Rules of PCI DSS Compliance

Pointers and considerations to make the compliance journey a smoother ride for your organization.

Data breaches have made news often in the past few years. When credit cardholder data is compromised, merchants face bad publicity, lasting damage to their reputations, lost business and possible fines. The global average cost of a single data-loss incident was $3.43 million in 2009, or $142 per compromised record, according to a report from the Ponemon Institute.

That’s why American Express, Discover Financial Services, JCB International, MasterCard Worldwide and Visa developed the PCI DSS (Payment Card Industry Data Security Standard). Businesses with merchant identification that takes credit card payments—whether online, over the phone, or using credit card machines or paper forms—need to comply with these standards, even if they use a payment service provider.

Here are some pointers and considerations to make the compliance journey a smoother ride for your organization:

• Don’t think PCI DSS is going away. Nevada, Minnesota and Washington have incorporated all or part of PCI DSS into their laws. These states are forerunners of a movement similar to the one that led to the adoption of data-breach notification laws, which have so far been enacted by 46 states. Additionally, many banks are now asking their merchants to comply; some are even imposing fines for noncompliance.

• Don’t hide behind the fact that your payment service provider is PCI DSS-compliant. Remember that all “actors” in the credit card payment chain must comply: merchants, payment service providers, banks and hosting providers (if applicable).

• Don’t pick and choose requirements. Merchants need to comply with all the requirements applicable to their credit card payments structure, regardless of any compliance-validation mechanisms they may use. This involves having the appropriate technical and physical security safeguards, policies and procedures in place, and performing quarterly scans of the CHD (cardholder data) environment if it is connected to public networks. Merchants need to train their employees—both when they are hired and again once each year—in matters concerning credit card security. It is also important to be aware that at the highest level, if a merchant makes more than 6 million transactions per year, a qualified security assessor must come on-site to verify compliance.

• Don’t underestimate the time, cost and effort involved in PCI DSS compliance. Get C-level support to make it happen.

Steps to Compliance

Seattle: Capitol Hill credit card fraud wave tied to Broadway Grill

The investigation into more than 100 reported cases of credit card fraud across Capitol Hill has identified a Broadway restaurant as one "point of interest." Like the victims who have had their bank and credit accounts hit for fraudulent charges in the thousands of dollars, Capitol Hill's Broadway Grill is also a victim in this wave as personal and business accounts related to the restaurant have been compromised along with accounts of a not-yet-known number of customers who ate and drank at the popular eatery.

We received the following statement from one of the partners behind the Broadway Grill, Matthew Walsh:

We take this issue very seriously and are working with both the Seattle Police Department as well as the Secret Service to find the people who have done this to everyone and have them stopped.

We have gone above and beyond to make sure that our network is completely secure and that this sort of thing can't happen to any of our customers, there has been no decline in credit/debit card use because of our actions to ensure safety. Not only were our personal accounts compromised but our business savings and operating accounts have also been compromised.

We are a tiny little company trying to manage this huge monster of a restaurant and for someone to swoop in and try to completely wipe our accounts is a really scary thing. I am seriously worried about the future of our business without the support of our community. We have been growing by leaps and bounds since I took over in June, not only in our new menu and food quality but also in our day to day operation. It is my hope that we have touched enough lives over the years to be able to count on our beloved customers for their support and continued patronage in this difficult time.

We do not know yet if Broadway Grill represents the only breached business on the Hill or if investigators have identified others in the area. On Monday, CHS reported that the Secret Service's Electronic Crimes Task Force had identified and "reduced" the threat from what the lead agent called a "point of interest" in the Capitol Hill area.

We have checked with Kroger, the parent company for QFC, about any involvement in the investigation. A QFC spokesperson told CHS he ws not aware of any contact between investigators and either of the Broadway stores. "To my knowledge, we have not been contacted by police. When we are, we will work with them," the spokesperson said earlier this week.

Meanwhile, the situation is widespread enough and people are so wary that large area institutions are dealing with relatively sizable numbers of victims. We talked to Seattle University about a a growing number of Seattle University students and employees who have experience problems with financial accounts in recent days. But Mike Sletten director of public safety for the campus, told us that the cases he is aware of all appear to be part of the Capitol Hill wave. "They all reflect that Capitol Hill theme," Sletten said.

