While surfing LinkedIn recently, a user’s posted question caught my eye.

The user, a small merchant, asked whether his approach to PCI compliance was the most cost-effective way possible. As his business was recently classified as a Level 4 merchant, he said he needed only “focus on those areas where we may fall short.” He also said free or low-cost solutions might be the best option because while “not very user friendly,” they do “tick the right PCI boxes and get us PCI compliant.”  

The poster then went through several security measures he was considering, including internal scanning and file-integrity monitoring. “Or am I just wasting my time?” he asked.

Well, no. Anything you do to make your business more secure is a good thing.

But, as another LinkedIn user correctly pointed out, the merchant was asking the wrong questions.

Instead of focusing on how to (and how much) it would take to better secure customer information, the merchant instead was laser-focused on simply becoming compliant.

This is the wrong approach, tactically and psychologically. The PCI Data Security Standard is a way to validate basic data security. It’s not the Yellow Brick Road to Oz. It’s only a tool—a pretty good one—to help minimize danger along the way.

Neither I nor the other LinkedIn user, I’m sure, believes this merchant doesn’t care about the security of his customers. But the things the poster, and any merchant, should be focusing on first are the steps to improve the overall safety of cardholder data.

Steps like:

• Using a compliant payment application. You can access these applications here.
• Securing transactions. All cardholder data must be encrypted during transmission.
• Conducting regular Web application and vulnerability scans. If you have externally-facing IP addresses, conduct regular scanning to identify critical vulnerabilities for remediation.
• Setting cardholder data storage policies. Merchants should not electronically store credit card data without a compelling business reason.
• Setting access policies. Employees who don’t need access to sensitive customer information should not be given access.

As for the LinkedIn question, the reader who responded to the merchant’s post had a particularly valid point: “If you are worried about the cost (to become) PCI DSS compliant, check on the alternative. Be non-compliant when your system is compromised, then you will be talking about real money and possibly your company will go out of business.”

I couldn’t have said it better myself.

‘Till Next Time,

Joan
The eSecurityDiva

If your store was breached, could you prove you were PCI compliant?

In a new survey, 45 percent of small merchants who claimed to be PCI compliant said they did not have the documentation to support their Self Assessment Questionnaires. This key statistic indicates that many merchants are just “going through the motions” when it comes to becoming compliant with PCI guidelines.

Thankfully, the majority of these polled merchants were aware that PCI compliance was of value in securing customer data. In addition, 88 percent of them said they viewed data security as a “high” or “medium” priority.

The report, sponsored by my company, ControlScan, as well as the National Retail Federation and the PCI Knowledge Base, outlines some surprising facts about small merchants’ attitudes toward data security and provides recommended solutions to this crucial issue.

A key implication of the report: Acquirers, ISOs and other providers serving the retail industry need to exercise more leadership and better guide merchants along the path to PCI compliance.

Why do these players need to do more? More than half of the 220 polled merchants said they depend on their merchant banks and point-of-sale or payment-application vendors for this knowledge. Also, while awareness of the PCI standard is high among small merchants, the level of understanding about PCI and how to comply is not. Of the merchants who said they were not PCI compliant, the reasons cited included “don’t understand it”, “don’t have the resources” and compliance is “too hard.”

Most merchants want to be more secure and PCI compliant, but they are confused about how to go about doing it.

But don’t just take my word.

“We want to comply,” one survey taker said, “but we’re not IT gurus. Please educate us and make it clear what we need to do.”

So…here are a couple of things ISOs and acquirers can do—now—to help merchants protect credit card data:

• Loose the jargon! Explain to merchants in an easy-to-understand manner how to be more secure. Get tactical, provide the specific guidance small merchants need.
  
• Educate them on the very real risks of non compliance. Things like, 85 percent of all breaches occur at small businesses. And that fines can reach up to $25,000 monthly until compliance is achieved.
  

You can read the full report, “What Small Merchants Know (and Don’t Know) about PCI Compliance”, here.

I’ve said this before. No measures will completely eliminate the threat of hackers. As long as there is money to be had, hackers will always be there. Waiting. Scheming. Evolving.

Further, we all know PCI compliance is not perfect. But I firmly believe that if we all work a little harder—as a team—data security can improve substantially.

'Till Next Time,

Joan

The eSecurityDiva