Posted by Mark Brousseau
Data center managers could be facing even more pressure. R. Edwin Pearce (epearce@egisticsinc.com), executive vice president of sales and corporate development for eGistics, Inc. (www.egisticsinc.com), explains:
Just when data center and IT managers assumed things couldn’t get any worse, along comes a report from Gartner predicting that the critical issues facing data centers – namely, technology, space and energy challenges – will worsen in 2010. Coupled with the tremendous cost pressures brought on by the economic downturn, the Gartner report should provide a heightened sense of urgency for data center and IT managers looking for pragmatic ways in which to deal with their operations issues.
In its report, Gartner provides several tips for helping reduce data center costs:
• Eliminate those systems that are underutilized or old
• Consolidate multiple sites
• Better manage energy and facilities costs
• Better manage people costs
• Delay the procurement of new assets
To be sure, these are all sound strategies. But savvy data center managers already have implemented (or at least considered) these strategies in response to the economic downturn. In other words, most data centers may have already squeezed as much savings as possible from their infrastructure.
Responding to the data center challenges that Gartner predicts requires a different approach.
Hosted Archive and Delivery
A better strategy is to leverage a hosted image and data archive to address today’s today data center challenges. Able to support images and data from any source, in virtually any format, a hosted archive provides authorized users with access to business information, anytime and anywhere via the Internet. Further, hosted archive solutions can integrate easily into an organization’s existing operations and IT environment, underlying a heterogeneous applications infrastructure.
Assuming companies partner with a provider that leverages redundant Tier 1 state-of-the-art facilities using national communications firms, hosted solutions offer other benefits compared to in-house:
Totally Variable Expense – Hosted archive solutions require no capital investment; customers typically are charged a one-time load fee to add documents. And when an array fills up, or a server must be replaced, it’s the hosted archive vendor’s problem.
Improved Compliance and Security – No one can argue the alphabet soup of stiffer regulatory requirements to control information. Leveraging a hosted redundant archive solution allows companies to offload much of this burden on their vendor. To address the compliance and security issues a vendor must use facilities that are SAS-70 I and II certified, HIPAA compliant, provide audit trails on all activity, and puts stringent controls on access.
Solution Flexibility –Hosted archive solutions vendors already are adept in providing services for multiple applications, processes and document types, and with distributed environments. Most vendors also have the ability to deliver tailored solutions that an internal IT department may not have the expertise to develop. Similarly, hosted solutions can be rapidly installed, and applications quickly added.
Scalability – The performance of in-house archives deteriorates with high volumes and the addition of applications. But there are hosted solutions that archive tens of billions of documents – growing by hundreds of millions per month – with no negative impact. What’s more, the ability to scale hosted archive load rates depending on needs opens unprecedented opportunities for companies who need scalability and availability during times of peak demand, but also need to keep their costs low.
Guaranteed Performance – By virtue of their redundancy and automatic failover, most hosted solutions providers will offer service level agreements (SLAs) guaranteeing 99.999 percent availability – or just 26 minutes of downtime per year. That’s piece of mind.
This all adds up to a comprehensive solution that can help organizations meet worsening data center challenges, while laying a solid foundation that can improve corporate agility and enhance service.
What do you think? Post your comments below.
Showing posts with label PCI compliance. Show all posts
Showing posts with label PCI compliance. Show all posts
Wednesday, January 13, 2010
Wednesday, January 6, 2010
New PCI Compliance Challenge
Posted by Mark Brousseau
Remittance operations face even greater challenges from new PCI compliance guidelines. Doug Myers, vice president of sales and business development for Creditron, explains:
A flurry of new regulations, guidelines and clarifications designed to improve credit card security has remittance operations that handle credit card payments -- in the back-office or via walk-up locations -- scrambling. With three new pieces of guidance on the docket for Payment Card Industry (PCI) compliance, and larger fines for non-compliance, these operations face external pressures to beat the deadlines, as well as internal pressures to meet requirements in a strategic and cost-effective manner.
