After Target, Neiman Marcus breaches, does PCI compliance mean anything?
"This leads to many points along the path of an active transaction where criminal malware can 'spy' on the information as it passes by which is what appears to have occurred at Target," Huguelet said. The best approach is to require that all card holder data be encrypted at the point it is swiped all the way until it reaches the merchant's bank for processing.
"This would take merchants' entire retail infrastructure out of the gun sights of payment criminals. There would simply not be any payment data that could be stolen from the retailers," he said.
Such end-to-end encryption can be costly, Huguelet said, but it is a one-time cost that is sure to drive real and lasting improvements in retail security.
John Pescatore, director of emerging technologies at the SANS Institute, said the breaches point out PCI implementation failures rather than a lack of controls in the standards itself. There's plenty in the standard that should have enabled Target and Neiman Marcus to catch the intrusions on the way in or to find and block the path the intruders took to break into the networks, Pescatore said.
"Doing security right is not trivial. But the problem is not some lack of requirements in PCI DSS or other standards," he said. "In fact, it would be counter-productive to try to jam attack-specific requirements into standards. It makes no sense."
The part of the PCI process that needs change is the compliance assessment process, Pescatore said.
The certified security assessors who verify a company's compliance status often don't do a good enough job. "Implementation or process failures should be caught by the assessors who do the yearly evaluations, or by quarterly vulnerability scanning," he said. "But too often the yearly assessments don't catch much and quarterly vulnerability scanning is not frequent enough."
The PCI Security Council, which administers the standard, did not have any immediate comments.
This article, After Target, Neiman Marcus breaches, does PCI compliance mean anything?, was originally published at Computerworld.com.
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed . His e-mail address is email@example.com.
- Hackers steal user data from the European Central Bank website, demand money
- Arrests made after international cyber-ring targets StubHub
- SQL injection flaw opens door for Wall Street Journal database hack
- Goodwill Industries probes possible payment card breach
- Aloha point-of-sale terminal, sold on eBay, yields security surprises
- The biggest data breaches of 2014 (so far)
- Blue Shield discloses 18,000 doctors' Social Security numbers
- PF Chang's says breach was 'highly sophisticated criminal operation'
- Breaches exposed 1 in 7 US debit cards in 2013
- New malware program targets banking data
Read more about Data Security in Computerworld's Data Security Topic Center.
- Top 3 Myths about Big Data Security : Debunking common misconceptions about big data security Big data represents massive business possibilities and competitive advantage for organizations that are able to harness and use that information. But how are...
- A More Predictable Way to Budget Software Costs Wavetronix enables creative collaboration while cost-effectively accessing all the latest tools with Adobe Creative Cloud for teams. For Wavetronix, collaboration was easy when...
- Adobe Creative Cloud for teams Security Overview This white paper describes the proactive approach and procedures implemented by Adobe to increase the security of your Creative Cloud experience and your...
- 3 Big Data Security Analytics Techniques You Can Apply Now to Catch Advanced Persistent Threats This technical white paper demonstrates how to use Big Data security analytics techniques to detect advanced persistent threat (APT) cyber attacks, and it...
- Live Webcast Security Vulnerabilities Associated With Having Local Administrator Privileges Viewfinity will demonstrate how removing admin rights and granularly managing privileges at the application level reduces the attack surface.
- Security Vulnerabilities Associated With Having Local Administrator Privileges Viewfinity will demonstrate how removing admin rights and granularly managing privileges at the application level reduces the attack surface.
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different.... All Data Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!