Is regulation coming to a point-of-sale device near you?

It certainly appears so. At least if the credit card ecosystem—banks, processors, security companies, assessors and retailers—doesn’t do more to ensure consumer transactions are safer.

Last week, Congress held hearings designed to get to the bottom of what is being done, and what can be done, to help stem the tide of cyber fraud and identity theft. It left little to debate. More has to be done. Now.

Bottom line, said a no-nonsense Rep. Yvette Clarke, chairwoman of the subcommittee that held the hearing, just being PCI compliant does not guarantee security.

Clarke said a recent investigation found PCI standards are of “questionable strength and effectiveness.” As a result, she warned, retailers need to take proactive measures to protect themselves and their consumers. She also said new security technologies and practices are needed—ASAP:

“The time for waiting is over. The time for shifting risk is over. Today, the responsibility is yours to make this situation better.”

Clarke spoke those words to a panel consisting of high-ranking representatives from the Department of Justice, the PCI Security Standards Council, Visa, Michaels Stores and the National Retail Federation.

For a change, it certainly appeared to me that our elected officials got it. And I also think the panel did an excellent job delivering a down-and-dirty assessment of the strengths, limits and dangers of our current security compliance system. Even if they did shift blame a little.

I think we all can appreciate just how vulnerable we are when Rep. Dan Lungren, vice chair of the committee, admitted his family was recently a victim of credit card fraud. He was particularly peeved at how he was informed: Embarrassingly, at a restaurant, when the waiter said his card wasn’t working. When Lungren called the credit card company, it didn’t have any information other than his account had been “compromised.”

Talk about more work to be done. If this can happen to Lungren, it can happen to anyone.

The PCI Council’s Robert Russo said his organization’s standards are solid. The challenge is that the council doesn’t enforce standards. That’s up to the credit card brands and the banks/processors. Many companies also approach PCI with a checking-the-box mentality. PCI compliance should be viewed as an opportunity to build solid security best practices for long term security versus point in time security. Visa’s Joseph Majka, meanwhile, said the credit card company never found a breached company to not be in compliance with PCI standards.

Regardless of these testimonials, data security standards need some work, said Michael Jones, CIO of Michaels Stores, who delivered a no-holds barred critique on the PCI compliance process. These standards were “set up for the credit card companies and banks to have all the power over fines and mandates,” Jones testified. “It is not an industry standards body.”

He continues: “We would be more secure…if the credit card companies would take more responsibility.”

Jones’ concerns: The inconsistencies, confusion, high cost and ambiguity in data security standards. Not to mention the credit card monopoly that controls these standards. While there is some debate over his particular issues, I agree PCI standards need to be much better. I also agree more responsibility can be shared. The retailer, after a breach, is left holding the bag. The retailer is demonized in the press. And it is often the one hit with fines.

We can debate the fine points of Jones’ concerns all we want. But it’s clear the United States is lagging behind. And it’s also clear retailers’ systems need to be better protected. While several European countries have enacted stricter and smarter standards, regulations and technologies, fraud has decreased in those countries. However, it is increasing globally, chairman Clarke points out. Why is this? Because hackers are taking advantage of countries with weaker technologies and security practices.

In other words, countries such as the United States. Of course, we must all keep in mind that the European countries' new technologies have much fewer companies to worry about versus the United States.

In a coming post, I will lay out some best practices specifically focused on small merchants. In the meantime, the seriousness of the situation cannot be underestimated. Not only are U.S. retailers the means of which more hackers are becoming rich, but U.S. retailers are also the means of which terrorists are financing their murderous activities.

Clarke reminded the panel that the 2002 Bali nightclub bomber financed his mission with credit card fraud.

Terrorists are clearly on the hunt for cyber vulnerabilities.

They could find that next vulnerability in your system.

Until next time,

Joan
The eSecurityDiva

With all the talk over the last few years about skyrocketing breach disclosures, it would seem as if the problem is pretty widespread, right?

If you only rely on what you hear in public disclosures, you don’t get the full picture. Actually, the published reports only scratch the surface.

According to research firm Gartner, 42 percent of U.S. retailers interviewed in a recent survey were “certain” they had been breached by a hacker. Only 14 percent, however, actually disclosed the incident to the public.

The types of threats Gartner used for the survey include “phishing” attacks, stolen laptops, outside hacks and insider breaches. Of the 50 subjects, four had been fined by credit card companies for not meeting Payment Card Industry (PCI) rules. Eleven were threatened with fines.

