COLUMN

PCI DSS: The standards should not be lowered

By Bob Russo 17 May 2007 | SearchSecurity.com Security Wire Daily News Digg This!     StumbleUpon     Del.icio.us

Bob Russo

While the very nature of our organization is based on the feedback and collaboration of the greater payment community, and we welcome any and all comments, we did want to provide SearchSecurity readers with an additional perspective to some of the concerns raised.

Specifically, as the general manager of the PCI Security Standards Council, I want to offer the council's position on the following:

Compliance is a Journey

Achieving compliance for any industry standard requires time and is not a one day event. While I cannot comment on specific compliance levels as the PCI SSC has not replaced individual payment brand programs, I can tell you that the payment brands have witnessed a significant uptick in compliance over the last year and this trend looks to continue as more and more merchants demonstrate that they have mapped out their process with the PCI DSS.

Making the PCI DSS easier to achieve is counterintuitive to delivering a robust and effective data security standard.

This is extremely heartening to the council, as our core goal is to drive adoption as well as reduce costs and lead times for the implementation of the PCI DSS through our ownership, development and maintenance of the standard.

We therefore strongly disagree with the recommendation to "set the bar lower" for PCI DSS requirements. There is an implicit expectation from consumers that merchants and financial institutions handle their information in a secure fashion, and we are actively working to meet this expectation through the PCI DSS. Compliance is improving on a daily basis and making the PCI DSS easier to achieve is counterintuitive to delivering a robust and effective data security standard. Everyone involved in the payment process has a duty to consumers to protect their data to the highest standard. This is the baseline principle and will not be achieved by a loosening of PCI DSS requirements.

Additionally we believe that the suggestion to develop a "PCI Certified Directory" detailing the names of PCI compliant companies could be used by hackers to target and attack specific companies. The council does not support putting consumer's data at potential risk in this way.

Financial Institutions: A key component of our participating organizations membership

The 12 requirements of the PCI DSS are the most prescriptive of all the common standards or regulations. We have done this intentionally, as we want to be in the best position to address emerging threats and exploits that evolve over time. To that end, one of the most significant actions the council has taken since its formation is a commitment to provide a transparent forum, through a participating organization membership base, in which all stakeholders can provide input into the ongoing development, enhancement and dissemination of data security standards.

I'd like to highlight that financial institutions have been one of the greatest champions of the PCI DSS. It is important to remember that, as recent events have illustrated, financial institutions are directly and financially impacted by data security breaches. As such they wholeheartedly recognize the value of the work that we are doing. A simple perusal of our participating organization roster affirms the engagement of this important industry sector.

Additionally, our invitation to participate in the feedback process has generated an overwhelming volume of support and buy-in from organizations throughout the payment chain – including merchants, processors, POS providers, and financial institutions. Each stakeholder has an opportunity to influence the direction of PCI standards through active involvement in community meetings, advance review of drafts of standards and supporting materials, and regular dialogue with key stakeholders.

The next step in this important feedback loop will be the announcement of a board of advisors elected from and by our participating organization members, as well as the first global community meeting to formally begin shaping the next iteration of the DSS.

Next Steps: Reaching more merchants

We will continue to focus on expanding our education and awareness efforts. In the initial cycle since the council's formation, we focused on mitigating the greatest potential volume of risk by driving awareness among large merchants. In the coming months we hope to have the same success replicated in our outreach efforts to smaller merchants and acquirers. For instance we have a detailed plan in place to simplify the self assessment questionnaire for smaller merchants.

In the interim, we will also continue to assess additional security standards, such as the PIN Entry Devices standard, for appropriation under the council's administration.

Within the last six months, we have succeeded in raising awareness of the DSS and driving adoption of the standard. In the next six months, with the assistance of our 200 participating organizations, we will continue to evolve the PCI DSS to accurately reflect real world challenges.

We welcome the continued feedback and open dialogue of our payment card industry constituents and look forward to your ongoing engagement and participation in the months ahead.

Bob Russo is the general manager of the PCI Security Standards Council. The council was formed by the major payment card brands American Express, Discover Financial Services, JCB, MasterCard Worldwide and Visa International to enhance payment account security by fostering broad adoption of the PCI Data Security Standard. About 200 merchants, banks, processors and point of sale vendors are currently registered as PCI SSC Participating Organizations. If you would like more information the PCI Security Standards Council or would like to become a Participating Organization please contact the PCI Security Standards Council at info@pcisecuritystandards.org.

Tags: PCI Data Security Standard,  Data Privacy and Protection,  FISMA,  FFIEC Regulations and Guidelines,  IT Security Audits,  Identity Theft and Data Security Breaches,  VIEW ALL TAGS

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT PCI Data Security Standard PCI DSS compliance help: Using frameworks, technology to aid efforts Chip and PIN adoption Chip and PIN adoption serves lesson for U.S. payment industry Heartland CIO is critical of First Data's credit card tokenization plan Heartland CIO on end-to-end encryption, credit card tokenization Heartland CIO on PCI, E3 project Wireless network guidelines for PCI DSS compliance Visa probes tokens, encryption for PCI card data protection Feds push cybersecurity jobs, PCI DSS changes ahead. Voltage, RSA spar over tokenization, data protection Data Privacy and Protection Quiz: Compliance-driven role management Interpreting 'risk' in the Massachusetts data protection law Strategies for using technology to enable automated compliance How to prepare for a FERPA audit How to find virtual machines for greater virtualization compliance Quiz: Virtualization and compliance Compliance in the cloud Researchers predict SSNs, crack algorithm putting identities at risk How to write a risk methodology that blends business, security needs PCI compliance requirement 3: Protect data Data Privacy and Protection Research FISMA GAO report cites government weaknesses, data leakage DHS fills National Cybersecurity Center post Experts optimistic of Obama cybersecurity plan WH cybersecurity plan needs private sector guidance White House cybersecurity czar faces major hurdles Feds should get private sector advice on cybersecurity ICE Act would create White House cybersecurity post Experts alarmed over U.S. electrical grid penetration Group identifies top 20 security controls to thwart cyberattacks FISMA compliance made easier with OpenFISMA FISMA Research

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary PCI DSS (Payment Card Industry Data Security Standard )  (SearchSecurity.com)

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary