After Target, Neiman Marcus breaches, does PCI compliance mean anything?
Security failures at companies certified as PCI compliant suggest problems in standards and implementation
Computerworld - The recent data breaches at Target and Neiman Marcus have once again shown that compliance with the Payment Card Industry Data Security Standard (PCI DSS) is no guarantee against an intrusion.
What's unclear is whether the problem lies in the standard itself, or the manner in which it is implemented and assessed.
In a letter to U.S. Sen. Richard Blumenthal (D-Conn.) explaining the recent breach that exposed 1.1 million payment cards, Neiman Marcus CIO Michael Kingston claimed the intrusion happened even though the company had security measures that exceeded PCI standards.
Target, which last month disclosed a data breach that exposed credit card data on 40 million people, is also believed to have been PCI compliant at the time of the intrusion.
Several other companies that have suffered major data compromises in recent years have also claimed they were compromised despite being certified as PCI compliant.
Security analysts and researchers have differing takes on what might be going on.
Visa, MasterCard, American Express and other major credit card associations established PCI several years ago to get companies to adopt a set of security controls for handling credit and debit card data. Over the years, the retail industry in particular, is believed to have spent billions of dollars implementing PCI requirements and billions more in mandatory third-party compliance assessments.
That companies like Target and Neiman Marcus were compromised in such spectacular fashion despite adhering to PCI has vexed many.
The breaches "highlight weaknesses in PCI and in the security industry," said Avivah Litan, an analyst with research firm Gartner. Nothing in the PCI standard, for instance, would have helped Target detect and block the intrusion before it happened, according to Litan.
"PCI does mandate checking for malware but none of the typical anti-malware products could find the Target malware, and PCI doesn't mandate next-generation anti-malware security that's starting to emerge," she said.
Some of the problems may have to do with the manner in which compliance is assessed, Litan said. Most assessments are done using previously known attack vectors and threats. Companies are not being assessed for their readiness in dealing with new threats. "That's why we need a new paradigm and stronger security inside the payment system," Litan said.
James Huguelet, an independent PCI consultant, said the biggest problem with the PCI standard is that it doesn't require companies to encrypt data in motion. While the standard has requirements for encrypting data at rest, there is no such requirement for data in action during the entire transaction processing chain.
- NSA used 'European bazaar' to spy on EU citizens
- Target CIO resigns following breach
- Evan Schuman: Mobile IT Roach Motel: Data checks in, but it won't check out
- Sears finds no evidence of data breach -- yet
- Gameover malware is tougher to kill with new rootkit component
- Mobile app for RSA Conference exposes personal data
- UK man charged with hacking Federal Reserve
- Bloomberg clamps down with data-access policies after scandal
- Amazon.com security slip allowed unlimited password guesses on mobile apps
- Huge turnout at RSA shows hackers are winning
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Streamline Data Protection with IBM Tivoli Storage Manager Operations Center IBM Tivoli Storage Manager (TSM) has been an industry-standard data protection solution for two decades. But, where most competitors focus exclusively on Backup...
- Top tips for securing big data environments - Why big data doesn't have to mean big security challenges Organizations don't have to feel overwhelmed when it comes to securing big data environments. The same security fundamentals for securing databases, data warehouses...
- Top 3 Myths about Big Data Security : Debunking common misconceptions about big data security Big data represents massive business possibilities and competitive advantage for organizations that are able to harness and use that information. But how are...
- Three guiding principles for data security and compliance Data security is a moving target-as data grows, more sophisticated threats emerge; the number of regulations increase; and changing economic times make it...
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva.
- How SIEM Addresses the Challenges of Big Security Data This webcast will help you understand today's big data security challenges and how intelligent and scalable SIEM solutions give IT the tools and... All Data Security White Papers | Webcasts