PCI DSS: No Angel, But Certainly Not the Devil

CSO - Fifty years ago, The Coasters had a top-10 hit with the song "Charlie Brown." The song is best known for the phrase "Why's everybody always pickin' on me?" Charlie Brown was a loveable character who was often beat up and picked on for no reason.

Far too many in the industry similarly see PCI as such a loser and criticize it relentlessly. In our article PCI Shrugged: Debunking Criticisms of PCI DSS from April 2009, we wrote that the PCI DSS is a valuable standard. We did not then, and do not now, feel that the PCI DSS is perfect, but it is in the best interest of the industry and consumers that it be maintained, developed and expanded as well as adapted to today's threats.

However, let's briefly step away from this debate and consider this: imagine a large distributed retailer that has somehow survived without investing in information security. Yes, they've updated antivirus subscriptions on their desktops and have added a firewall, but they haven't gone beyond that (it goes without saying that this said organization was consistently compromised by malicious hackers).

The advent of PCI worried this retailer and now they have to take security actions like encrypt, log, monitor, educate employees, and more. However, this retailer is now fighting PCI with all their strength since they believe that "PCI is too much security." Their worldview of security is that "no security" is "just enough security."

This is but one example of the types of the organizations that PCI is meant to put a squeeze on. That is why we'd like to remind PCI critics that as they whine about PCI as too little, too late, organizations that handle your sensitive data are conducting gross negligence in regards to security. Please get out of your perfectionist ivory tower and see the real world; a world full of security laggards -- not leaders that you are accustomed to! Our justification of PCI is it needs a refresh again in reference to the article PCI Security a Devil, "Like No Child Left Behind." In the piece, Joshua Corman of The 451 Group takes a number of swipes at PCI, makes a few analogies, but offers few facts.

We will briefly counter his objections as well as remind everybody that yearning for pre-PCI world is reckless and dangerous, since for many organizations "PCI level" of security is way above their current posture, however unbelievable it may sound to security literati.

The authors wholeheartedly agree with Corman that organizations that have made PCI and compliance the basis of their information security policies probably don't understand PCI or security. Still, for many organizations that had no security program whatsoever, even something based on PCI will be a huge improvement over having nothing and doing nothing.