Ecommerce Businesses Under Gun To Become PCI DSS Compliant

Banks are pushing hard for ecommerce businesses to get your websites PCI DSS Compliant.

So if you are an ecommerce business owner don't be surprised by a letter from your bank stating that it is now a requirement for you to signup for their compliance management program.

If you think this doesn't apply to you because you are just a small business, think again, hackers are targeting small businesses precisely because they are ripe for the picking and quite frankly they can get in and out of your unprotected data quicker than you can say "Bob's your Uncle!"

So don't get caught with your pants down around your ankles, tighten the belt and get your business PCI DSS Compliance certified.

Not doing so will not only put you and your business at serious risk for some very nastey fines, but you can expect to lose 65% of your business due to a data breach when the word gets out that you were negligent.

Oh, and the word will get out...

PCI compliance: What it is and why it matters (Q&A)

"And if you're a merchant you really have to be careful because consumers are getting smarter and smarter and if they find out you are not protecting their data, credit card data or personal data, they're going to walk away. And that's going to be the downfall of your business." ~ Bob Russo, general manager of the PCI Security Standards Council.

Found this Gem of an article on CNET, if you are a merchant I urge you to read it in its entirety...C.S.G.

If you own a bank account or use credit cards, chances are you've heard the term "PCI compliant." But you probably don't know what it means.

The term is heard more and more frequently these days as data breaches at merchants like TJX, parent of TJMaxx, and payment processors Heartland Payment Systems and RBS WorldPay land millions of card records in the hands of hackers. Criminals are using the data to make purchases and withdraw money from accounts of unsuspecting victims who did nothing wrong; they just owned a card.

It's a huge and growing problem. More than 80 percent of data stolen in breaches is payment card data, according to the 2009 Verizon Business Data Breach Report.

CNET asked Bob Russo, general manager of the PCI Security Standards Council, to explain what is being done to keep criminals from accessing consumer payment card data.

Q: So, what does the PCI Security Standards Council do?

Russo: The council was formed in September 2006 by the five major credit card brands, Visa, MasterCard, American Express, Discover, and JCB [Japanese Credit Bureau]. It was formed because each one of the brands has their own compliance programs and they still do, but they all use this standard as the foundation for their programs. There was a time when you could pick up the phone and call one brand and ask a security question and get one answer and call another brand and ask the same question and get a different answer. They all now use these standards that we manage as the foundation for those compliance questions.

What is the standard exactly?

Russo: It's the PCI, which stands for Payment Card Industry, data security standard. It's a set of 12 specific requirements that cover six different goals. It's very prescriptive. It says not only that you need to be secure but it tells you how to become secure. It's more about security than compliance. The goals are things like build and maintain a secure network, protect card holder data and regularly monitor and test the networks. That's the main standard. We manage three different standards. The first one covers everything from the physical security to logical security.

The second standard is PADSS, Payment Application Data Security Standard. These are for payment applications a merchant would buy off the shelf. For example, if you went to a restaurant and you ordered your meal and the waiter used a touch-screen terminal, that puts the order in the kitchen and it's tied to an ordering database. The application also takes the credit card at the end of the meal. We make sure these applications aren't storing prohibitive data, such as data on the magnetic strip on the card. If they stored that data and someone got a hold of it then they would be able to clone credit cards. There are literally thousands of applications out there and when it's compliant with the standard it gets listed on our Web site.

The last piece we manage is called PTS, PIN Transaction System. Anytime you enter a PIN number, for example, this standard would take effect. It looks at those PIN entry devices so when you go to a large department store and you buy something and you use a debit card they'll hand you a PIN pad and you key in your number. We certify those devices as well as unattended payment terminals, such as those used at gas station [islands], ticket kiosks, and transit systems, like the Boston underground. Complete article at cnet

Why PCI compliance goes beyond - and is more important than - the PCI audit

When it comes to payment processing security, many organisations focus on passing the PCI compliance audit. Once that certificate is signed, their focus on payment processing security falls to the wayside.

This is a dangerous mindset, said Walt Conway, a Qualified Security Assessor and payment processing technology expert.

"CIOs and merchants who focus only on their annual PCI validation may actually find that they unintentionally make themselves more vulnerable to a costly data breach," Conway wrote in an article on StorefrontBacktalk.com. "They also make their PCI revalidation the following year more difficult, and possibly more expensive, than it has to be." pivotalpayments

Ending the PCI Blame Game

A typical day. Russians were yet again selling fresh batches of stolen payment card data in closed hacker forums, and our initial undercover buys indicate that there was a significant breach. I knew what was going to happen next, and there was nothing that I or anyone else could do to stop it. No warning was possible. There was going to be another slow, painful train wreck--of that there was no question.

With our subsequent undercover buys of stolen cards, the involved issuer identifies the victim of the breach and notifies the card associations who eventually confront the victim. Disbelief. Shock. Panic. Lawyers--lots of lawyers. Outside attorneys. Estimates are made of the number of cards compromised--a meaningless figure that will later be prominently displayed in news headlines. PCI certification records are waved about. The victim's assessor is notified. Accusations. Finally, the victim is obligated to go public with the bad news. Their stock plunges as their customers jump ship. Game over. computerworld

The Merchants Strike Back?

With the recent news of several restaurants teaming up to sue point-of-sale system provider Radiant Systems (a copy of the complaint can be found here) for failing to comply with the PCI Standard, it appears that some merchants may be in a mood to strike back in the aftermath of a payment card security breach.

This lawsuit comes in the wake of a couple lawsuits against payment card security assessor Savvis for allegedly failing to properly validate a processors' Visa CISP compliance (admittedly in this case it is the merchant bank suing the assessor, but a similar cause of action could exist for a merchant if its assessor makes a mistake in verifying PCI compliance).

While two instances certainly don’t indicate a trend, they do indicate a potential route that merchants may consider to deflect liability arsing out of a payment card security breach. infolawgroup

When a Shopping Cart is Not PCI Compliant: Three Options for Merchants

Earlier this week, Practical eCommerce shared three important questions to ask about your shopping cart. Today, as part of our ongoing PCI compliance series, I’ll take a look at options for ecommerce merchants currently using a shopping cart that is not PA-DSS (payment application data security standard) validated. More specifically, I’ll share the insights of hosting director Matt Whitted of Cybrhost, a web hosting provider specializing in ecommerce.

Cybrhost has alerted its subscriber base to the July 1, 2010 deadline for shopping carts to become PA-DSS compliant and Whitted has fielded numerous inquiries from merchants regarding the mandate.

Whitted says he recognizes that many of the more than 350 shopping carts, by Practical eCommerce's count, available to merchants have not been PA-DSS certified. “I do think this [the mandate] is going to push some of those smaller carts out. It’s a major investment to get your application certified. And then it’s a recurring process,” he says.

Three Options for Users of Non-compliant Shopping Carts

If an ecommerce merchant’s shopping cart provider is not PA-DSS compliant or in the process of becoming certified, Whitted says there are three options.

1.Outsource to an alternative payment solution.

Alternative payment solutions such as Google Checkout and PayPal Express Checkout allow merchants to outsource the checkout process. Payment information is not handled by the merchant. As a result, the merchant’s shopping cart is not considered a payment application and doesn’t fall under the PA-DSS mandate.

Whitted notes, however, that there are several downsides to this option: Outsourcing is generally a more expensive proposition, there are occasional technical glitches involved with the handoff between the shopping cart and the alternative payment system, and you’re giving some control of your business’ information to “Paypal or Checkout by Amazon or whoever you choose.”

2.Switch to a different shopping cart provider.

There are a variety of shopping carts that have applied for and received certification.

“Some of the ecommerce applications that are ahead of the curve and are going through the certification process proactively are going to benefit from people who make this decision (to switch),” Whitted says.

3.Do nothing and see if PA-DSS compliance is enforced.

Acquiring banks or processors are responsible for enforcement of PCI compliance. “Who knows how Visa or MasterCard will handle it?” questions Whitted. “They may be understanding or more extreme.” He notes however, “ Most businesses are not going to want to live by the seat of their pants.” Summing It Up - Practical Ecommerce

PCI DSS checklist: Mistakes and problem areas to avoid

"I can't tell you how many businesses we walk into where they have paper records -- a warehouse of credit card receipts that's intermixed with invoices, etc." Seth Peter CTO, NetSPI

The Payment Card Industry Data Security Standard (PCI DSS) has been a world-changing experience for many midmarket businesses, retailers and credit card processors that previously had little or no regulatory oversight for security.

Breaking Down PCI for the Midmarket

PCI DSS: Building and maintaining a secure network: The first PCI focus area requires a set of documented configuration standards, perimeter and endpoint protection.

PCI DSS: Protect Cardholder Data: The second PCI DSS focus area spells out how organizations must secure cardholder data they store and transmit.

"PCI has been their baptism," said Steve Alameda, principal consultant of Data SafeGuard of San Francisco. "It's one heck of a way to get baptized."

Consultants who devote part or most of their activities helping smaller organizations -- mostly those with Level 3, 4 and some Level 2 requirements for self-assessment -- share some of the difficult lessons learned in the trenches.

Lesson 1: Don't Underestimate PCI

Astonishingly, there's anecdotal evidence that some smaller companies are still unaware they must comply with PCI. Level 4 merchants, those processing fewer than 20,000 transactions annually, are slower to get the word.

Assuming your business is not in that situation, you're facing requirements that are growing increasingly demanding. Self-Assessment Questionnaire D, which most covered organizations are required to complete, is far more detailed than what the questionnaire originally required in 2007. Most companies often turn to consulting help for a variety of reasons:

Lack of knowledge about their own environment. Small companies are wrapped up in doing business, not doing security. Once they realize what they have to protect and all the ways they might be exposed, light bulbs go off.

Inability to comprehend the requirements. Few small companies have security people and most have, at most, a small IT staff that lacks the time and/or expertise to understand and complete the assessment.

The requirements sink in. Organizations start out doing a self-assessment, then realize as they proceed they may have bitten off more than they can chew.

Nobody wants to get it wrong. No one wants to go to the president and tell him/her that after all the time and money spent, the company is still not compliant.

Companies think they have adequate security to meet the requirements. To most small businesses, that's desktop AV and a firewall.

his may also mean underestimating cost. Companies that do their homework, either internally or in combination with outside help, will have a realistic expectation of what they'll need to spend in terms of manpower, technology and services. For example, while they have AV and a firewall, chances are they have never given a thought to purchasing log management, IDS or file integrity-monitoring tools, let alone a Web application firewall.

Also, small companies, unlike enterprises or smaller organizations in heavily regulated industries, are not accustomed to refreshing equipment, such as point-of-sale systems, every few years. In many cases, they need to either upgrade or replace older equipment to become or remain compliant.

Companies do not, typically, anticipate they will have to make some fundamental changes in the way they do business. It's not a matter of tacking on security, even for the little guys. You may, for example, store credit card information in Excel spreadsheets. Now you need to convert all that information into databases and protect them.

"It's one of the hidden costs of PCI. I can't tell you how many businesses we walk into where they have paper records -- a warehouse of credit card receipts that's intermixed with invoices, etc." said Seth Peter, CTO of Minneapolis-based consultancy NetSPI. "One big area where companies underestimate costs is how do you stop doing that and how do you go back and clean it up?"

"They feel their environment is in pretty good shape, and don't think they'll need to make many changes," said Data SafeGuard's Alameda. "Then the reality hits that there will be a lot of changes." TechTarget

Lessons Learned From PCI Compliance

Assessors reveal mistakes companies make with data security standard.
Whether you think PCI is a useful standard that makes our credit card data safer or a credit card industry whitewash that merely creates the illusion of security, PCI compliance is a fact of life.

As part of PCI compliance, companies that process a high volume of credit card transactions must submit to an annual assessment by a qualified security assessor, or QSA. For example, Visa requires it of merchants that process 6 million or more transactions. Assessors work for third-party organizations and generally visit companies to examine their processes and determine whether they comply with PCI rules.

