While surfing LinkedIn recently, a user’s posted question caught my eye.

The user, a small merchant, asked whether his approach to PCI compliance was the most cost-effective way possible. As his business was recently classified as a Level 4 merchant, he said he needed only “focus on those areas where we may fall short.” He also said free or low-cost solutions might be the best option because while “not very user friendly,” they do “tick the right PCI boxes and get us PCI compliant.”  

The poster then went through several security measures he was considering, including internal scanning and file-integrity monitoring. “Or am I just wasting my time?” he asked.

Well, no. Anything you do to make your business more secure is a good thing.

But, as another LinkedIn user correctly pointed out, the merchant was asking the wrong questions.

Instead of focusing on how to (and how much) it would take to better secure customer information, the merchant instead was laser-focused on simply becoming compliant.

This is the wrong approach, tactically and psychologically. The PCI Data Security Standard is a way to validate basic data security. It’s not the Yellow Brick Road to Oz. It’s only a tool—a pretty good one—to help minimize danger along the way.

Neither I nor the other LinkedIn user, I’m sure, believes this merchant doesn’t care about the security of his customers. But the things the poster, and any merchant, should be focusing on first are the steps to improve the overall safety of cardholder data.

Steps like:

• Using a compliant payment application. You can access these applications here.
• Securing transactions. All cardholder data must be encrypted during transmission.
• Conducting regular Web application and vulnerability scans. If you have externally-facing IP addresses, conduct regular scanning to identify critical vulnerabilities for remediation.
• Setting cardholder data storage policies. Merchants should not electronically store credit card data without a compelling business reason.
• Setting access policies. Employees who don’t need access to sensitive customer information should not be given access.

As for the LinkedIn question, the reader who responded to the merchant’s post had a particularly valid point: “If you are worried about the cost (to become) PCI DSS compliant, check on the alternative. Be non-compliant when your system is compromised, then you will be talking about real money and possibly your company will go out of business.”

I couldn’t have said it better myself.

‘Till Next Time,

Joan
The eSecurityDiva

If your store was breached, could you prove you were PCI compliant?

In a new survey, 45 percent of small merchants who claimed to be PCI compliant said they did not have the documentation to support their Self Assessment Questionnaires. This key statistic indicates that many merchants are just “going through the motions” when it comes to becoming compliant with PCI guidelines.

Thankfully, the majority of these polled merchants were aware that PCI compliance was of value in securing customer data. In addition, 88 percent of them said they viewed data security as a “high” or “medium” priority.

The report, sponsored by my company, ControlScan, as well as the National Retail Federation and the PCI Knowledge Base, outlines some surprising facts about small merchants’ attitudes toward data security and provides recommended solutions to this crucial issue.

A key implication of the report: Acquirers, ISOs and other providers serving the retail industry need to exercise more leadership and better guide merchants along the path to PCI compliance.

Why do these players need to do more? More than half of the 220 polled merchants said they depend on their merchant banks and point-of-sale or payment-application vendors for this knowledge. Also, while awareness of the PCI standard is high among small merchants, the level of understanding about PCI and how to comply is not. Of the merchants who said they were not PCI compliant, the reasons cited included “don’t understand it”, “don’t have the resources” and compliance is “too hard.”

Most merchants want to be more secure and PCI compliant, but they are confused about how to go about doing it.

But don’t just take my word.

“We want to comply,” one survey taker said, “but we’re not IT gurus. Please educate us and make it clear what we need to do.”

So…here are a couple of things ISOs and acquirers can do—now—to help merchants protect credit card data:

• Loose the jargon! Explain to merchants in an easy-to-understand manner how to be more secure. Get tactical, provide the specific guidance small merchants need.
  
• Educate them on the very real risks of non compliance. Things like, 85 percent of all breaches occur at small businesses. And that fines can reach up to $25,000 monthly until compliance is achieved.
  

You can read the full report, “What Small Merchants Know (and Don’t Know) about PCI Compliance”, here.

I’ve said this before. No measures will completely eliminate the threat of hackers. As long as there is money to be had, hackers will always be there. Waiting. Scheming. Evolving.

