Are you Using a Mobile Payment System? Part II: Best Practices and Cyber Liability Insurance

Last week we introduced some of the basic policies and procedures a business owner should implement to keep their customers’ data and their business safe (Are You Using a Mobile Payment System? Part 1: Keeping Customer Data Safe).  We will finish the discussion this week by talking about being compliant and about insurance you may want to consider to further protect your business.

One more employee consideration

Aside from informing employees about how to handle, use, and store mobile devices it may be prudent to include background checks during the applicant screening and hiring process (bit.ly/1ftpQaA), if you do not already.  Some pre-hire background checks include requesting credit and criminal records (http://1.usa.gov/1uvVxV9).  Businesses that ask employees to handle payments, regardless if they are mobile device-based, have the right to require such background checks (http://1.usa.gov/1o36hbK).

Strategy for PCI compliancy

We introduced the concept of the PCI (Payment Card Industry) Security Standards Council and being compliant with their standards, but what does the entail?  The following table summarizes the responsibilities of the small business owner and the six goals that comprise “security best practices” (http://bit.ly/Oz1G1j).

Source: PCI Security Standards Council 

The PCI also has resources for small businesses, which they consider to be more vulnerable to security breaches than large companies, and several short videos to further demonstrate how retailers can protect consumer data (http://bit.ly/1rZWa5e).

What cyber liability insurance can offer

You may already have a comprehensive insurance policy or riders that protect your business incase of theft, fire, disaster, and even when essentials employee are unable to perform their duties.  As mobile payment systems and threats to these systems have evolved so has the insurance industry.  Cyber liability insurance is one such addition and “is designed to protect businesses” from:

• Lawsuit damages
• Lawsuit defense costs
• Breach notice costs
• Data restoration costs
• Breach extortion costs (http://bit.ly/1iUntyb)

The following site includes a list of questions that can help you assess your level of risk and issues that should be discussed with an insurance agent (http://bit.ly/1rZK0sX).  Just a few of those listed include:

• “What security controls can you put into place that will reduce the premium?
• What is expected of you to reduce or limit the risks?
• What and how big [of] a difference to your future premiums will a claim make?
• Do all portable media/computing devices need to be encrypted?
• Are malicious acts by employees covered?”

This source further suggests asking potential insurers if you, the small business owner, will have to participate in post claim tasks (e.g. alerting customers about the breach) or if they provide “a point of contact” to oversee all processes after a claim is initiated.

What might cyber liability insurance cost?

Of course costs vary by type of business, geographical market, and factors that impact your general policy (e.g. number of policies held, number of claims within a certain period) but according to one source “a cyber add-on to an existing liability policy might cost $300 a year while a separate policy could cost $1,000 or several multiples of that” (http://bit.ly/Sxrgqv).  Other sources state that policy premiums can be much higher (http://bit.ly/1shcr7Q).  Having cyber liability insurance may “pay off” even if a claim is never filled.  According to once source: “Cyber insurance also can help boost your business by giving customers and business partners more confidence in you” (http://bit.ly/Sxrgqv).

After a breach is detected

So, what do you do when you experience a security breach?  Insurers and IT security experts stress notifying the authorities and your insurance company as soon as a breach is expected. Also, finding and repairing the breach quickly is crucial, as well as keeping records of all procedures that were followed after the incident (in addition to having a good record keeping system to begin with; http://bit.ly/1uwoAb3).

Though no one ever wants to experience this type of disaster, taking precautions, being diligent in your practices, and being prepared is a must.  As our use and dependence on technology grows, with all the associated benefits and advantages such systems provide, it can only be assumed that business owners will need to be aware of possible security situations of which they will need to be aware.  

Kathy Kelley is a professor of horticultural marketing in the Department of Plant Science
Robert C. Goodling, Jr. is an extension associate in the Department of Animal Science

Are You Using a Mobile Payment System? Part 1: Keeping Customer Data Safe

We have blogged a bit about mobile payment systems and the benefits they offer consumers and small businesses (Why You Might Want to Consider Offering Mobile Payments); however, what does a small business owner need to consider before implementing a system or when they switch mobile payment companies?  As with every business decision, the owner needs to do some research and make sure that the proper guidelines and procedures are followed to ensure a good experience for all. 

