securing payment data. Most respondents are involved in setting priorities and selecting vendors and contractors in their companies' payment ecosystem.

Related Resources

• Infographic: Global Payment Data Security Trends
• Video: Secure the Breach – a Three Step Approach to Data Security

About Gemalto

Gemalto (Euronext NL0000400653 GTO) is the world leader in digital security, with 2014 annual revenues of €2.5 billion and blue-chip customers in over 180 countries.

Gemalto helps people trust one another in an increasingly connected digital world. Billions of people want better lifestyles, smarter living environments, and the freedom to communicate, shop, travel, bank, entertain and work – anytime, everywhere – in ways that are enjoyable and safe. In this fast moving mobile and digital environment, we enable companies and administrations to offer a wide range of trusted and convenient services by securing financial transactions, mobile services, public and private clouds, eHealthcare systems, access to eGovernment services, the Internet and internet-of-things and transport ticketing systems.

Gemalto's unique technology portfolio - from advanced cryptographic software embedded in a variety of familiar objects, to highly robust and scalable back-office platforms for authentication, encryption and digital credential management - is delivered by our world-class service teams. Our 14,000 employees operate out of 99 offices, 34 personalization and data centers, and 24 research and software development centers located in 46 countries.

For more information visit www.gemalto.com, www.justaskgemalto.com, blog.gemalto.com, or follow @gemalto on Twitter.

Gemalto media contacts: