http://www.infoworld.com/article/07/10/01/PCI-experts-say-deadline-is-just-the-beginning_1.html By Matt Hines October 01, 2007 The deadline for retailers and other companies that handle credit card data to achieve compliance with the Payment Card Industry Data Security Standard has passed, but experts say that only a few large firms are already prepared to go under the microscope via external audits. At midnight on Monday, the PCI DSS version 1.1 guideline officially went into effect, requiring that all credit and debit card handlers adhere to a stricter set of data protection rules implemented by the PCI Security Standards Council -- which is backed by prominent card issuers including AMEX, MasterCard, and Visa. However, industry watchers familiar with the PCI standard contend that the work necessary to pass an audit based on the regulations remains incomplete inside all but the largest, most security-focused companies. Despite having over a year to examine the PCI DSS requirements -- which include stipulations for businesses to encrypt any sensitive customer account information they store -- those people most familiar with the individual elements of the standard and the methods being employed by businesses to meet them claim that most organizations still have a long road ahead. From perceived ambiguity regarding some of the PCI DSS requirements in some organizations to a seemingly inexcusable lack of concern within others, experts said that they would be surprised to find many businesses that are ready to undergo their audits today. "A lot of companies want to be ready but can't because many of the core systems involved can't be changed to meet PCI needs that quickly," said John Pironti, chief information risk strategist at Getronics and a member of the Information Systems Audit and Control Association (ISACA) -- an industry group that represents the auditors who will carry out PCI compliance tests. "It's a great incentive for the card companies to say, 'Go do it,' but the work is challenging and without as a big a deadline as something concrete like Y2K, people are going to handle it in different ways, especially around how they make any necessary investments," he said. Pironti said that large numbers of companies affected by PCI, especially SMBs, are still struggling to replace aging backend and point-of-sale systems to help meet the more stringent security measures. In other cases, companies are waiting for the PCI Security Standards Council to clear up questions about various elements of the mandate -- such as for vetting DSS compliance with business partners -- before making some of their related policy and technology decisions. Other firms, emboldened by the fact the peers like TJX Companies have been able to experience major data exposure events without any apparent impact on their core business, have begun pushing back on their IT departments and asking why they need to sink so much time and money into the process of meeting the regulation at all, the expert said. While TJX has reported that it will pay well over $100 million in remediation expenses related to its incident, in-store sales at the retail chain have actually increased since it announced its breach in Jan. 2007. PCI adoption faces obstacles "Most large companies at least have PCI initiatives in place if they're not already compliant, but because the TJX incident has not had the impact on sales that some have predicted, we are hearing about some CIOs who are pushing back and saying it's not as big of a deal," Pironti said. "Because the only real consequences are financial and, unlike some of the other regulations, no one going to jail for not following PCI, some companies aren't rushing to get prepared like they might have been in the past." Michael Gavin, security strategist at Security Innovation, which provides risk assessment services to large businesses, said that some companies have hit a wall when it comes to certain aspects of PCI, such as in testing their business partners' compliance. The mandate's requirement that companies ensure that whatever card processing providers they work with have their own houses in order has proven unwieldy, he said, and become an obstacle for some firms who felt that they were getting closer to achieving preparation for PCI audits. "Because all the service providers haven't become compliant, companies were left wondering what they should do because the requirement should have worked top-down from the banks through the processors to the merchants, instead of the other way around," said Gavin. "There's been a wide range of quality in terms of how different banks worked with their partners to get the word out, so a lot of the preparedness depends on issues like that." Gavin said that the banks at the top of the card-handling food chain should have been more aggressive about educating smaller partners about how they should deal with PCI DSS, with some doing a far better job than others. Many companies are taking a "fail the first audit" approach to find out exactly what is expected of them in the future, he said, and the expert contends that it might be one of the most practical ways for smaller firms to approach the standard. "It's very hard to say who is ready for an audit at all. Some companies have always been more conscious and concerned about third-party data, and those types of companies are clearly in a much better position than people who don't focus too much in security in general, especially smaller companies," Gavin said. "The truth is that a lot of merchants didn't know what they needed to do up until recently, so in the end, some might not be prepared as they should be." Other industry watchers maintain that companies who have been serious about handling PCI DSS all along are for the most part prepared to be audited. However, some companies may be missing the point of improving their overall security because they've been too busy attempting to meet specific requirements of the standard itself, they said. "People who decided to be ready are going to be ready for the audits when they come, the problem is with people who are just scraping by with the standard but who are missing out on the idea behind the standard," said Rob Warmack, director of customer advocacy at TripWire, which markets IT configuration and change monitoring applications. "When it comes to audit time, some of these people might find that they're going to be exposed to the assessors' interpretations of adequacy for all the controls," he said. "Others might squeak by the initial audits but find that this is an ongoing thing and realize that they missed an opportunity to go back and do things the right way the first time." __________________________________________________________________ CSI 2007 is the only conference that delivers a business-focused overview of enterprise security. It will convene 1,500+ delegates, 80 exhibitors and features 100+ sessions/seminars providing a roadmap for integrating policies and procedures with new tools and techniques. Register now for savings on conference fees and/or free exhibits admission. - www.csiannual.com
This archive was generated by hypermail 2.1.3 : Mon Oct 01 2007 - 23:19:30 PDT