This week’s blog, the first of a two-part series, will focus on some of the security considerations pertaining to the device itself.  Next week’s blog will discuss measures, including insurance, small business owners can take to protect their businesses should the mobile device go missing or worse.  

What is at stake?

You very well could experience a security breach that (though not restricted to using a mobile device to collect payments but applicable to every method you use to collect cardholder data) with consequences that include:

An example of a mobile payment card reader.  Wikipedia.org

• cost of reissuing new payment cards,
• fines,
• termination of ability to accept payment cards, and
• "going out of business" (bit.ly/1iwnFUd).  

Still, even with these penalties, many businesses have been able to process credit cards with mobile payment systems without experiencing any problems.

Why is there so much concern about compromised data or a security breach associated with mobile devices? 

As you can imagine, and maybe it has happened to you, it is easier to misplace a smartphone or other mobile device compared to a register or computer that is either tethered to something or too heavy or bulky to just carry off without anyone noticing.

A safeguard that is suggested includes securely storing the device, in a safe for example, when not in use or fastening the device to a heavy, bulky item (such as a desk or counter) with a combination lock and cable, much as you would a laptop or desktop.  Concern is further based on “traditional security controls such as [anti-virus], firewalls, and encryption [not having] reached the level of maturity needed in the mobile space” (bit.ly/1ftLIm3). 

How can a small business owner using a mobile payment system protect customer data and their business?

Let’s first start with the device that you will use to collect payments.  A list of equipment and systems can be found here (Why Mobile Payment Systems Might Work for Your Business), but you’ll also need to consider device ownership, who can use the device, and (in certain instances) whether an employee can use the device for more than just collecting payments. 

If you are not already familiar with the PCI (Payment Card Industry) Security Standards Council, they work “to educated stakeholders (merchants, processors, financial institutes, and similar) about the PCI Security Standards…and promotes the awareness of the need for payment data security to the public” (www.pcisecuritystandards.org), in essence “keeping your customer’s payment card data secure.” bit.ly/1ix8PN3.  Retailers who accept credit cards are required to be compliant with the standards (next week’s blog will include an overview on how to be complaint).

Device ownership: BYOD vs COPE

The PCI strongly discourages what is referred to as BYOD (bring your own device), which involves employees using their own mobile device to process consumer credit card payments.  Instead the device should be owned by the business, regardless if it is used solely for “payment and acceptance for transaction processing” or for both business and personal tasks (bit.ly/1hayiqv).

Some companies do buy corporate-owned personally enabled (COPE) devices which they distribute to managers and other employees who process payments at remote locations.  In such instances these businesses permit employees to use the device for both business and personal use.  This allows the business to install and update software that might not necessarily be appropriate for an employee-owned device (bit.ly/1iCHYyj).  Updates can be pushed to devices and the business can seize the device when needed.  This particular arrangement is not unreasonable as employees are often provided with desktops, laptops, and tablets to use in their homes and when traveling. 

Basic mobile device security policies

Some of the more recognized security policies that you should implement:

•    Don’t store any sensitive cardholder data on the mobile device, or on any electronic equipment for that matter.  If you are using the smartphone or tablet and/or a mobile app to save customers’ addresses, birthdates, etc. for the purpose of keeping track of purchases (i.e. loyalty program) take steps to encrypt the data and only collect and store what is absolutely necessary. 

•    Be selective about what apps you download to the device and question why apps might need access to contacts, calendars, location services, etc. on the device.

Source: Pixabay.com

•    Require each employee who needs to have access to mobile devices to have a unique username and password.

•    Employees should be trained on how to properly use the device and owners should educate them on how to maintain device security. 

•    Don’t “jailbreak” or “root” your devices (iPhone, iPad, iPod touch, Android phone or tablets).  Jailbreaking or rooting a device allows the owner to download “additional applications, extensions, and themes” not available at the Apple App Store (bit.ly/1luD6Mb); however, Apple states on its website that doing could: shorten battery live, allow for security vulnerabilities, cause apps to crash, prevent future software updates, and similar (bit.ly/1iDCiEq).

•    Update your operating software.  Often you will get a notification but check the setting on each device often in case a push notification doesn’t go through. 

•    Keep apps up-to-date, too.

•    Beware of phishing emails (emails from individuals posing as legitimate companies with links to malicious software) and SMS texts.  Don’t click on any hyperlinks or URLs that look suspicious. 