Further, we all know PCI compliance is not perfect. But I firmly believe that if we all work a little harder—as a team—data security can improve substantially.

'Till Next Time,

Joan

The eSecurityDiva

You’ve heard the saying. What happens in Vegas stays in Vegas.

That might be true for vacationers. But thanks to a new Nevada law, merchants in that state won’t have it so easy: If you receive, transmit or store payment card information, and you’re not PCI compliant next year, you’ll be breaking the law.

Yes, Nevada has become the first state to legislate full PCI Data Security Standard compliance. Only Minnesota’s 2007 law, which involves a small portion of PCI rules, comes close. California and other “progressive” states haven’t even touched this; they’ve only passed breach notification laws or other less strict data privacy laws.

If you’re a merchant in Nevada, the effect is obvious. Comply or face additional penalties on top of those imposed by credit card brands. Plus, the new law, SB 227, among other things, particularly mandates the encryption of transmitted customer data between entities. (PCI DSS already requires this, by the way).

If you don’t do business in the Silver State, the effect could be the same. That’s because many experts, with good reason, predict other states will follow suit. Time and time again, states have followed California’s lead on similar issues.

Whether you like PCI DSS or not, or government regulation on this issue, there are some serious questions to think about.

What happens if 50 different states pass 50 different PCI-related laws? That could be rather confusing, cumbersome…and expensive. At least with Sarbanes-Oxley, a controversial accounting oversight law, it’s federal. That means one rule. In 50 states.

Also, the PCI Security Standards Council went through a thorough process to come up with its rules. Some experts such as David Taylor, founder of the PCI Knowledge Base, worry that state legislators will not go through the same processes. In a recent blog post, Taylor laments the fact that the Nevada law makes a point to add encryption…when it was already included in PCI rules. (Further, encryption itself is hardly standardized.)

“This is more proof that government organizations should not be writing technically-detailed security legislation,” Taylor writes. He continues: “Since security legislation does not have to go through such as process, I remain skeptical that state, federal or international legislation can improve on what PCI DSS already provides in terms of technical detail.”

I also wonder how strictly, if at all, these state laws will be enforced. Other things to consider—will Nevada’s upcoming law, and other PCI-related laws, actually put a dent in fraud?

Quoted in BankInfoSecurity.com, Tom Wills, a senior analyst for Javelin Strategy and Research, says Nevada’s interest is a step in a right direction. But, ultimately, “I don’t expect fraud to drop significantly because of it—until we see a strong educational push,” he says.

Bottom line, legislation might spread the wrong belief that PCI compliance is the absolute goal. As I’ve said several times in this blog, PCI compliance is only a point-in-time measurement. Security is an ongoing process.

I hope our state legislators have a firm grasp of this concept when they tackle this very important issue.

Till Next Time,

Joan,
The eSecurityDiva

As Payment Card Industry deadlines come and go, I’ve noticed a rash of acquiring banks, card processors, ISOs AND vendors jumping into the mix to get a piece of the compliance pie fees.

So, what does this mean for small- or medium-sized merchants? Well, this influx does show that companies of all walks are becoming more aware of security and PCI compliance. That is good.

But the influx also means plenty of opportunities for questionable practices that may not serve to improve the true state of security with the best interest of the merchants. That is not good.

Becoming PCI compliant is a daunting task for any merchant, especially small merchants. Whether you’re a merchant or an acquirer, you should learn more about security and PCI before selecting a compliance partner. You should also beware of simply going with the vendor who offers the lowest fees. Understand what you can expect from the PCI vendor and make sure the result is a more secure business.

Despite the inherent complexities surrounding PCI compliance, we’ve all seen ill-conceived  programs that don’t provide the most basic of services or support to merchants. Some don’t even provide a basic education in PCI. Bottom line, smaller merchants need real help with becoming—and staying—compliant.

After all, no one wins if you get fined. Or worse, breached.

Which makes me think. What is really driving this behavior? Is it to protect shoppers’ payment card data? Is it to minimally satisfy the card brands’ mandates? Or is it to create an incremental revenue stream?

Can these drivers co-exist…or are they mutually exclusive?

