[ISN] PCI experts say deadline is just the beginning

From: InfoSec News (alerts@private)
Date: Mon Oct 01 2007 - 22:59:47 PDT


http://www.infoworld.com/article/07/10/01/PCI-experts-say-deadline-is-just-the-beginning_1.html

By Matt Hines
October 01, 2007

The deadline for retailers and other companies that handle credit card 
data to achieve compliance with the Payment Card Industry Data Security 
Standard has passed, but experts say that only a few large firms are 
already prepared to go under the microscope via external audits.

At midnight on Monday, the PCI DSS version 1.1 guideline officially went 
into effect, requiring that all credit and debit card handlers adhere to 
a stricter set of data protection rules implemented by the PCI Security 
Standards Council -- which is backed by prominent card issuers including 
AMEX, MasterCard, and Visa.

However, industry watchers familiar with the PCI standard contend that 
the work necessary to pass an audit based on the regulations remains 
incomplete inside all but the largest, most security-focused companies.

Despite having over a year to examine the PCI DSS requirements -- which 
include stipulations for businesses to encrypt any sensitive customer 
account information they store -- those people most familiar with the 
individual elements of the standard and the methods being employed by 
businesses to meet them claim that most organizations still have a long 
road ahead.

 From perceived ambiguity regarding some of the PCI DSS requirements in 
some organizations to a seemingly inexcusable lack of concern within 
others, experts said that they would be surprised to find many 
businesses that are ready to undergo their audits today.

"A lot of companies want to be ready but can't because many of the core 
systems involved can't be changed to meet PCI needs that quickly," said 
John Pironti, chief information risk strategist at Getronics and a 
member of the Information Systems Audit and Control Association (ISACA) 
-- an industry group that represents the auditors who will carry out PCI 
compliance tests.

"It's a great incentive for the card companies to say, 'Go do it,' but 
the work is challenging and without as a big a deadline as something 
concrete like Y2K, people are going to handle it in different ways, 
especially around how they make any necessary investments," he said.

Pironti said that large numbers of companies affected by PCI, especially 
SMBs, are still struggling to replace aging backend and point-of-sale 
systems to help meet the more stringent security measures.

In other cases, companies are waiting for the PCI Security Standards 
Council to clear up questions about various elements of the mandate -- 
such as for vetting DSS compliance with business partners -- before 
making some of their related policy and technology decisions.

Other firms, emboldened by the fact the peers like TJX Companies have 
been able to experience major data exposure events without any apparent 
impact on their core business, have begun pushing back on their IT 
departments and asking why they need to sink so much time and money into 
the process of meeting the regulation at all, the expert said.

While TJX has reported that it will pay well over $100 million in 
remediation expenses related to its incident, in-store sales at the 
retail chain have actually increased since it announced its breach in 
Jan. 2007.


PCI adoption faces obstacles

"Most large companies at least have PCI initiatives in place if they're 
not already compliant, but because the TJX incident has not had the 
impact on sales that some have predicted, we are hearing about some CIOs 
who are pushing back and saying it's not as big of a deal," Pironti 
said. "Because the only real consequences are financial and, unlike some 
of the other regulations, no one going to jail for not following PCI, 
some companies aren't rushing to get prepared like they might have been 
in the past."

Michael Gavin, security strategist at Security Innovation, which 
provides risk assessment services to large businesses, said that some 
companies have hit a wall when it comes to certain aspects of PCI, such 
as in testing their business partners' compliance.

The mandate's requirement that companies ensure that whatever card 
processing providers they work with have their own houses in order has 
proven unwieldy, he said, and become an obstacle for some firms who felt 
that they were getting closer to achieving preparation for PCI audits.

"Because all the service providers haven't become compliant, companies 
were left wondering what they should do because the requirement should 
have worked top-down from the banks through the processors to the 
merchants, instead of the other way around," said Gavin. "There's been a 
wide range of quality in terms of how different banks worked with their 
partners to get the word out, so a lot of the preparedness depends on 
issues like that."

Gavin said that the banks at the top of the card-handling food chain 
should have been more aggressive about educating smaller partners about 
how they should deal with PCI DSS, with some doing a far better job than 
others.

Many companies are taking a "fail the first audit" approach to find out 
exactly what is expected of them in the future, he said, and the expert 
contends that it might be one of the most practical ways for smaller 
firms to approach the standard.

"It's very hard to say who is ready for an audit at all. Some companies 
have always been more conscious and concerned about third-party data, 
and those types of companies are clearly in a much better position than 
people who don't focus too much in security in general, especially 
smaller companies," Gavin said. "The truth is that a lot of merchants 
didn't know what they needed to do up until recently, so in the end, 
some might not be prepared as they should be."

Other industry watchers maintain that companies who have been serious 
about handling PCI DSS all along are for the most part prepared to be 
audited.

However, some companies may be missing the point of improving their 
overall security because they've been too busy attempting to meet 
specific requirements of the standard itself, they said.

"People who decided to be ready are going to be ready for the audits 
when they come, the problem is with people who are just scraping by with 
the standard but who are missing out on the idea behind the standard," 
said Rob Warmack, director of customer advocacy at TripWire, which 
markets IT configuration and change monitoring applications.

"When it comes to audit time, some of these people might find that 
they're going to be exposed to the assessors' interpretations of 
adequacy for all the controls," he said. "Others might squeak by the 
initial audits but find that this is an ongoing thing and realize that 
they missed an opportunity to go back and do things the right way the 
first time."


__________________________________________________________________      
CSI 2007 is the only conference that delivers a business-focused
overview of enterprise security. It will convene 1,500+ delegates,
80 exhibitors and features 100+ sessions/seminars providing a
roadmap for integrating policies and procedures with new tools
and techniques.  Register now for savings on conference fees   
and/or free exhibits admission. - www.csiannual.com



This archive was generated by hypermail 2.1.3 : Mon Oct 01 2007 - 23:19:30 PDT