All of these procedures, and other applicable best practices, should be included in your employee handbook and operations manual.  Just as you would expect your employees to adhere to a code of conduct when dealing with customers you should expect the same for those who have access to business-owned mobile devices.

No matter what type of device, mobile or stationary, that is used to collect payments it is the retailer’s responsibility to ensure that customer payments processed properly and that only the appropriate data is stored – and that it is stored correctly.  In next week’s blog we will continue the discussing and help you further ensure that you are operating a safe mobile payment system and have a policy in place for any issues that might occur with either a missing device or compromised cardholder data.

Kathy Kelley is a professor of horticultural marketing in the Department of Plant Science
Robert C. Goodling, Jr. is an extension associate in the Department of Animal Science

2014 Farmers' Market Food Trends

by Carla Snyder, Extension Educator, Adams Co.

The top food trend of eating healthy is holding strong for 2014, except it's cleaned up a bit.  The 2014 food trend buzzword of the moment is clean eating, meaning the same as the monotonously repeated healthy eating trend of previous years.  It translates to eating fresh nutritious food that is good for your body.  Most of us know this can only be a good addition to any lifestyle.

What's great about clean eating is that it's not only healthy, but it's helpful.  When paired with a farmers' market of Community Supported Agriculture (CSA) program there can be a community aspect to eating clean.  This means a greater number of health conscious eaters at market stands this summer.

FOTS Market. Ali Frohman - photographer

According to Eating Well magazine, clean eating also means more vegetables, less sodium, limiting processed foods and choosing whole grains.  Where are customers looking to shop to accomplish all of these healthy clean eating tips in one place?  The farmers' market.  Keep it in mind this season as you're selling your fruits, vegetables, grains, and meats.  Why are your customers standing on the other side of the table from you?  It's because they're looking for a clean healthy product for their family, and they're choosing your farm to provide it.  They're trusting in you and can't wait to see what's in store for this season.

Keep customers engaged this season with clean snacks.  "In the past 24 hours, 92% of the adult population had a snack" (Hartman Group, April 2014).  Combine these two trends to be a hit with the market crowd this season!

Keep your core grocery shopping customers on their toes by wowing their taste buds with a little amuse bouche while they shop.  It may be just the thing that sets your market stand apart and keeps customers coming back for more.

It doesn't have to be difficult or time consuming to accomplish clean snacking.  Think small packaging changes and your could open yourself up to a new market, meaning new sales and happy customers for 2014.  A small change such as packaging berries in small cups rather than quart boxes or pureeing watermelon for on-the-spot refreshment can easily attract more moms, kids and thirsty customers to your stand.  Of course, it can't be all fun and games - be sure to check with your local health department for regulations regarding sampling and serving foods ready to eat.

If you're really looking for a way to impress customers, take the clean trend a step further and be on the cutting edge of new product development.  The latest to hit the streets is maple water, the sweet and shy cousin of coconut water, this new product promises to hydrate, be made from local agricultural ingredients and is a shoe-in as the 2014 farmers' market food trend hit.

Keep up to date on food trends and more as they come out by following the Penn State Extension Ag Entrepreneurship Team on Facebook.  And as I raise a glass of maple water "cheers" to a clean and prosperous 2014 market season!

Emerging Food Trends--Peruvian Items Are On The Rise

If you're involved in the ethnic foods industry (whether that's growing, selling, education, or just plain consuming), I suggest joining the Ethnic Greens and Herbs Workshop Facebook group.  This group was formed to disseminate helpful research information and news regarding the ethnic produce industry to growers, wholesalers, retailers, Extension personnel, researchers, and association representatives.  


Fellow blogger Kathy Kelley recently posted a link to the article "From Aji peppers, amaranth and pichuberries to purple corn and quinoa, Peruvian cuisine is hot, says Packaged Facts".  In the article, results from the 'What's Hot in 2014' survey of American Culinary Federation chefs shows that 57% of respondents "voted Peruvian cuisine the top trend in the ethnic cuisines and flavors category".  The article also reports that "the UN declared 2013 the 'International Year of Quinoa' (a Peruvian staple) and the Culinary Institute of America has declared 2014 to be the year of Peruvian cuisine".

So what kind of foods are popular with Peruvians?

• Purple corn- most commonly used to make chicha morada (a drink) and mazamorra (a pudding). 

