As an issuer and merchant acquirer, Apex Global Bank processes billions in credit and debit transactions daily. Cardholder data is governed by private contractual security standards (PCI DSS) alongside statutory Intellectual Property laws.
Apex Bank Scenario 3.2
The Merchant Gateway Audit
A Qualified Security Assessor (QSA) performs Apex Bank’s annual PCI DSS Level 1 audit. The auditor discovers that debug log files on developer testing servers were storing full Primary Account Numbers (PAN) and CVV security codes unencrypted in plain text, threatening Apex’s merchant processing privileges.
1. The 6 Core Goals of PCI DSS
The Payment Card Industry Data Security Standard (PCI DSS) is not a government law, but an industry standard mandated by Visa, Mastercard, AMEX, Discover, and JCB:
1. Build Secure Network
Install firewalls; never use vendor-supplied defaults for system passwords.
2. Protect Cardholder Data
Encrypt stored data; never store CVV/CVC post-authorization; encrypt data in transit.
3. Vulnerability Management
Maintain anti-virus software; develop and maintain secure software and systems.
4. Strong Access Controls
Restrict access to cardholder data by business need-to-know; mandate MFA; unique IDs.
5. Monitor & Test Networks
Track and monitor all access to network resources; perform quarterly vulnerability scans.
6. Maintain Policy
Maintain an explicit information security policy for all personnel and contractors.
2. Intellectual Property (IP) in Fintech
Copyright: Protects the original creative expression of ideas (e.g. source code, user interface designs, and documentation). Automatically applies upon fixation in tangible form.
Trade Secrets: Proprietary algorithms (e.g. Apex Bank’s real-time fraud scoring models) protected by confidentiality agreements and robust access control rather than public registration.
Fair Use: A legal doctrine allowing limited use of copyrighted material without permission for criticism, commentary, news reporting, teaching, or reverse-engineering for security interoperability.
Digital Millennium Copyright Act (DMCA): Criminalizes the circumvention of technological copyright protection measures (DRM) while providing safe harbor protections for online service providers.
3. Knowledge Check
Checkpoint Quiz: PCI DSS Data Storage Rules
Under PCI DSS standards, under what circumstances is Apex Bank permitted to store the 3-digit CVV/CVC security code after transaction authorization has completed?