Some recent trends suggest to me that it will take a while for the PCI market to shake out. Merchants and acquirers will eventually grow wise to shoddy activity and will gravitate toward quality PCI-compliance services. Unfortunately, in the meantime, not enough is being done to truly advance increased security for small merchants. 

Congress is aware of this, as we’ve seen with the recent PCI hearings. As the pendulum tilts toward more regulation on everything from carbon emissions to debt lending, this lack of true security improvements could ultimately lead to Congress legislating compliance—which the PCI Council has been diligently working at to avoid.

Worse, these trends will hurt your efforts to become PCI compliant, which will ultimately leave your shoppers more exposed to hackers and data thieves.

As the new PCI market begins to mature, having the right partners will help you stay compliant in the most efficient manner possible. Having the right partners will also ensure you’re not being taken advantage of.

‘Til Next Time,

Joan
The eSecurity Diva

I just returned from the PCI Security Standards Council Annual Community Meeting I attended last week in Orlando. According to the Council there were 575 delegates from 310 different organizations in attendance, representing merchants, acquirers and vendors. This is up from 320 participants last year.  There is no doubt that PCI compliance is top-of-mind for many organizations.

Of the many topics covered, I want to share one area with you that I found particularly interesting.  The Council is introducing a Quality Assurance Program that will be phased in starting October.  Their goal is to achieve more consistency across providers, initially targeting Qualified Security Assessors (QSAs) and Authorized Scanning Vendors (ASVs).  They defined specific grading scales and remediation steps that will be taken if vendors are found to be non-compliant with program standards. The Council will review a good sampling of ASVs and QSAs each year and will post the names of those vendors who are “under review” in their Website (a sort of modern day letter “A”?).

We welcome this step by the Council.  When any new standard emerges (think SOX), vendors clamor to figure out how to take advantage of the market opportunity.  In most cases, this works well by supplying buyers with many options at a fair price.  In some case, though, vendors are looking for a way to make a quick buck, and their processes and deliverables may not meet the standards.  When the security of cardholder data is at stake, this creates unknown risk for both consumers and merchants.  It will be interesting to observe (and possibly participate!) in the process.

I'll keep you posted on what I continue to uncover. What do you think? Please share your thoughts with me along with other merchants like you by commenting on this post.

'Til next time,
Joan
The eSecurity Diva

The card processor for a tiny Mexican restaurant, hit by robbers who stole a whopping 10 to 15 receipts with credit card numbers on them, was recently fined the equivalent of $83.50 for each card because the data was not properly secured.

Meanwhile, a recent forensics analysis showed that a larger Internet merchant was possibly breached because it was storing nearly 1,500 unencrypted credit card numbers. The fine for the same processor was $4.44 per card, even though the analysis showed no proof of a breach.

Then there’s clothing retailer TJX, which we all know about. The large Level 1 merchant, whose lax security practices led to millions of compromised records, reached a settlement of 64 cents per breached credit card with Visa and 83 cents per card with MasterCard.

See anything awry here? I sure do. Ken Musante does too.

Musante, president of the processor charged in the top two fines—Humboldt Merchant Services—is lobbying for more clarification, transparency and consistency in the penalty process. There is often no rhyme nor reason in the penalties imposed now, he says in Digital Transactions, a monthly magazine that covers the North American consumer electronic transaction market. Additionally, the system unfairly penalizes processors and often takes so long that some breached merchants actually are out of business by the time the fines are levied.

His solution is that PCI forensics companies should keep a database of breaches and base network fines on that database and the following metrics:

• The number of valid versus unencrypted cards compromised
• The extent and amount of related information—such as expiration date and name—that were exposed
• The extent and amount of prohibited information—such as magnetic-stripe data—that were compromised

Such a system would be more predictable and fairer, he says. In addition, these new guidelines would bring fines on quicker, Musante adds. It also could “hold the bank card associations more accountable.”

I believe him. The PCI fining system is pure chaos. As Forrest Gump would say, it’s like a box of chocolates. You know the rest.

Without a doubt, a more uniform and reasonable system is badly in need. If we expect more merchants to follow PCI security rules, the penalties for breaking those rules should at least be logical.