Card Firms Loosen Grip on Data Rules

Wal-Mart, 13 others given advisory role on PCI standard

Large retailers and other key stakeholders in the payment card chain are finally being given a chance to help guide the development and modification of the data security standard imposed on them by the major credit card companies.

Last week, Wal-Mart Stores Inc. and U.K.-based Tesco Stores Ltd. were elected along with 12 other organizations to be the first members of a newly created board of advisers to the PCI Security Standards Council. The advisory board members were chosen by about 200 retailers, banks and other companies that belong to the council, an independent body that was established last September to manage ongoing development of the security standard.

Until now, PCI has been crafted by the five credit card companies that created it: Visa International Inc., MasterCard Worldwide, American Express Co., Discover Financial Services LLC and Tokyo-based JCB Co.

Seana Pitt

Seana PittSeana Pitt, an executive at American Express who chairs the PCI council, said the groups executive committee hopes that the formation of the advisory board will help reduce the confusion and resistance swirling around the security standard. The concerns about PCI stem at least partly from the fact that the companies directly affected by the requirements havent had a seat at the table until now, Pitt said.

According to Pitt, the advisory board will be responsible for collecting industrywide feedback on PCI, which is formally known as the Payment Card Industry Data Security Standard. She said the board is also expected to influence future enhancements to the standard.

Michael Barrett, CISO, Paypal Inc.

Michael Barrett, CISO, Paypal Inc.One of the members of the advisory board is PayPal Inc., a unit of eBay Inc. Michael Barrett, PayPals chief information security officer, called the boards formation a step in the right direction for PCI.

The PCI standard is extremely important in protecting the payment card industry, but it isnt a finished work of beauty yet, Barrett said. Its a work in progress. It has rough spots that need to be polished down. And that is best done by people who have had experience implementing it, he said.

Practical Advice

Barrett said PayPal already complies with the security rules and will be able to provide the PCI councils executive committee made up of credit card company representatives with real-world guidance about the standard. Weve seen where it works and where it doesnt, and can therefore make suggestions for tweaking the language here or driving it in a slightly different direction there, he said.

Other advisory board members include Bank of America Corp., JPMorgan Chase & Co., British Airways PLC and APACS Administration Ltd., a trade group for payment services companies in the U.K. The PCI councils executive committee will select seven more members at a later date. The goal is to ensure that the 21-member board has enough geographic and stakeholder diversity, Pitt said.

The PCI standard prescribes a set of 12 broad security controls that all entities accepting credit or debit card transactions are contractually obligated to implement. The requirements went into effect in June 2005 and cover functions such as data encryption, transaction logging and monitoring, and strong end-user authentication and access controls.

But many businesses began paying serious attention to the rules only after credit card companies warned last December that they would begin assessing stiff fines for noncompliance this fall. Since then, supporting the standard has become a major implementation issue. One of the big complaints from companies is that the requirements stipulate specific controls instead of broad security objectives.

PCI effectively is a proprietary standard, said Colin Whittaker, head of security at APACS. Now, he added, the PCI council wants to get wider engagement in place to ensure that the security rules meet the needs of businesses worldwide.

We need to make sure the standard remains relevant to the emerging threat environment, Whittaker said. And we need to make sure that it is sufficiently responsive and appropriate to all markets where payment cards are used, because there are different threat profiles [in different regions].

Theres a lot of pent-up frustration in the market about not being able to help shape the standard, said Avivah Litan, an analyst at Gartner Inc. For instance, there is considerable confusion about when companies can use so-called compensating controls in lieu of the actual PCI requirements, she said.

Similarly, Litan said, companies are looking for better guidance on prioritizing the controls mandated by PCI.

The advisory board should be able to put pressure on the PCI councils executive committee to change the current situation, Litan said. But, she cautioned, the advisory boards charter doesnt touch upon PCI implementation and enforcement issues.

Currently, each of the five credit card brands has its own implementation, auditing and enforcement practices, and its a huge challenge for businesses to keep up with all of them, Litan said. Whats really needed, she said, is a way to rationalize the implementation of the PCI standard.

The [advisory] board is a great communication vehicle, she said. But there are some immediate problems that arent being solved here.

Copyright © 2007 IDG Communications, Inc.

  
Shop Tech Products at Amazon