Four reasons why some big retailers are still not PCI-compliant

The deadline for compliance was Oct. 1

Starting today, big retailers accepting payment card transactions face fines ranging from $5,000 to $25,000 a month if they don't comply with the Payment Card Industry (PCI) data security standard mandated by the major credit card companies.

Under the PCI standard, all companies accepting payment cards are required to implement a set of 12 security controls for protecting card holder data. The controls include ones related to access control and authentication, data encryption, and transaction logging.

About 325 Tier 1 merchants, those defined as processing more than 6 million card transactions a year, had until Sept. 30 to show they had implemented all of the required controls. But according to estimates from analyst firm Gartner Inc. and observers in the payment industry, a good half of them are unlikely to have made the deadline for a variety of reasons.

Here are four of the likeliest reasons:

The time and money required to implement PCI controls on legacy systems

Large companies with highly distributed, older computing environments are having an especially hard time applying the security controls mandated by PCI, said Amer Deeba, chief marketing officer and vice president of product marketing at Qualys Inc., a Redwood Shores, Calif.-based vendor of IT security systems. "Many of the big [retailers] are handling credit card information from all around the world and storing it in legacy systems that are no longer being supported or updated" by software vendors, he said.

Applying the needed security updates and patches in such an environment without breaking functionality can be a huge challenge -- especially given the near continuous uptime requirements of such systems, said Sean Smith, technology director at Steak N Shake Co., an Indianapolis-based restaurant chain. Steak N Shake, a Tier 1 vendor, has turned in its compliance reports "with all areas being marked as sufficient" for compliance, Smith said. But getting to that point involved a large-scale, yearlong effort that included adding new security controls such as file integrity monitoring and event log capturing to a "very legacy environment," he said.

A proper security upgrade in distributed legacy environments would require millions of dollars in system upgrades and months of dedicated manpower, said Avivah Litan, an analyst at Gartner Inc. "As a result, retailers in these positions are basically being forced to apply Band-Aids to patch the problems while having to juggle lots of priorities and competing interests as they do so," she said. "The effort is far from straightforward."

Differing interpretations of compliance by auditors

A company may think it has implemented all of the recommended controls under the PCI standard and discover that it is still not compliant when assessed because of the way different auditors assess compliance, said Jay White, global information protection architect at Chevron Corp. "The biggest challenge with PCI is that you are at the mercy of the auditors and their skill set," White said. With some auditors, he said, "everything becomes black and white. It's either on or it's off," whereas what might be needed is a more nuanced view of the controls a company has in place.

Complicating the issue is the fact that under PCI, companies are not always required to implement the mandated controls if they can show they have a compensating control in place, said Alan Bird, vice president of business development at Cyber-Ark Software Inc., a security vendor in Newton, Mass. For instance, a lot of the controls that Chevron has implemented are not PCI-specific and are instead part of a core set of best practices and controls the company put in place to address multiple compliance objectives.

The problem is that one auditor might consider some compensating controls as adequate for PCI but another might not, Bird said. "The result is that a lot of companies have gone through multiple assessment and keep getting a lot of different answers [about compliance]. A lot of people are filing a lot of papers to get their compensating controls signed off as being compliant."

"Large retailers and their assessors often disagree over the scope of the compliance effort," Litan said. While retailers want to narrow the scope and the segment of the network subject to compliance, assessors tend to want to broaden the scope. "This definitional issue over what constitutes adequate network segmentation needs to be addressed by the PCI Security Council," she said.

The challenge of sustained compliance

If achieving compliance is hard enough, sustaining it presents a whole different set of challenges, said Steve Schlarman, chief compliance strategist at Brabeion Software Corp., a Reston, Va.-based vendor of compliance management softoware. "Sustainability is a key point," he said. "In most organizations, their network today is not what their network tomorrow is going to look like."

Sometimes companies that were previously seen as compliant might fall out of compliance because they fail to take into account changes in the business and threat environments, said Branden Williams, director of Mountain View, Calif.-based Verisign Inc.'s PCI practice. "They are treating PCI like a project and not as a journey" and often fail to implement adequate program management processes. Though such companies might be able to achieve PCI compliance, "they are often just one change control away from noncompliance," Williams said.

According to White, Chevron has dedicated "literally an army of people" to ensure the company's ongoing compliance with PCI and various regulatory mandates. As part of that effort, Chevron set up a technical control board responsible for, among other things, keeping tracking of vulnerabilities, patches and other security issues that could affect compliance. It is this group's responsibility to deal with the issue and integrate its solution into the company's broader set of compliance controls, he said.

"I can see where companies can be running into problems if they are treating security as an afterthought," he said.

Lack of visible enforcement

Even before the Sept. 30 deadline, the PCI dictate called for fines against companies that were breached or caught storing prohibited magnetic stripe data on their computers. According to a Gartner report, Visa levied over $4.5 million in such fines in 2006, up from $3.4 million in 2005. The fines are assessed on the merchant banks that authorize retailers to accept credit card transactions. The banks then pass the fines onto the merchants themselves. But the total lack of publicity surrounding such fines may be leading some to question how seriously the standards are enforced, said Bird.

"I think if the credit card brands want this thing to move ahead, they are going to have to publicly levy some pretty hefty fines against major retailers," Bird said.

Copyright © 2007 IDG Communications, Inc.

  
Shop Tech Products at Amazon