Despite Target data breach, PCI security standard remains solid, chief says
Breaches at Target highlight need for multi-layered security effort, Bob Russo says.
Computerworld - The head of the organization in charge of maintaining security controls over credit card transactions insisted Monday that its standards remain solid despite the concerns raised by data breaches at Target and other companies.
Speaking with Computerworld, Bob Russo, general manager of the PCI Security Standards Council, downplayed criticisms about the effectiveness of the Payment Card Industry Data Security Standard (PCI DSS) and said it remains a vital part of the multi-layered approach needed to secure payment card data.
"Any time there's a breach it sheds a spotlight on what we do," Russo said. But instead of pointing fingers at PCI, there should be more focus on working collaboratively to address security issues in the payment card industry, he said.
"Everybody is looking for a silver bullet," in the wake of the recent breaches, said Russo, who is scheduled to testify before Congress pn Wednesday on the issue. "As far as I know, no silver bullet exists. It's a combination of people, process and technology."
All organizations that accept credit and debit card transactions are required to implement the security controls prescribed under PCI. Companies, especially major retailers like Target, have spent billions of dollars over the past several years implementing PCI requirements and billions more in mandatory third-party compliance assessments.
Yet compliance with the standard has been no guarantee against data breaches, prompting some to question whether the problem lies in the standard itself, or the manner in which it is implemented and assessed.
According to Russo, a company that implements all required PCI controls should be well-protected against data breaches. The standard not only prescribes controls for blocking security intrusions but also for detecting them in the event that an intrusion occurs, he said.
Companies have often complained that they suffered a data breach even though they were fully certified as being compliant at the time of the breach. In reality, though, with every major payment card data breach in the past, companies were not PCI compliant when the breach happened, Russo said.
Though a company might be certified as PCI compliant, it's important to remember the compliance certification is just a snapshot in time, he noted.
"You can be in compliance today and be totally out of compliance tomorrow," because of a failure to implement some required small security measure, he said. "This is really about security. Not about compliance. These are the bare minimum things you should be doing."
- Web apps and point-of-sale were leading hacker targets in 2013, says Verizon
- Michaels breach exposes nearly 3M payment cards
- Teen nabbed in Heartbleed attack against Canadian tax site
- Heartbleed bug can expose private server encryption keys
- FTC can sue companies hit with data breaches, court says
- 5-year-old hacks Xbox, now he's a Microsoft 'security researcher'
- State AGs probe Experian subsidiary's data breach
- NSA sniffing prompts Yahoo to encrypt traffic between its data centers
- Banks withdraw data breach claim against Target
- Bank abandons place in class-action suit against Target, Trustwave
- Silicon Valley's 19 Coolest Places to Work
- Is Windows 8 Development Worth the Trouble?
- 8 Books Every IT Leader Should Read This Year
- 10 Hot Hadoop Startups to Watch
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Infographic: Converged Infrastructure Benefits This Infographic quantifies the savings organizations are realizing from increased deployment speed, higher availability, and lower annual costs.
- CIOs Deliver Productivity Breakthroughs with Intelligent Digital Signage Retailers have long recognized the influence that digital signage provides over a shopper's point-of-purchase decision making process.
- Going Paperless? Here's What You Need to Think About As makers of some of the world's most popular PDF solutions, we often consult with businesses & governmental agencies that have the goal...
- The Big Data Opportunity for HR and Finance If CEOs, CFOs, CIOs, and CHROs want to drive their businesses forward, they will need to quickly recognize the enormous value of big...
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva.
- Top 4 Digital Signage Fails Join RMG Networks for a look at four of the most common reasons digital signage fails in corporate businesses. Learn about strategies to... All Data Security White Papers | Webcasts
Our new weekly Consumerization of IT newsletter covers a wide range of trends including BYOD, smartphones, tablets, MDM, cloud, social and what it all means for IT. Subscribe now and stay up to date!