More Security InsightsWhitepapersThe How and Why of PCIIDC Report: Complex Event Processing Opportunity Analysis and Assessment of Key ProductsWebcastsTapping into the Information Pipeline in Real-Time: Creating new levels of visibility and control for the Oil and Gas IndustryLessons From the "2009 Data Breach Investigations Report"ReportsHTML 5 Starts Looking Real (Dr. Dobbs)Hybrid CloudsVideos

Forbes CIO Mykolas Rambus talks about managing cost cutting, the changing role of the CIO, building leadership within, and his company's high priority on mining intelligence from vast amounts of data.

To help companies get ready for a an evaluation, we asked QSAs to describe common problems they encounter when working with IT groups on PCI compliance. What follows are five best practices to help companies better prepare for an assessment and maintain compliance. Information Week

Michelle Rodger: Informed choices on compliance can pay big rewards

COMPLIANCE is a bureaucratic nightmare. Business hates it because it costs money and not only is it time consuming, it's Big Brother sticking his neb into our business.

But have you – as business owners – seriously considered the implications of non-compliance? The massive fines and potential sentences? Or do you just take your chances?

Then consider this alternative. Have you ever viewed compliance as an opportunity, a USP, a differentiator, a competitive advantage? Or used it as a marketing tool, or to leverage loyalty and build trust?

I suspect not. The current information about compliance and data security legislation is all negative. It's about promoting fear of the consequences of not doing what you are told, but I suggest the opportunities could outweigh the disadvantages. Scotland On Sunday

Early Impact Co-founder on PCI Compliance

Found a great Pod Cost interview on the Practical Ecomerce site done by Kevin Patrick Allen of Massimo Arrigoni who is the co-owner of Early Impact, a developer of the licensed shopping cart ProductCart. Here is his perspective on PCI compliance.  Listen to interview

PCI Compliance: A Moment In Time

When it comes to PCI compliance, merchants and software vendors alike often make the mistake of viewing their compliance as a "checklist" rather than an ongoing process. Too many people assume that PCI compliance is achieved once. In reality, however, it is maintained, through vigilant adaptation to both PCI requirements and evolving security threats.

A closer look at PCI DSS requirements should make it quite clear that compliance is an ongoing exercise. For example, requirement 1 reads, "Install and maintain a firewall configuration to protect cardholder data." Requirement 5 mandates that you "Use and regularly update anti-virus software." Requirement 6 states that you "Develop and maintain secure systems and applications." Requirement 11 implores that you "Regularly test security systems and processes." And, of course, Requirement 12 states that you must "Maintain a policy that addresses information security."

Clearly, five of the twelve PCI requirements explicitly mention either maintaining or updating, which should make it clear to all paying attention that there is no finality to PCI compliance. Business Solutions

Analyst: PCI Security a Devil, 'Like No Child Left Behind'

BOSTON -- By obsessing about PCI security compliance and spending money on overly complex and underperforming defenses, companies are ignoring risk management and making themselves a target of state-sponsored cyber villains.

That was one of the main messages delivered by Joshua Corman, research director for enterprise security at The 451 Group, during that firm's 4th Annual Client Performance Conference Wednesday morning.

"Organizations have made PCI DSS and compliance in general the basis of their information security policies," he said. "They're basing security on sloppy logic from Visa and MasterCard and in the process are ignoring some very bad state-sponsored threats. As a community, we have not evolved at all."

He compared PCI DSS to No Child Left Behind, the education reform law championed by former President George W. Bush. The law has been criticized by some who believe it has stifled innovation in education and focused too much on standardized testing. CSO Online

Why Most PCI Self-Assessments Are Wrong

Another fantastic article I found in the archives of Even Shcuman's StorefrontBackTalk on PCI compliance written by David Taylor... it gives me the willies!

Written by David Taylor

The reason that so many PCI self-assessments are wrong is that they focus on the mainstream business processes of the company. They often ignore a lot of “back-channel” or “just-in-case” practices that result in card data coming into the company not protected by the various PCI and other data security measures to protect more mainstream applications, data repositories and processes.

Here are 3 examples, all of which come from personal experience:  StoreFrontBackTalk

Some PCI Compliance Facts

What is PCI DSS? The Payment Card Industry Data Security Standard (PCI DSS) is a set of requirements designed to ensure that ALL companies that process, store or transmit credit card information maintain a secure environment. Essentially any merchant that has a Merchant ID (MID). It is important to note, the payment brands and acquirers are responsible for enforcing compliance, not the PCI council.

To whom does PCI apply? PCI applies to ALL organizations or merchants, regardless of size or number of transactions, that accepts, transmits or stores any cardholder data (including non profits).

PCI compliance deadline? All merchants that store, processes or transmit cardholder data must be compliant now.

What are the PCI compliance ‘levels’? All merchants will fall into one of the four merchant levels based on Visa transaction volume over a 12-month period.

Merchant Level Description

1 Any merchant -- regardless of acceptance channel -- processing over 6M Visa transactions per year. Any merchant that Visa, at its sole discretion, determines should meet the Level 1 merchant requirements to minimize risk to the Visa system.

2 Any merchant -- regardless of acceptance channel -- processing 1M to 6M Visa transactions per year.

3 Any merchant processing 20,000 to 1M Visa e-commerce transactions per year.

4 Any merchant processing fewer than 20,000 Visa e-commerce transactions per year, and all other merchants -- regardless of acceptance channel -- processing up to 1M Visa transactions per year.


Level 4 merchant: You will have to refer to your merchant bank for their specific validation requirements and deadlines. All deadline enforcement will come from your merchant bank



Does PCI apply if I only accept credit cards over the phone? Yes. All business that store, process or transmit payment cardholder data must be PCI Compliant.

I’m in Canada do I have to worry about it? Canada’s deadline has come and gone. Both Canadian and UK merchants are required to be PCI compliant.

Is PCI compliance expensive? No, but non-compliance can be catastrophic. Non-compliance doesn’t just result in lofty fines, credit card replacement and audit fees. Consider the loss of business reputation and revenue.

70% of the cost of non-compliance was due to the loss of revenue!


What are the PCI Compliance Fines?

• $3 to $10 per card for replacement costs
• $5,000 to $50,000 (or more) in compliance fines
• The payment brands may, at their discretion, fine an acquiring bank $5,000 to $100,000 per month for PCI compliance violations. The banks then pass the fines down to the merchant. The bank is likely to either terminate your business relationship or increase your transaction fees.

The average cost of a data breach for a Level 4 merchant averages $36,000 and can be as high as $50,000 (or more) for failure to meet PCI compliance.

What does PCI mean to you?

This week my attention has been dominated by one word, well six officially, but often narrowed down to six or even three letters – PCI.

To give it its full title it is the ‘Payment Card Industry Data Security Standard', and in my meetings this week at Gartner and other panel debates, the subject arose on several occasions. Now I will be the first to acknowledge that I do not know the ins and outs of PCI (as we will now call it), but thanks to the PCI DSS user group (see link) I do know that it is a set of complex regulations that all businesses taking credit card payments must adhere to.

The first debate over PCI is generally in regard to how much of a point the standard has, and how much it is enforced. An article published back in June gave the opinion that the PCI Council had ‘failed to adequately address consumer risk by not mandating end-to-end encryption as part of its requirement, allowing the use of compensating controls in lieu of encryption in order to spare those under PCI requirements from the expense of properly securing the data they were entrusted to protect'.

Paul Henry, security and forensic analyst at Lumension, who gave the opinion, claimed that the amount of data breaches witnessed had become all too commonplace, and that the bar should be raised to increase the minimum acceptable standards to become compliant in light of these many failures.

SC Magazine UK

What does PCI mean to you?

This week my attention has been dominated by one word, well six officially, but often narrowed down to six or even three letters – PCI.

To give it its full title it is the ‘Payment Card Industry Data Security Standard', and in my meetings this week at Gartner and other panel debates, the subject arose on several occasions. Now I will be the first to acknowledge that I do not know the ins and outs of PCI (as we will now call it), but thanks to the PCI DSS user group (see link) I do know that it is a set of complex regulations that all businesses taking credit card payments must adhere to.

The first debate over PCI is generally in regard to how much of a point the standard has, and how much it is enforced. An article published back in June gave the opinion that the PCI Council had ‘failed to adequately address consumer risk by not mandating end-to-end encryption as part of its requirement, allowing the use of compensating controls in lieu of encryption in order to spare those under PCI requirements from the expense of properly securing the data they were entrusted to protect'.