  

  Purple corn being sold at a farm market. Photo taken by Kathy Kelley on a 2013 trip to South America.

• Aji peppers- a species of chili pepper.  Aji Amarillo, Aji Panca, Aji Rocoto, Aji Mirasol, and Aji Limo are the most commonly used varieties of Aji peppers in Peruvian cooking.

  

  Aji panca pepper.  Photo from TheHotPepper.com.

• Amaranth- a grain with a high nutrition value; the seeds are consumed whole toasted or milled into flour. 

  

  Amaranth harvest.  Photo from NationalGeographic.com.

• Pichuberry- a polyphenol-rich fruit.

  

  Pichuberry. Photo from LAMag.com.

• Pisco- a grape brandy produced in Peru and Chile.

  

  Two different brands of Pisco.  Photo from wikipedia.com.

Why is this trend important to you, the food producer?  Hispanic and Latino populations in the United States are seeing dramatic increases.  According to the 2010 Census, 16% of the US population were of Hispanic or Latino origin.  (The US Census Bureau defines "Hispanic or Latino" as a person of Cuban, Mexican, Puerto Rican, South or Central American, or other Spanish culture or origin regardless of race.)  The Census also shows that between 2000 and 2010, the Hispanic population grew by 43%, which was four times the growth in the total population.  

With this tremendous growth, Hispanic and Latino customers are not to be ignored.  Are you looking to expand your product line and/or market to a new target audience?  This might be your answer, but as always, do your research to find out if you should start selling any new product or marketing to a new audience.  

I Seem to Have Lost a Customer Someplace!

by John Berry, Extension Educator, Lehigh Co.

How much is one customer worth?  How much does it cost the business to lose one customer?  More than you want to know, and probably more than you can measure in real dollars.

Most people only measure the dollar loss of a sale, or how much revenue was lost for the year.  Big mistake.  For openers, multiply that times 20 years.  Losing a customer once could mean they never shop with you again.  And don't even begin to count the people the could have recommended.

The loss of a customer is more than the
dollar amount on one sale.

Then the real losses begin to pile up.  Besides telling everyone in the immediate vicinity, they will tell all their office mates, everyone at the next association meeting, everyone at the next annual trade show and convention, and - if you do a real bad job of recovery or service - report it to people in local media.

The real cost of a lost customer is the different between "cost of lost" and "cost to fix."  Now measure that against the cost of servicing, fixing, discounting or replacing the situation, defect or problem when you first learned of it.  Seems like a pittance compared to the paragraphs above.

The painful part comes when you ask yourself "How did this happen?" "Could I have prevented this from happening?" and "How can I prevent this from occurring again?"

If you have ever lost a customer you aren't alone.  It's not a one person battle.  It's not a one-idea solution.  You need specific facts before any ideas on how to minimize the issues can be formulated.  Start by switching places with the customer.  Try to use your stuff in their environment.  Try to call yourself from their office.  Wear their shoes, and walk around in them for awhile.  Ask your customer brutal questions.  The ones you don't want to hear the answers to.

Get closer to the customer's "real" life.  Meals and ball games can reveal relevant truths that arms length relationships won't uncover.  How do you do this with your existing budget?  You can't.  You must have a "win back" budget.  Funds that are earmarked to fix problems, create resolve, and build goodwill.

When you get back in - thank the customer for dumping you.  Tell them that without the loss of their business, this innovative solution would never have been possible, and you are willing to offer some (major?) concessions for a re-try at the business using these changes.  Notice we have not apologized or groveled.  Customers are less interested in apology than they are in great ideas, recoverable actions, and solutions to their problem.

And finally, get real.  Know the difference between a problem and a symptom.  Losing customers is a symptom.  Poor service, poor product, late delivery, or back-orders are problems.  Remember, it never costs as much to fix the problem as it does to not fix the problem.

Choosing Social Media Tools for Your Business

by Sarah Cornelisse, Sr. Extension Associate, Dept. of Agricultural Economics, Sociology, and Education

"What social media should I use for my business?"  This is an often-asked question, and unfortunately, not one that is easily answered by an outsider.  The appropriate social media tool(s) for your individual business will depend on a number of factors, several of which I discuss below.

What are your goals?  Any time you implement the use of a tool, you should have an identified goal that the tool's use will help you in reaching.  The same goes for social media tools.  It is easy to post lots of content to one or more platforms without accomplishing anything.  Keep in mind also, that it is entirely feasible to identify the use of more than one social media tool to accomplish one or more goals, such as using both Facebook and YouTube to share videos of recipe preparations.

