PCI de-scope

Let me also throw out a real world scenario.  When disputes happen the credit card company requires that we provide them with the full PAN.  In a third party system where the credit card number is never even seen how can we deal with the credit card companies requirement to provide that information.  They want the full PAN and authorization number.  We have this scenario come up often.

Thanks,

Dave Alton

CIO

Center Theatre Group

o:213-972-7539 | c:213-973-2834

I think Keith is somewhat correct in his reading of the Network update item on the new credit card server.  It is one of our goals to have a completely "hands off" method to deal with credit cards in order to remove the onus of PA-DSS certification for the software.  In fact our team had a meeting this week with our security auditors to discuss that very topic (among others).  The new credit card server is one step towards that because it gives us more options for ways to address payment processors.  I understand that what you are talking about specifically is a 3rd party hosted window so that the application never even touches (much less stores) that credit card data and we are looking at that as well.  That approach does add some simplicity to the process but also poses some integration challenges because of the "commit" problem.  What happens if you authorize a card through a totally separate window and then you never save the order?  And if you want to do recurring payments (automatic credit card billing) then we have to store some pointer to the credit card stored in a 3rd party system.  All solvable problems but ones that add to the complexity.

Thanks for the comments and for keeping the conversation going.

Hi all,

Just on the point of automatic credit card billing. If like us you always require  the CV2 number, but then you can’t save this number in Tessitura, doesn’t this function become obsolete in the UK?

I think Keith is somewhat correct in his reading of the Network update item on the new credit card server.  It is one of our goals to have a completely "hands off" method to deal with credit cards in order to remove the onus of PA-DSS certification for the software.  In fact our team had a meeting this week with our security auditors to discuss that very topic (among others).  The new credit card server is one step towards that because it gives us more options for ways to address payment processors.  I understand that what you are talking about specifically is a 3rd party hosted window so that the application never even touches (much less stores) that credit card data and we are looking at that as well.  That approach does add some simplicity to the process but also poses some integration challenges because of the "commit" problem.  What happens if you authorize a card through a totally separate window and then you never save the order?  And if you want to do recurring payments (automatic credit card billing) then we have to store some pointer to the credit card stored in a 3rd party system.  All solvable problems but ones that add to the complexity.

Thanks for the comments and for keeping the conversation going.

Thanks Keith – We are particularly interested in de-scoping PCI which I don' t think the covers

You were sent this message automatically by www.tessituranetwork.com because you subscribed to the Tessitura Next Generation forum email notifications. You may reply to this message or visit the site to reply to the post above. If replying via email, please consider deleting the previous message text before sending to help with readability on the site. Thank you!

Tom,

The Science Museum has a functional, but inelegant way of processing gift cards. I say inelegant because it is does not seamlessly link Tessitura to our processor. We use a third party processor to enable our patrons to use their gift cards in our Explore Store, parking ramp and contracted food service. We use methods of payment to add value to and redeem gift cards. Processing, balance inquiries is done through a separate software. Please let me know if I can provide more details, though I think we may have talked at a conference?

Thanks.

Ray

Chuck,

As you are looking at the Credit Card Server are you considering the issues around credit card company issued gift cards?  Right now we have not found a way to institute this kind of gift card setup for Tessitura. 

This seems to be because the current credit card server and Tessitura Clients have no way to do the following:

• querry available balances and then
• easily split payments between the Gift Card and apply the remaining expences on another Credit Card or more gift cards.

To be the most help, we would have to be able to do the above from both the Box Office and on the Web. 

Is this sort of functionality on the "Radar Screen"?

--Tom