September 2008

September 30, 2008

The PCI Council's Quality Assurance Program

I just returned from the PCI Security Standards Council Annual Community Meeting I attended last week in Orlando. According to the Council there were 575 delegates from 310 different organizations in attendance, representing merchants, acquirers and vendors. This is up from 320 participants last year. There is no doubt that PCI compliance is top-of-mind for many organizations.

Of the many topics covered, I want to share one area with you that I found particularly interesting. The Council is introducing a Quality Assurance Program that will be phased in starting October. Their goal is to achieve more consistency across providers, initially targeting Qualified Security Assessors (QSAs) and Authorized Scanning Vendors (ASVs). They defined specific grading scales and remediation steps that will be taken if vendors are found to be non-compliant with program standards. The Council will review a good sampling of ASVs and QSAs each year and will post the names of those vendors who are “under review” in their Website (a sort of modern day letter “A”?).

We welcome this step by the Council. When any new standard emerges (think SOX), vendors clamor to figure out how to take advantage of the market opportunity. In most cases, this works well by supplying buyers with many options at a fair price. In some case, though, vendors are looking for a way to make a quick buck, and their processes and deliverables may not meet the standards. When the security of cardholder data is at stake, this creates unknown risk for both consumers and merchants. It will be interesting to observe (and possibly participate!) in the process.

I'll keep you posted on what I continue to uncover. What do you think? Please share your thoughts with me along with other merchants like you by commenting on this post.

'Til next time,
Joan
The eSecurity Diva

Posted at 10:30 AM in PCI Issues | Permalink | Comments (1) | TrackBack (0)

September 23, 2008

The Wacky World of PCI Fines

The card processor for a tiny Mexican restaurant, hit by robbers who stole a whopping 10 to 15 receipts with credit card numbers on them, was recently fined the equivalent of $83.50 for each card because the data was not properly secured.

Meanwhile, a recent forensics analysis showed that a larger Internet merchant was possibly breached because it was storing nearly 1,500 unencrypted credit card numbers. The fine for the same processor was $4.44 per card, even though the analysis showed no proof of a breach.

Then there’s clothing retailer TJX, which we all know about. The large Level 1 merchant, whose lax security practices led to millions of compromised records, reached a settlement of 64 cents per breached credit card with Visa and 83 cents per card with MasterCard.

See anything awry here? I sure do. Ken Musante does too.

Musante, president of the processor charged in the top two fines—Humboldt Merchant Services—is lobbying for more clarification, transparency and consistency in the penalty process. There is often no rhyme nor reason in the penalties imposed now, he says in Digital Transactions, a monthly magazine that covers the North American consumer electronic transaction market. Additionally, the system unfairly penalizes processors and often takes so long that some breached merchants actually are out of business by the time the fines are levied.

His solution is that PCI forensics companies should keep a database of breaches and base network fines on that database and the following metrics:

The number of valid versus unencrypted cards compromised
The extent and amount of related information—such as expiration date and name—that were exposed
The extent and amount of prohibited information—such as magnetic-stripe data—that were compromised

Such a system would be more predictable and fairer, he says. In addition, these new guidelines would bring fines on quicker, Musante adds. It also could “hold the bank card associations more accountable.”

I believe him. The PCI fining system is pure chaos. As Forrest Gump would say, it’s like a box of chocolates. You know the rest.

Without a doubt, a more uniform and reasonable system is badly in need. If we expect more merchants to follow PCI security rules, the penalties for breaking those rules should at least be logical.

Posted at 02:54 PM in PCI Issues | Permalink | Comments (1) | TrackBack (0)

September 03, 2008

The Data Breach Paradox and Why You Should Still Do the Right Thing

Remember the federal bust in early August that netted 11 hackers who allegedly stole more than 40 million credit card numbers? Now, The Wall Street Journal reports that many of the victims of those thefts were never even notified by the restaurants and retailers who were hacked.

This is true despite the fact that some 40 states have breach notification laws.

Only four of the nine companies that were hacked clearly notified their customers. The companies that did not – Boston Market, Forever 21, and possibly Barnes and Noble, Office Max and Sports Authority – had varying excuses. One excuse was that they never “confirmed” data was stolen, the WSJ says. Barnes and Noble, Office Max and Sports Authority, meanwhile, wouldn’t even say whether they made disclosures in the first place. (A WSJ investigation found no evidence of any disclosures).

I’m surprised how little PR backlash these companies have received. It’s not only law that says you have to notify customers in the event of a breach, but it is the ethical thing to do. The only reasonable debate is how that disclosure should happen.

However, four companies – TJX, BJ’s Wholesale Club, DSW and Dave and Busters – did notify customers shortly after the breaches were discovered. These companies deserve full credit for their actions, especially TJX. The clothing retailer has been lambasted for more than a year in the press since the disclosure in early 2007.

I’m well aware of the paradox here. The four retailers that allegedly were not proactive so far have received little condemnation. And some of the retailers who were proactive are now synonymous with the words “data breach.” Not very fair.

So, does that mean that doing the right thing isn’t always the best thing? I interviewed crisis management expert Dean Trevelino, owner of public relations firm Trevelino/Keller, on this very topic. To begin, he says, all retailers should follow these three steps:

Retailers big and small need to make the necessary investments in making sure they are as protected as possible. That, of course, means having a robust and consistent security policy in place. For smaller retailers, he says, these investments ought to be weighed with substantial thought next to the revenue they may be bringing in.
All retailers – even the smaller ones – need to have a basic crisis control plan in place. This includes a to-call list -- i.e. PR, legal and IT.
If it does happen, you “absolutely need to be forthcoming,” Trevelino says. That means a disclosure within 48 hours. But he adds that no disclosure should occur if you don’t have a clear handle on how it happened. “Grab the smartest people you can find and drill down on the causes and solutions to the problem,” he says. “Once you do that, let effected customers know ASAP what they should do and what you are doing to solve the problem," he adds.

So what about the paradox? Trevelino sums it nicely:

While TJX received its fair share of bad press, the worst is over. In fact, he says, the companies on the up-and-up may be viewed rather positively, now that the thieves have been busted. In contrast, for Boston Market and the rest of them, the worst is likely yet to come.

“It’s a heck of a road back if you’re weak from a security standpoint and not forthcoming,” Trevelino says. “People will forgive you if you didn’t have enough security, especially nowadays – you’re simply just one of the many victims. But if you’re a victim and not forthcoming, that’s a difficult thing to recover from.”

Posted at 12:43 PM in Breaches | Permalink | Comments (0) | TrackBack (0)