Who do you want to connect with?  Are you looking to connect with consumer, businesses, colleagues, women, techies, etc.?  Different tools attract different types of users.  You'll want to research the demographics of the users for the different social media tools you're considering.  For instance, women are the primary users of Pinterest, while connecting with industry peers may call for using Linkedin.

Where are your competitors?  Some degree of weight should be placed on what social media tools your competitors are using.  What platforms are your direct competitors most active on?  If enough of your direct competitors, or businesses similar to yours, are active on a particular platform, it's likely that is where you should be as well. 

What type of content do you want to share?  Typically, the type of business you operate and the products/services you sell, dictate the type of content, but not always.  Different social media platforms lend themselves better to different types of content.  Photos and recipes are great fodder for Pinterest.  Facebook handles a variety of content types, but photos and video are more likely to be shown in the newsfeed of followers.  To tell stories, educate, or discuss industry related information, blogs are likely preferable.

How do you want to engage?  You may have a preference for how you would like to engage with consumers and followers.  If you enjoy ongoing conversations, can be "connected" a great deal of the time, and are not concerned with followers finding past posts, you may prefer using Twitter. 

Track analytics.  If you're using more than one social media tool, study the analytics that each provides on your activity.  You may find that your followers are conversing with you, sharing your content, etc. more often on one platform than on another.  If that's the case, you'll want to focus your efforts more on the tool that is generating this "return."

Answering these questions should lead you to identify the most appropriate social media platform(s) for your business.  Remember, you don't need to be everywhere.  It's fine to start out with just one social media tool.  The trick is to start with the right one.

Do Your Products Meet Your Customers' Values?

by Brian Moyer, Program Assistant, Lehigh Co.

Many times when we introduce our products to the marketplace,we don't always think about how our potential customers will view the product.  We may know how special our new product is, but how do we get that information to our customers?  An example might be trying to sell freezer beef in the local "Penny-Pincher" paper.  Most of that readership are looking for inexpensive purchases and might not respond well to the purchase price of a quarter or half of a beef.  On the other side, if your goal is to be the lowest priced sweet corn producer, an up-scale farmers' market might now be your best outlet.  Those customers might view your product as lower quality simply because you are offering a lower price than your competitors.  In both cases, neither is a good product-place match.

How surveyed consumers were categorized
based on their involvement in "sustainability."

The Hartman Group, who specialize in researching and understanding how consumer attitudes and behaviors lead to purchases, surveyed consumers about their involvement in "sustainability."  They identified four categories - reflected in the image to the right.  The "core" are those who are very involved (recycle, purchase local food, conserve energy, etc.).  The "periphery" reflects those who do not necessarily go out of their way to follow any kind of sustainable practices.

Notice the kind of language these groups use to reflect what they value or what is important to them when making purchases.  Words such as "transparency," "greater good," and "authenticity" are the values of the "core" and "inner mid-level" groups.  It's very similar to the language of the local food movement, so if you believe your product would be beneficial to this group, then think about where they might make their purchases or get their information and center your marketing efforts and materials on their values and shopping habits.

Values expressed by those surveyed regarding
their involvement in "sustainability"

"Price," "convenience," and "comparability" are words that are used here by the "periphery" group and most closely resemble what we might see in box stores and grocery stores.  If your product's benefits meet those customer needs then you will need to capture this group where they get their information and where they shop.

Now, think about where you think your product falls in here and does your promotional materials and language reflect that of the group of consumers you are trying to reach.  Let's say you raise grass-fed beef.  Maybe your customer base will lie within the "core" and "inner mid-level" group of consumers who are interested in a sustainable lifestyle and would most likely purchase your beef products.  You need to show how authentic your products are and that your values of farming reflect their values when making food purchases.

How some consumers may prefer to envision their
beef - "faceless" - yet still knowing how they were raised.

The picture to the right demonstrates some of those values that the customer may envision when purchasing your grass-fed beef.  The customer wants a high quality eating experience from beef raised on beautiful pastures.  The one thing you will notice missing from this ad is pictures of cows.  We as farmers are greatly interested in our animals, but the customer may not be.

Whether we share the same values as our customers isn't as important as making sure our products do.