Is P2P Encryption Secure? That Depends...
In the wake of the highly publicized payment card security breaches of the past few years, point-to-point encryption (P2PE) has emerged as a frontrunner in the search for a stronger defense against data compromise. The technology is also being touted as a solution to limit the scope -- and therefore the expense -- of complying with the Payment Card Industry Data Security Standard (PCI DSS).
Yet the ability of P2PE to improve security as well as reduce PCI scope is entirely dependent on the implementation. Both the encryption points selected and the encryption methodologies used will have a direct effect on how well cardholder data is protected between the time it leaves the payment terminal and arrives at its destination.
What should also be remembered is that P2PE does not encrypt payment data "end to end" from the point-of-sale terminal all the way to the issuing banks. While true end-to-end encryption would guarantee safe data passage through the entire transaction cycle, implementation in the U.S. is not currently possible given the challenges of bringing the country's nearly 7 million merchants, more than a dozen major third-party processors, several hundred gateways, several thousand ISOs and over 100 acquirers on board.