PCI and RP
The PCI Standard is the result of a collaborative effort formed by the five major credit card companies (Visa International, MasterCard Worldwide, American Express, Discover Financial Services and JCB) to develop an efficient approach to safeguarding sensitive data and for the prevention of credit card fraud, hacking and various other security concerns. Any merchant, organization or software that processes, stores or disseminates credit card data must be PCI DSS compliant or they risk hefty fines and/or losing the ability to process credit cards altogether.
Remittance processors that accept credit card payments in lieu of checks must meet the standard.
Failure to comply with PCI standards exposes an organization to two types of liability: substantial penalties, and, more importantly, "charge-back" liability for damages suffered by the card issuer as a result of a data breach. The losses sustained by card issuers includes not only the fraudulent charges made on the accounts of the victims of identity theft, but also the administrative costs associated with the issuance of new cards to customers whose personal information may have been compromised. As a result, these costs can be significant. Add in the damage to reputation associated with the loss of customer card details, and the importance of PCI compliance to remittance processors becomes clear.
Conversely, in an environment where consumers are concerned about privacy and online security, there is an opportunity for businesses to improve their security posture by meeting the PCI standard.
What You Should Do
Remittance operations put their organizations at great risk if due diligence is not practiced and steps are not taken to protect cardholder and member data. Managers must take a very active approach to operational risk management, and not assume that the PCI DSS standard doesn't apply to them.
One strategy to ensure PCI compliance for remittance operations is to work with vendors that have already deployed a PCI compliance program for their entire end-to-end suite. With this approach, the onus is on the vendor to ensure that their underlying software and processes gain and maintain PCI compliance. This won't let operations off the hook for PCI, but it is a lower cost route to compliance.
To see if your vendor has a validated PCI application, visit www.pcisecuritystandards.org.
Remittance operations face even greater challenges from new PCI compliance guidelines. Doug Myers, vice president of sales and business development for Creditron, explains:
A flurry of new regulations, guidelines and clarifications designed to improve credit card security has remittance operations that handle credit card payments -- in the back-office or via walk-up locations -- scrambling. With three new pieces of guidance on the docket for Payment Card Industry (PCI) compliance, and larger fines for non-compliance, these operations face external pressures to beat the deadlines, as well as internal pressures to meet requirements in a strategic and cost-effective manner.
PCI and RP
The PCI Standard is the result of a collaborative effort formed by the five major credit card companies (Visa International, MasterCard Worldwide, American Express, Discover Financial Services and JCB) to develop an efficient approach to safeguarding sensitive data and for the prevention of credit card fraud, hacking and various other security concerns. Any merchant, organization or software that processes, stores or disseminates credit card data must be PCI DSS compliant or they risk hefty fines and/or losing the ability to process credit cards altogether.
Remittance processors that accept credit card payments in lieu of checks must meet the standard.
Failure to comply with PCI standards exposes an organization to two types of liability: substantial penalties, and, more importantly, "charge-back" liability for damages suffered by the card issuer as a result of a data breach. The losses sustained by card issuers includes not only the fraudulent charges made on the accounts of the victims of identity theft, but also the administrative costs associated with the issuance of new cards to customers whose personal information may have been compromised. As a result, these costs can be significant. Add in the damage to reputation associated with the loss of customer card details, and the importance of PCI compliance to remittance processors becomes clear.
Conversely, in an environment where consumers are concerned about privacy and online security, there is an opportunity for businesses to improve their security posture by meeting the PCI standard.
What You Should Do
Remittance operations put their organizations at great risk if due diligence is not practiced and steps are not taken to protect cardholder and member data. Managers must take a very active approach to operational risk management, and not assume that the PCI DSS standard doesn't apply to them.
One strategy to ensure PCI compliance for remittance operations is to work with vendors that have already deployed a PCI compliance program for their entire end-to-end suite. With this approach, the onus is on the vendor to ensure that their underlying software and processes gain and maintain PCI compliance. This won't let operations off the hook for PCI, but it is a lower cost route to compliance.
To see if your vendor has a validated PCI application, visit www.pcisecuritystandards.org.
Tuesday, July 21, 2009
PCI Compliance No Guarantee
Posted by Mark Brousseau
PCI-compliant companies aren't immune from data breaches.
A new report from Javelin Strategy & Research (www.javelinstrategy.com) looks at the top reasons payment card breaches that have occurred despite compliance measures.
“The PCI Data Security Standard has raised the high water mark for security,” said Mary Monahan, Managing Partner & Research Director, Javelin Strategy & Research. “But there’s a persistent myth that compliance guarantees security. The reality is that PCI compliance is only a baseline. It needs to be monitored constantly as the threat landscape changes.”
Javelin Strategy & Research says the top three breach vulnerabilities of PCI-compliant companies occur because of poor tracking and monitoring, insecure Web applications, and inadequate protection of stored cardholder data. At PCI-certified companies that are breached, many compliance requirements are often found to be out-of-compliance, the firm notes.
“The notion that certified PCI-compliant companies cannot be breached is a myth,” said Robert Vamosi, Research Analyst, Risk, Fraud, and Security, Javelin Strategy & Research. “Our research has found that qualified security assessors can mishandle the PCI certification process or businesses may be compliant during the audit, but not follow-through later. In addition, compliance improves security, but it does not prevent breaches. Merchants, the PCI Council and issuers must continue to work together to resolve reoccurring complaints and speak with one voice against the common threats of loss and fraud.”
What do you think? Post your comments below.
PCI-compliant companies aren't immune from data breaches.
A new report from Javelin Strategy & Research (www.javelinstrategy.com) looks at the top reasons payment card breaches that have occurred despite compliance measures.
“The PCI Data Security Standard has raised the high water mark for security,” said Mary Monahan, Managing Partner & Research Director, Javelin Strategy & Research. “But there’s a persistent myth that compliance guarantees security. The reality is that PCI compliance is only a baseline. It needs to be monitored constantly as the threat landscape changes.”
Javelin Strategy & Research says the top three breach vulnerabilities of PCI-compliant companies occur because of poor tracking and monitoring, insecure Web applications, and inadequate protection of stored cardholder data. At PCI-certified companies that are breached, many compliance requirements are often found to be out-of-compliance, the firm notes.
“The notion that certified PCI-compliant companies cannot be breached is a myth,” said Robert Vamosi, Research Analyst, Risk, Fraud, and Security, Javelin Strategy & Research. “Our research has found that qualified security assessors can mishandle the PCI certification process or businesses may be compliant during the audit, but not follow-through later. In addition, compliance improves security, but it does not prevent breaches. Merchants, the PCI Council and issuers must continue to work together to resolve reoccurring complaints and speak with one voice against the common threats of loss and fraud.”
What do you think? Post your comments below.
Monday, June 15, 2009
Credit Card Security Problems
Posted by Mark Brousseau
An interesting article from the Associated Press on how lax requirements leave consumer data at risk of attack by hackers:
Weak security enables credit card hacks
By JORDAN ROBERTSON
AP Technology Writer
Every time you swipe your credit card and wait for the transaction to be approved, sensitive data including your name and account number are ferried from store to bank through computer networks, each step a potential opening for hackers.
And while you may take steps to protect yourself against identity theft, an Associated Press investigation has found the banks and other companies that handle your information are not being nearly as cautious as they could.
The government leaves it to card companies to design security rules that protect the nation's 50 billion annual transactions. Yet an examination of those industry requirements explains why so many breaches occur: The rules are cursory at best and all but meaningless at worst, according to the AP's analysis of data breaches dating to 2005.
It means every time you pay with plastic, companies are gambling with your personal data. If hackers intercept your numbers, you'll spend weeks straightening your mangled credit, though you can't be held liable for unauthorized charges. Even if your transaction isn't hacked, you still lose: Merchants pass to all their customers the costs they incur from fraud.
More than 70 retailers and payment processors have disclosed breaches since 2006, involving tens of millions of credit and debit card numbers, according to the Privacy Rights Clearinghouse. Meanwhile, many others likely have been breached and didn't detect it. Even the companies that had the payment industry's top rating for computer security, a seal of approval known as PCI compliance, have fallen victim to huge heists.
Companies that are not compliant with the PCI standards - including one in 10 of the medium-sized and large retailers in the United States - face fines but are left free to process credit and debit card payments. Most retailers don't have to endure security audits, but can evaluate themselves.