Paul Henry, security and forensic analyst at Lumension, who gave the opinion, claimed that the amount of data breaches witnessed had become all too commonplace, and that the bar should be raised to increase the minimum acceptable standards to become compliant in light of these many failures.

Coincidentally, Lumension announced the launch of its Compliance and IT Risk Management tool earlier this week, perhaps to encourage others into their stricter way of thinking.

Another company to make a significant PCI-related launch was Qualys. I met chief marketing officer Amer Deeba earlier this week to discuss the launch of the new QualysGuard platform.

Deeba claimed that Qualys was seeing more focus on PCI in the UK as more customers became interested, yet he claimed that ‘a couple of years ago this was not the case'.

He also commented that with the PCI Council meeting soon, current challenges, such as virtualisation and pre-authorisation, will need to be clarified and addressed.

Deeba said: “We think PCI is great but needs regulations, but as a regulation it is the best possible for security. It is the common sense of security and companies should do it if they are not already.”

Another company to discuss PCI was Imperva. Its CTO is Amichai Shulman, and he was passionate about both the compliance to it and its enforcement.

Shulman said: “PCI enforcement is very interesting. You are compliant or pay more commission, or the regulators will sue if it doesn't come out. It is not perfect but it does work, as an organisation it makes risk management sensible.”

Imperva's own research found that 71 per cent of companies are not taking security seriously. Shulman claimed that he saw three times the amount of organisations who had a bad attitude towards security to begin with, and did not bother to go through the process, while some went through the compliance process to do the bare minimum to be compliant.

He further claimed that the regulatory enforcement should be balanced against the size of a company, and not be a ‘one size fits all' situation. Shulman said: “Smaller companies should have smaller regulations, not be half compliant but have different layers to affect different deadlines. The remaining fact is that potential change is smaller, so there should be fewer requirements.

“The Heartland CEO said the assessors did not know what they were doing and there are variants and it is understandable as long as you have direct and simple criteria, then the bare minimum is done. Use a firewall, anti-virus, small businesses do this, the council need to sit up and make more clear guidelines.”

He also claimed that there should be a certificate or logo, which regulated companies can display to show that they are controlled and have passed the evaluation. This, Shulman claimed, would raise awareness in the public too.

Shulman said: “This is an issue for the council to take care of, having a certificate saying that you are compliant would help the public make a decision and will show that you care about the safety of your data. Also as a business you will have the incentive to be compliant.”

However Jan Fry, head of PCI at Pro Check Up Labs, had some differing views. He claimed that a company displaying a PCI logo would allow an attacker to ‘determine that a company is probably processing enough credit cards to make an attack worthwhile'.

Fry said: “The attacker will also be able to make assumptions about what is likely not to be in place (network encryption) and has been used successfully before in PCI attacks (still not fixed), and fine tune his attack to take advantage of this - possibly SQL command injection to install listening malware to capture card details.”

He also questioned what benefits it would bring, as it could be replicated by a fraudulent website, and asked: “Is PCI compliance really something to be proud of? What exactly were organisations doing with credit card data before PCI came along?

"The standard in many areas provides a very basic level of security and is not without its flaws. So achieving compliance is not some holy grail of security. Not even close.”

The opinion from Shulman, which was backed up by Shavlik Technologies, seems to not be universally agreed upon, and it is fair to understand Fry's point about it being used indiscriminately, something that was raised by comments left on the story.

SC Magazine UK

Debit Or Credit? Neither

I stopped using my debit card altogether a couple of years ago out of an intense fear that I would never recoup the losses if my card was skimmed in the grocery-store line or compromised at TJ Maxx.

Now I casually slide my checkbook onto the card reader stand and perform that rare act of putting pen to paper while trying to avoid the annoyed stares of shoppers behind me in line who may lose a few seconds off their shopping time because I didn't use plastic.

But my check apparently isn't any safer. The Ponemon-Imperva study on PCI compliance report

released this week found that 55 percent of retailers and organizations who take credit cards don't bother securing their customers' Social Security numbers, driver's license numbers, and bank account details. And 79 percent of retailers surveyed had suffered at least one data breach.

