## 5 Discussion
### Vulnerabilities Mitigation
#### 5.2.1 Card  
The Payment Card Industry Data Security Standard (PCI-DSS) is a critical debit card- and credit card-related data security standard. The PCI requires technical and operational controls to be put in place by any entity that stores, processes, or transmits credit card data. The PCI-DSS delineates specific requirements for protecting payment card data. These requirements are detailed in Table 8, providing a comprehensive overview of the PCI-DSS standards and their associated requirements. This is enforced by three ongoing steps: an assessment, identifying all locations of cardholder data, an inventory of assets, and analyzing them for vulnerabilities that could expose cardholder data. The following stage is to repair the vulnerabilities found, and, lastly, to report the assessment and remediation details and submit the resulting document to entities the company does business with. Regarding encryption, PCI-DSS requires compliance with the Point-to-Point Encryption (P2 PE) standard by using one of their listed validated solutions. Two relevant data breaches involving debit card and credit card information were the Home Depot and Target Corp. breaches, displayed in Figure 6, which represent the most voluminous breaches. The most probable cause of the breach at Target was an infection by the Citadel malware [62]. This malware, which is based on its predecessor Zeus, executes a Man-in-the-Browser attack. Another malware used in the attack was BlackPOS, which aims at Points of Sale (POS) devices [63]. Section 5.2.2 provides more information on banking malware. Consequently, approximately 40 million credit card and debit card records were leaked, including their encrypted PINs and other PII. According to the studied dataset, Home Depot was also infected by BlackPOS [63], leaking 56 million payment records. The two companies were also PCI-DSS compliant at the time of the breach [64], although Table 8 shows some requirements that could have prevented a malware infection if successfully implemented, such as regularly updating antivirus software and maintaining secure systems and applications. Additionally, the Home Depot data breach could have been prevented using P2 PE and network segregation. Hence, it is observed that PCI-DSS serves as a reliable foundation for credit card security, but for better security it should not be solely implemented. \begin{table}
\begin{tabular}{p{142.3 pt} p{142.3 pt}} \hline
**Goals** & **Requirements** \\ \hline Build and maintain a secure network and systems. & Install and maintain a firewall. \\  & Do not use vendor-supplied defaults for system passwords and other security parameters. \\ Protect cardholder data. & Protect stored cardholder data. \\  & Encrypt transmission of cardholder data across open, public networks. \\ Maintain a vulnerability-management program. & Protect all systems against malware and regularly update antivirus software or programs. \\  & Develop and maintain secure systems and applications. \\ Implement strong access-control measures. & Restrict access to cardholder data by business need to know. \\  & Identify and authenticate access to system components. \\  & Restrict physical access to cardholder data. \\ Regularly monitor and test networks. & Track and monitor all access to network resources and cardholder data. \\  & Regularly test security systems and processes. \\ Maintain an information security policy. & Maintain a policy that addresses information security for all personnel. \\ \hline \end{tabular}
\end{table} 
Table 8: PCI-DSS requirements summarized. One additional technology that may be used to improve transaction security is the Europay, MasterCard, and Visa (EMV) micro-processing chip, increasing complexity and costs for card counterfeiting, which is known as skimming. Counterfeiting cases are steeply lowering in areas where EMV is implemented, but there has been a consequential rise in Card Not Present (CNP) crime [65].