By Matt Hines
October 01, 2007
The deadline for retailers and other companies that handle credit card
data to achieve compliance with the Payment Card Industry Data Security
Standard has passed, but experts say that only a few large firms are
already prepared to go under the microscope via external audits.
At midnight on Monday, the PCI DSS version 1.1 guideline officially went
into effect, requiring that all credit and debit card handlers adhere to
a stricter set of data protection rules implemented by the PCI Security
Standards Council -- which is backed by prominent card issuers including
AMEX, MasterCard, and Visa.
However, industry watchers familiar with the PCI standard contend that
the work necessary to pass an audit based on the regulations remains
incomplete inside all but the largest, most security-focused companies.
Despite having over a year to examine the PCI DSS requirements -- which
include stipulations for businesses to encrypt any sensitive customer
account information they store -- those people most familiar with the
individual elements of the standard and the methods being employed by
businesses to meet them claim that most organizations still have a long
From perceived ambiguity regarding some of the PCI DSS requirements in
some organizations to a seemingly inexcusable lack of concern within
others, experts said that they would be surprised to find many
businesses that are ready to undergo their audits today.
"A lot of companies want to be ready but can't because many of the core
systems involved can't be changed to meet PCI needs that quickly," said
John Pironti, chief information risk strategist at Getronics and a
member of the Information Systems Audit and Control Association (ISACA)
-- an industry group that represents the auditors who will carry out PCI
"It's a great incentive for the card companies to say, 'Go do it,' but
the work is challenging and without as a big a deadline as something
concrete like Y2K, people are going to handle it in different ways,
especially around how they make any necessary investments," he said.
Pironti said that large numbers of companies affected by PCI, especially
SMBs, are still struggling to replace aging backend and point-of-sale
systems to help meet the more stringent security measures.
In other cases, companies are waiting for the PCI Security Standards
Council to clear up questions about various elements of the mandate --
such as for vetting DSS compliance with business partners -- before
making some of their related policy and technology decisions.
Other firms, emboldened by the fact the peers like TJX Companies have
been able to experience major data exposure events without any apparent
impact on their core business, have begun pushing back on their IT
departments and asking why they need to sink so much time and money into
the process of meeting the regulation at all, the expert said.
While TJX has reported that it will pay well over $100 million in
remediation expenses related to its incident, in-store sales at the
retail chain have actually increased since it announced its breach in
PCI adoption faces obstacles
"Most large companies at least have PCI initiatives in place if they're
not already compliant, but because the TJX incident has not had the
impact on sales that some have predicted, we are hearing about some CIOs
who are pushing back and saying it's not as big of a deal," Pironti
said. "Because the only real consequences are financial and, unlike some
of the other regulations, no one going to jail for not following PCI,
some companies aren't rushing to get prepared like they might have been
in the past."
Michael Gavin, security strategist at Security Innovation, which
provides risk assessment services to large businesses, said that some
companies have hit a wall when it comes to certain aspects of PCI, such
as in testing their business partners' compliance.
The mandate's requirement that companies ensure that whatever card
processing providers they work with have their own houses in order has
proven unwieldy, he said, and become an obstacle for some firms who felt
that they were getting closer to achieving preparation for PCI audits.
"Because all the service providers haven't become compliant, companies
were left wondering what they should do because the requirement should
have worked top-down from the banks through the processors to the
merchants, instead of the other way around," said Gavin. "There's been a
wide range of quality in terms of how different banks worked with their
partners to get the word out, so a lot of the preparedness depends on
issues like that."
Gavin said that the banks at the top of the card-handling food chain
should have been more aggressive about educating smaller partners about
how they should deal with PCI DSS, with some doing a far better job than
Many companies are taking a "fail the first audit" approach to find out
exactly what is expected of them in the future, he said, and the expert
contends that it might be one of the most practical ways for smaller
firms to approach the standard.
"It's very hard to say who is ready for an audit at all. Some companies
have always been more conscious and concerned about third-party data,
and those types of companies are clearly in a much better position than
people who don't focus too much in security in general, especially
smaller companies," Gavin said. "The truth is that a lot of merchants
didn't know what they needed to do up until recently, so in the end,
some might not be prepared as they should be."
Other industry watchers maintain that companies who have been serious
about handling PCI DSS all along are for the most part prepared to be
However, some companies may be missing the point of improving their
overall security because they've been too busy attempting to meet
specific requirements of the standard itself, they said.
"People who decided to be ready are going to be ready for the audits
when they come, the problem is with people who are just scraping by with
the standard but who are missing out on the idea behind the standard,"
said Rob Warmack, director of customer advocacy at TripWire, which
markets IT configuration and change monitoring applications.
"When it comes to audit time, some of these people might find that
they're going to be exposed to the assessors' interpretations of
adequacy for all the controls," he said. "Others might squeak by the
initial audits but find that this is an ongoing thing and realize that
they missed an opportunity to go back and do things the right way the
CSI 2007 is the only conference that delivers a business-focused
overview of enterprise security. It will convene 1,500+ delegates,
80 exhibitors and features 100+ sessions/seminars providing a
roadmap for integrating policies and procedures with new tools
and techniques. Register now for savings on conference fees
and/or free exhibits admission. - www.csiannual.com