Those aren't great odds.

Sure, even if you swipe your credit card at a retailer that's PCI-compliant, there's no guarantee your credit card won't get breached anyway. But more worrisome is the attitude of many of the retailers in the survey: most look at PCI as more of a "check-box" item than part of a strategic security initiative. If they're playing to the auditors, who's really minding the store and its customer data?

Then there are the opportunistic retailers. These companies are using PCI to parlay some other IT security purchases that they may not previously have had the funds for: "There's almost a dark side to this: they're putting things in the PCI basket that are really not PCI-critical and leveraging PCI for other security projects," says Brian Contos, chief security strategist at Imperva.

Dark Reading

The Future of PCI: 4 Questions to Answer

It's been an interesting year for the Payment Card Industry Data Security Standard (PCI DSS, or just PCI).

On one hand there were the Heartland Payment Systems (HPY) and Network Solutions data breaches, after which at least one industry analyst declared "It's stop pretending that PCI is working."

On the other, there is the State of Nevada, which has passed a new law requiring businesses to comply with PCI when collecting or transmitting payment card information.

In the middle, is a debate among payment card companies, banking institutions, merchants, industry groups and even congressional leaders, questioning the merit of the standard and all hinting at the same open question: What is the future of PCI?

PCI stakeholders are gathering this week for the 2009 PCI Security Standards Council Community meeting in Las Vegas, NV. Among the questions sure to be discussed at this conference:

1)What About End-to-End Encryption?

Following the announcement of the Heartland breach, company CEO Robert Carr called for end-to-end encryption efforts and acceptance of that standard by the payments industry. Heartland even has piloted such a program, but critics say this initiative has a long road ahead if it's to become an industry standard. This is likely to be a major topic for discussion this week and in the coming months.

2) Is Chip and PIN Viable?

In the wake of the year's bigger breaches, some PCI critics have called for U.S. adoption of the UK's chip and PIN security standard, which relies on smartcard technology to reduce point-of-purchase fraud. Alas, the solution is not as effective in online card not present (CNP) transactions - one of the fastest growing fraud schemes. Still, given discussion of chip and PIN at a congressional hearing earlier this year, the solution is likely to get significant consideration in the PCI debate.

3) What are PCI's Limits?

Gartner analyst Avivah Litan has been one of the more outspoken PCI critics, arguing that U.S. card issuers and the industry need to strengthen the core of card payment security. "Card fraud is getting out of control in many areas, and bank card fraud detection systems across the globe are struggling to keep up," Litan says.

Following the recent indictment of Albert Gonzalez for the Heartland breach, Litan said Litan asserts it's time for the U.S. card industry "to get on the bandwagon and upgrade payment card system security, and stop pretending that PCI is working."

Litan's statements will fuel the ongoing debate.

4) Where are the Lessons Learned?

The PCI debate has been riddled with contradictory statements. Following the Heartland breach, the company stated publicly that it was PCI-compliant at the time of the hack. But then Adrian Phillips, Visa's Deputy Chief Enterprise Risk Officer, countered: "We've never seen anyone who was breached that was PCI compliant."

Network Solutions likewise argues that it was PCI compliant when it was breached. But David Taylor, CISSP and founder of PCI Knowledge Base, says it's a mistake for anyone to equate "compliant" with "impossible to breach."

There is no way that a committee that has to consider what is "reasonable" and "affordable" to its members and the industry as a whole can possibly design a set of standards that can prevent one clever hacker from figuring out a way to break in, then sharing his/her hack with millions via the Internet, Taylor says.

One common refrain in PCI discussions this year has been that PCI compliance represents a point in time - not a permanent state of being. To ensure ongoing compliance, financial services firms and merchants need to engage in a detailed, ongoing review of service providers to better understand what is specifically being done to protect data at rest and in transit.

No doubt, the names Heartland and Network Solutions will come up frequently in the ongoing debate. The key is: What are the lessons learned from these incidents, and how will the payment card industry strengthen its standards?

The answers to those questions will shape the true future of PCI.
Bank Info Security