Credit card providers don't appear to be in a rush to tighten the rules. They see fraud as a cost of doing business and say stricter security would throw sand into the gears of the payment system, which is built on speed, convenience and low cost.
That is of little consolation to consumers who bet on the industry's payment security and lost.
It took four months for Pamela LaMotte, 46, of Colchester, Vt., to fix the damage after two of her credit card accounts were tapped by hackers in a breach traced to a Hannaford Bros. grocery store.
LaMotte, who was unemployed at the time, says she had to borrow money from her mother and boyfriend to pay $500 in overdraft and late fees - which were eventually refunded - while the banks investigated.
"Maybe somebody who doesn't live paycheck to paycheck, it wouldn't matter to them too much, but for me it screwed me up in a major way," she said. LaMotte says she pays more by cash and check now.
It all happened at a supermarket chain that met the PCI standards. Someone installed malicious software on Hannaford's servers that snatched customer data while it was being sent to the banks for approval.
Since then, hackers plundered two companies that process payments and had PCI certification. Heartland Payment Systems lost card numbers, expiration dates and other data for potentially hundreds of millions of shoppers. RBS WorldPay Inc. got taken for more than 1 million Social Security numbers - a golden ticket to hackers that enables all kinds of fraud.
In the past, each credit card company had its own security rules, a system that was chaotic for stores.
In 2006, the big card brands - Visa, MasterCard, American Express, Discover and JCB International - formed the Payment Card Industry Security Standards Council and created uniform security rules for merchants.
Avivah Litan, a Gartner Inc. analyst, says retailers and payment processors have spent more than $2 billion on security upgrades to comply with PCI. And the payment industry touts the fact that 93 percent of big retailers in the U.S., and 88 percent of medium-sized ones, are compliant with the PCI rules.
That leaves plenty of merchants out, of course, but the main threat against them is a fine: $25,000 for big retailers for each month they are not compliant, $5,000 for medium-sized ones.
Computer security experts say the PCI guidelines are superficial, including requirements that stores run antivirus software and install computer firewalls. Those steps are designed to keep hackers out and customer data in. Yet tests that simulate hacker attacks are required just once a year, and businesses can run the tests themselves.
"It's like going to a doctor and getting your blood pressure read, and if your blood pressure's good you get a clean bill of health," said Tom Kellermann, a former senior member of the World Bank's Treasury security team and now vice president of security awareness for Core Security Technologies, which audited Google's Internet payment processing system.
Merchants that decide to hire an outside auditor to check for compliance with the PCI rules need not spend much. Though some firms generally charge about $60,000 and take months to complete their inspections, others are far cheaper and faster.
"PCI compliance can cost just a couple hundred bucks," said Jeremiah Grossman, founder of WhiteHat Security Inc., a Web security firm. "If that's the case, all the incentives are in the wrong direction. The merchants are inclined to go with the cheapest certification they need."
For some inspectors, the certification course takes just one weekend and ends in an open-book exam. Applicants must have five years of computer security experience, but once they are let loose, there's little oversight of their work. Larger stores take it on themselves to provide evidence to auditors that they comply with the rules, leaving the door open for mistakes or fraud.
And retailers with fewer than 6 million annual card transactions - a group comprising more than 99 percent of all retailers - do not even need auditors. They can test and evaluate themselves.
At the same time, the card companies themselves are increasingly hands-off.
Two years ago, Visa scaled back its review of inspection records for the payment processors it works with. It now examines records only for payment processors with computer networks directly connected to Visa's.
In the U.S., that means fewer than 100 payment processors out of the 700 that Visa works with are PCI-compliant.
Visa's head of global data security, Eduardo Perez, said the company scaled back its records review because it took too much work and because the PCI standards have improved the industry's security "considerably."
"I think we've made a lot of progress," he said. "While there have been a few large compromises, there are many more compromises we feel we've helped prevent by driving these minimum requirements."
Representatives for MasterCard, American Express, Discover and JCB - which, along with Visa, steer PCI policy - either didn't return messages from the AP or directed questions to the PCI security council.
