Credit Cards at Fermilab Irwin Gaines Computer Security Awareness Day 9-Nov-2010

Many Potential Uses Auditorium Committee (tickets to events) Recreation Office (gym memberships) Ed Center Cafeteria Chez Leon Housing Office Conference Office Collaboration Meetings

Many Potential Use Cases Employee presents actual card Member of general public presents card Individual reads card number over phone Individual types card number into a web page

Significant Constraints We cannot just do anything we like in processing credit cards!! E-Gov Act requires us to not collect any personal information about members of the general public PII requirements demand that we do not have any credit card information on lab computers Bank requires that any networks that process credit cards must be audited for PCI- compliance (which the general lab network could not do) Lab does not want multiple different solutions for the same problem

Credit Card Policy The lab computer network cannot be used to transmit credit card information, except by an individual using their own credit card while acting as a customer. This includes contract services such as the cafeteria, shoe truck, eye glass store, etc. All credit card transactions accepted by lab employees must be processed using a swiper/keypad provided under the terms of the lab contract administered by the Finance Section. All credit card processing services must be arranged under the terms of the labwide contract administered by the Finance Section.

Use cases handled as follows: A customer physically presents credit card to a lab merchant. The lab merchant must use swiper/keypad (not a computer!!!) to process credit card. A customer phones lab merchant with credit card information. Merchant must use keypad on swiper (not a computer!!!) to process credit card. A customer enters their own credit card information by visiting a site cleared by a 3d party provider. Customer may be onsite or remote. A customer physically presents credit card to a contractor (eg eye glass vendor, shoe truck, etc). The contractor cannot use any device attached to the Fermilab network to process credit card. The two expected mechanisms are a physical imprinter or a swiper/keypad. Note these use cases are designed to ensure that a lab merchant never enters a customer’s credit card into a computer, they only process credit cards using a swiper/keypad.