Tokenisation: Five things CIOs need to know

If you set up a tokenisation server on your network, you're still storing the data

It beats encryption. Encryption leaves your data vulnerable if thieves steal the key. Tokenisation replaces protected data with a digital placeholder that applications use just as they would real Social Security or credit card numbers. But if you're hacked, the data is useless to criminals. "Any business storing card numbers today should be looking at tokenisation," says Lucas Zaichkowsky, a senior compliance technologist with Mercury Payment Systems.

Tokens can look like your legacy data. One of the good things about tokenisation is that you can be flexible in how you create your tokens. They can have the same data structure as the credit card or Social Security numbers you're already storing, making it easier to reprogram your legacy applications to handle tokens. And there's a pretty good chance you'll end up using both tokenisation and your legacy systems in combination at first.

For some, it reduces your pci compliance burden. Another of the great benefits of tokenisation is that if you set it up using an outside vendor and are not storing card data, you can skip the very long PCI Self-Assessment Questionnaire D in favor of the smaller and easier-to-complete Questionnaire C. However, if you set up a tokenisation server on your network, you're still storing the data, so you still have to fill out the longer compliance questionnaire.

It's tricky to deploy. If you switch from credit card numbers to tokens, you may find unexpected places where those credit card numbers are used. If you're issuing a new token every time someone hands over a credit card number, for example, that could mess up your fraud-detection systems. You'll need to map out all applications using this data beforehand. But even after you do this, don't expect to be able to move every system to tokens immediately.

Payment options vary. How do you want to pay for tokenisation? Akamai offers a service that prevents Web users from ever entering their credit card numbers into a merchant's system. They charge a flat rate. You can probably get tokenisation as a service for about 10 cents per transaction from a payment-processing vendor, but that could lock you in to their system. You can manage your own tokenisation servers, but some vendors charge per record.

Read more about data management in CIO's Data Management Drilldown.

Join the CSO newsletter!

Error: Please check your email address.

Tags data breachesapplicationsPCI compliancesecuritysoftwareencryptiontokenizationData management

More about Akamai TechnologiesetworkMercury Group

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Robert McMillan

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place