PCI's general manager, Bob Russo, said inspector certification is "rigorous." Yet he also acknowledged that inconsistent audits are a problem - and that merchants and payment processors who suffered data breaches possibly shouldn't have been PCI-certified. Those companies also might have easily fallen out of compliance after their inspection, by not installing the proper security updates, and nobody noticed.
The council is trying to crack down on shoddy work by requiring annual audits for the dozen companies that do the bulk of the PCI inspections. Smaller firms will be examined once every three years.
Those reviews merely scratch the surface, though. Only three full-time staffers are assigned to the task, and they can't visit retailers themselves. They are left to review the paperwork from the examinations.
The AP contacted eight of the biggest "acquiring banks" - the banks that retailers use as middlemen between the stores and consumers' banks. Those banks are responsible for ensuring that retailers are PCI compliant. Most didn't return calls or wouldn't comment for this story.
Mike Herman, compliance managing director for Chase Paymentech, a division of JPMorgan Chase, said his bank has five workers reviewing compliance reports from retailers. Most of the work is done by phone or e-mail.
"We have faith in the certification process, and we really haven't doubted the assessors' work," Herman said. "It's really the merchants that don't engage assessors; those get a little more scrutiny."
He defended the system: "Can you imagine how many breaches we'd have and how severe they'd be if we didn't have PCI?"
Supporters of PCI point out nearly all big and medium-sized retailers governed by the standard now say they no longer store sensitive cardholder data. Just a few years ago they did - leaving credit card numbers in databases that were vulnerable to hackers.
So why are breaches still happening? Because criminals have sharpened their attacks and are now capturing more data as it makes its way from store to bank, when breaches are harder to stop.
Security experts say there are several steps the payment industry could take to make sure customer information doesn't leak out of networks.
Banks could scramble the data that travels over payment networks, so it would be meaningless to anyone not authorized to see it.
For example, TJX Cos., the chain that owns T.J. Maxx and Marshalls and was victimized by a breach that exposed as many as 100 million accounts, the most on record, has tightened its security but says many banks won't accept data in encrypted form.
PCI requires data transmitted across "open, public networks" to be encrypted, but that means hackers with access to a company's internal network still can get at it. Requiring encryption all the time would be expensive and slow transactions.
Another possibility: Some security professionals think the banks and credit card companies should start their own PCI inspection arms to make sure the audits are done properly. Banks say they have stepped up oversight of the inspections, doing their own checks of questionable PCI assessment jobs. But taking control of the whole process is far-fetched: nobody wants the liability.
PCI could also be optional. In its place, some experts suggest setting fines for each piece of sensitive data a retailer loses.
The U.S. might also try a system like Europe's, where shoppers need a secret PIN code and card with a chip inside to complete purchases. The system, called Chip and PIN, has cut down on fraud there (because it's harder to use counterfeit cards), but transferred it elsewhere - to places like the U.S. that don't have as many safeguards.
A key reason PCI exists is that the banks and card brands don't want the government regulating credit card security. These companies also want to be sure transactions keep humming through the system - which is why banks and card companies are willing to put up with some fraud.
"If they did mind, they have immense resources and could really change things," said Ed Skoudis, co-founder of security consultancy InGuardians Inc. and an instructor with the SANS Institute, a computer-security training organization. Skoudis investigates retail breaches in support of government investigations. "But they don't want to strangle the goose that laid the golden egg by making it too hard to accept credit cards, because that's bad for everybody."
An interesting article from the Associated Press on how lax requirements leave consumer data at risk of attack by hackers:
Weak security enables credit card hacks
By JORDAN ROBERTSON
AP Technology Writer
Every time you swipe your credit card and wait for the transaction to be approved, sensitive data including your name and account number are ferried from store to bank through computer networks, each step a potential opening for hackers.
And while you may take steps to protect yourself against identity theft, an Associated Press investigation has found the banks and other companies that handle your information are not being nearly as cautious as they could.
The government leaves it to card companies to design security rules that protect the nation's 50 billion annual transactions. Yet an examination of those industry requirements explains why so many breaches occur: The rules are cursory at best and all but meaningless at worst, according to the AP's analysis of data breaches dating to 2005.
It means every time you pay with plastic, companies are gambling with your personal data. If hackers intercept your numbers, you'll spend weeks straightening your mangled credit, though you can't be held liable for unauthorized charges. Even if your transaction isn't hacked, you still lose: Merchants pass to all their customers the costs they incur from fraud.
More than 70 retailers and payment processors have disclosed breaches since 2006, involving tens of millions of credit and debit card numbers, according to the Privacy Rights Clearinghouse. Meanwhile, many others likely have been breached and didn't detect it. Even the companies that had the payment industry's top rating for computer security, a seal of approval known as PCI compliance, have fallen victim to huge heists.
Companies that are not compliant with the PCI standards - including one in 10 of the medium-sized and large retailers in the United States - face fines but are left free to process credit and debit card payments. Most retailers don't have to endure security audits, but can evaluate themselves.
Credit card providers don't appear to be in a rush to tighten the rules. They see fraud as a cost of doing business and say stricter security would throw sand into the gears of the payment system, which is built on speed, convenience and low cost.
That is of little consolation to consumers who bet on the industry's payment security and lost.
It took four months for Pamela LaMotte, 46, of Colchester, Vt., to fix the damage after two of her credit card accounts were tapped by hackers in a breach traced to a Hannaford Bros. grocery store.
LaMotte, who was unemployed at the time, says she had to borrow money from her mother and boyfriend to pay $500 in overdraft and late fees - which were eventually refunded - while the banks investigated.
"Maybe somebody who doesn't live paycheck to paycheck, it wouldn't matter to them too much, but for me it screwed me up in a major way," she said. LaMotte says she pays more by cash and check now.
It all happened at a supermarket chain that met the PCI standards. Someone installed malicious software on Hannaford's servers that snatched customer data while it was being sent to the banks for approval.
Since then, hackers plundered two companies that process payments and had PCI certification. Heartland Payment Systems lost card numbers, expiration dates and other data for potentially hundreds of millions of shoppers. RBS WorldPay Inc. got taken for more than 1 million Social Security numbers - a golden ticket to hackers that enables all kinds of fraud.
In the past, each credit card company had its own security rules, a system that was chaotic for stores.
In 2006, the big card brands - Visa, MasterCard, American Express, Discover and JCB International - formed the Payment Card Industry Security Standards Council and created uniform security rules for merchants.
Avivah Litan, a Gartner Inc. analyst, says retailers and payment processors have spent more than $2 billion on security upgrades to comply with PCI. And the payment industry touts the fact that 93 percent of big retailers in the U.S., and 88 percent of medium-sized ones, are compliant with the PCI rules.
That leaves plenty of merchants out, of course, but the main threat against them is a fine: $25,000 for big retailers for each month they are not compliant, $5,000 for medium-sized ones.
Computer security experts say the PCI guidelines are superficial, including requirements that stores run antivirus software and install computer firewalls. Those steps are designed to keep hackers out and customer data in. Yet tests that simulate hacker attacks are required just once a year, and businesses can run the tests themselves.
"It's like going to a doctor and getting your blood pressure read, and if your blood pressure's good you get a clean bill of health," said Tom Kellermann, a former senior member of the World Bank's Treasury security team and now vice president of security awareness for Core Security Technologies, which audited Google's Internet payment processing system.
Merchants that decide to hire an outside auditor to check for compliance with the PCI rules need not spend much. Though some firms generally charge about $60,000 and take months to complete their inspections, others are far cheaper and faster.
"PCI compliance can cost just a couple hundred bucks," said Jeremiah Grossman, founder of WhiteHat Security Inc., a Web security firm. "If that's the case, all the incentives are in the wrong direction. The merchants are inclined to go with the cheapest certification they need."
For some inspectors, the certification course takes just one weekend and ends in an open-book exam. Applicants must have five years of computer security experience, but once they are let loose, there's little oversight of their work. Larger stores take it on themselves to provide evidence to auditors that they comply with the rules, leaving the door open for mistakes or fraud.
And retailers with fewer than 6 million annual card transactions - a group comprising more than 99 percent of all retailers - do not even need auditors. They can test and evaluate themselves.
At the same time, the card companies themselves are increasingly hands-off.