It appears the problem will only get more unsavory. Credit card companies predict incidences of payment card fraud will double over the next two years.

These statistics are important for a number of reasons. First, the top industry affected by data breaches is retail. About 20 percent of all hacks happen to  retailers, Gartner says. In particular, my research shows that smaller retailers are more likely not to disclose these breaches. And worse, smaller retailers are often at more risk because they have fewer resources and often lack adequate security.

Another important reason is that retailers – big and small – are simply afraid of the negative publicity associated with a breach. As a result, successful hacks are often swept under the proverbial rug. This matter is important to governments across the world, many of which are now grappling with how to keep consumers safer from identity theft.

It is certainly gaining attention in Canada. In a scathing report issued June 3 by the country’s privacy commissioner, nine in 10 people whose data were compromised had been put at risk because their information was simply stored in an unsecured electronic format. Plus, the report said too many companies are failing to implement “elementary security measures” such as firewalls or laptop encryption. These are basic things here, folks.

Due to reports such as these, tough data breach notification legislation is likely just around the corner.

So, what’s the best solution here? Some say the government should force companies to publicize all data breaches. But, according to a recent research report by Carnegie Mellon University, that measure may not help security at all.

Rather, the easiest solution is to be proactive, not reactive. Here are some easy tips you can perform to keep your customers safer and your bottom line higher:

1. Inventory all sensitive data held by your company and identify possible threats, from security holes in your network to unhappy employees.
2. Keep employees on a need-to-know basis. You should always limit employees’ access to crucial data. If they don't need to see particular data, don't give them access.
3. Truncate all credit card numbers and delete expiration dates on customer receipts. An expiration date coupled with another form of data is often all a criminal needs to steal a customer’s identity and money. This is required by law.
4. Investigate your vendors to make sure they have adopted industry-accepted security practices.
5. Shred all records containing sensitive information if the records aren’t needed. Why risk identity theft for something you don’t even need?

'Til next time,

Joan
The eSecurity Diva

Type the word "economy" in Google News and most of the headlines that pop up have negative descriptors in them, from "sluggish" and "troubled" to "cooling" and "slowing." Do the same for "retail" and you get a mixed bag of gloom, cautious optimism and mildly good news.

Despite "sluggish" retail sales due to the "slowing" economy, though, a substantial surge is expected for online sales. According to a new report by research firm Forrester, online spending is expected to grow 17 percent this year to $204 billion. That may not be hockey-stick growth. But it's pretty substantial, especially given the health of the overall economy.

In particular, small online businesses are expected to fare well. Websites operated by smaller businesses, Forrester says, are where one-fourth of all online sales occur. And that's expected to increase, as online retail is attractive to many entrepreneurs because start-up costs are usually low.

So, if the economy is at best sluggish, why would people be spending more money online?

There are several reasons. One is that consumers are increasingly getting comfortable using the Internet to buy things. But the price of gasoline is another reason. Gas prices are hitting record highs across the country and not only don't show signs of decreasing but look as if they will continue to rise. In Arizona -- which enjoys some of the lowest gas prices in the country -- the cost for a gallon right now is $3.61, AAA says. That's a record high. And it's still 19 cents below the national average.

Consumers are simply traveling less to save money on gas. So that means even if retail spending is flat, consumers are spending more on the Internet. According to e-commerce software maker iCongo, 33 percent of respondents in a recent survey said they were "more likely" to shop online than in-person because of high gas prices. That's almost hockey-stick growth.

If you think a sluggish, slowing or cooling -- whatever it may be -- economy is a time to scale back on marketing expenses, think again. I believe it's a great time to consider scaling up spending aimed at optimizing e-commerce Websites, especially given the stats above.

According to a new survey by Opinion Research Corp., 14 percent of shoppers are "frustrated" by malfunctioning Websites. Don't let your customers be in that 14 percent. In addition to ironing out basic kinks, you can do the following five things to take advantage of this uptick in online spending:

1. Let shoppers know where they are in the checkout process.
2. Fine-tune your navigation, as intuitive page flow definitely increases the likelihood of a sale.
3. Make all images clickable, with a call to action.
4. Add a search box, as you will get insight into what shoppers want and help them find stuff faster -- on your site as opposed to your competitor's.
5. Fine-tune your search engine optimization (for another post).

'Til next time,

Joan
The eSecurityDiva