Two years ago, Visa scaled back its review of inspection records for the payment processors it works with. It now examines records only for payment processors with computer networks directly connected to Visa's.
In the U.S., that means fewer than 100 payment processors out of the 700 that Visa works with are PCI-compliant.
Visa's head of global data security, Eduardo Perez, said the company scaled back its records review because it took too much work and because the PCI standards have improved the industry's security "considerably."
"I think we've made a lot of progress," he said. "While there have been a few large compromises, there are many more compromises we feel we've helped prevent by driving these minimum requirements."
Representatives for MasterCard, American Express, Discover and JCB - which, along with Visa, steer PCI policy - either didn't return messages from the AP or directed questions to the PCI security council.
PCI's general manager, Bob Russo, said inspector certification is "rigorous." Yet he also acknowledged that inconsistent audits are a problem - and that merchants and payment processors who suffered data breaches possibly shouldn't have been PCI-certified. Those companies also might have easily fallen out of compliance after their inspection, by not installing the proper security updates, and nobody noticed.
The council is trying to crack down on shoddy work by requiring annual audits for the dozen companies that do the bulk of the PCI inspections. Smaller firms will be examined once every three years.
Those reviews merely scratch the surface, though. Only three full-time staffers are assigned to the task, and they can't visit retailers themselves. They are left to review the paperwork from the examinations.
The AP contacted eight of the biggest "acquiring banks" - the banks that retailers use as middlemen between the stores and consumers' banks. Those banks are responsible for ensuring that retailers are PCI compliant. Most didn't return calls or wouldn't comment for this story.
Mike Herman, compliance managing director for Chase Paymentech, a division of JPMorgan Chase, said his bank has five workers reviewing compliance reports from retailers. Most of the work is done by phone or e-mail.
"We have faith in the certification process, and we really haven't doubted the assessors' work," Herman said. "It's really the merchants that don't engage assessors; those get a little more scrutiny."
He defended the system: "Can you imagine how many breaches we'd have and how severe they'd be if we didn't have PCI?"
Supporters of PCI point out nearly all big and medium-sized retailers governed by the standard now say they no longer store sensitive cardholder data. Just a few years ago they did - leaving credit card numbers in databases that were vulnerable to hackers.
So why are breaches still happening? Because criminals have sharpened their attacks and are now capturing more data as it makes its way from store to bank, when breaches are harder to stop.
Security experts say there are several steps the payment industry could take to make sure customer information doesn't leak out of networks.
Banks could scramble the data that travels over payment networks, so it would be meaningless to anyone not authorized to see it.
For example, TJX Cos., the chain that owns T.J. Maxx and Marshalls and was victimized by a breach that exposed as many as 100 million accounts, the most on record, has tightened its security but says many banks won't accept data in encrypted form.
PCI requires data transmitted across "open, public networks" to be encrypted, but that means hackers with access to a company's internal network still can get at it. Requiring encryption all the time would be expensive and slow transactions.
Another possibility: Some security professionals think the banks and credit card companies should start their own PCI inspection arms to make sure the audits are done properly. Banks say they have stepped up oversight of the inspections, doing their own checks of questionable PCI assessment jobs. But taking control of the whole process is far-fetched: nobody wants the liability.
PCI could also be optional. In its place, some experts suggest setting fines for each piece of sensitive data a retailer loses.
The U.S. might also try a system like Europe's, where shoppers need a secret PIN code and card with a chip inside to complete purchases. The system, called Chip and PIN, has cut down on fraud there (because it's harder to use counterfeit cards), but transferred it elsewhere - to places like the U.S. that don't have as many safeguards.
A key reason PCI exists is that the banks and card brands don't want the government regulating credit card security. These companies also want to be sure transactions keep humming through the system - which is why banks and card companies are willing to put up with some fraud.
"If they did mind, they have immense resources and could really change things," said Ed Skoudis, co-founder of security consultancy InGuardians Inc. and an instructor with the SANS Institute, a computer-security training organization. Skoudis investigates retail breaches in support of government investigations. "But they don't want to strangle the goose that laid the golden egg by making it too hard to accept credit cards, because that's bad for everybody."
Subscribe to:
Posts (Atom)
