This is page 2 of:
PCI Hypocrisy: Citi’s Data Breach
Will Citigroup be ordered to conduct such an investigation? A second consequence if a retailer were involved is fines. If fines were only about covering replacement costs, a fine wouldn’t make much sense. The bank would, in effect, just be paying itself the card reissuing costs. If, however, the fines are designed to punish noncompliant behavior, it might be a different story.
Sadly, what I do see are newspaper articles advising consumers on what steps to take to protect themselves. Everyone is recommending consumers change (and strengthen) passwords, check their credit reports and watch out for phishing E-mails.
All these recommendations are good. But in light of this data breach, it looks too much like the old game of blame the victim. A merchant or a bank gets hacked, and the cardholders are told to check their credit scores (at all three agencies) and go buy a paper shredder. Granted, the cardholders’ liability is virtually zero (at least for a credit card; it may not be so for a debit card). But with Citi’s breach of additional personally identifiable information (PII), identity theft is a possibility.
I have a good friend who is a very successful attorney, and she once told me she has a simple rule: She will not take on a client who thinks the world either is or should be “fair.” I sometimes have to explain that approach to merchants who are just learning about PCI. I don’t expect the world, or even the PCI part of it, to be fair. I do, however, believe it is in issuers’ own best interest to validate their PCI compliance. Citigroup’s unfortunate experience makes that case better than I ever could.
When I wrote about issuers and PCI compliance validation last year, I took the position that card issuers should not be ordered to validate PCI compliance. Instead, I made the case that issuers should voluntarily validate their compliance for three reasons: It is smart; it probably won’t be that difficult; and, most importantly, it is the right thing to do.
Today, I still believe all those things. But I find myself questioning my conclusion. I would love for Citigroup to announce publicly that it had conducted an outside PCI assessment and that at that time it was compliant. Such an announcement would reinforce to every merchant the importance of PCI compliance everyday, not just when the QSA is looking over your shoulder. Then, if Citi had been breached while compliant, we might learn more about potential new attack vectors.
It is probably too much to ask, but I would also like to know a few more details on the breach, so every issuer and merchant could learn from Citi’s experience. For example, did it result from a phishing E-mail to a helpdesk staffer (think RSA), a cross-site scripting attack or even a malicious insider?
What do you think? As a retailer or payment processor or service provider, do you think it is appropriate that issuers do not report when they validate their own PCI compliance? I’d like to hear your thoughts. Either leave a comment or E-mail me at wconway@403labs.com.
-Marc
June 14th, 2011 at 12:22 pm
More data here:
http://www.dailymail.co.uk/news/article-2003393/How-Citigroup-hackers-broke-door-using-banks-website.html
Sadly the article claims this is a “sophisticated attack”. It is certainly not.
Changing the URL in an address bar is not “a vulernability in the browser.”
June 16th, 2011 at 12:21 pm
Generally speaking, banks only have two rules.
1. We make the rules
2. You must follow them
June 16th, 2011 at 2:31 pm
Walt poses an interesting question to say the least. “Will Citi treat itself as harshly as it does its retailer customers that are breached?” If PCI doesn’t force issuers to follow the same protocol as the merchants/retailers in the event of a breach, we may see a StorefrontBacklash from the retailers.
June 17th, 2011 at 1:01 am
Great article,
I know small companies, here in Colombia, investing great quantity of money, and great effort, in order to become PCI Compliant, just for one reason: The bank gives them all complete PAN, even if the small service provider doesn’t need it… the owner of the company told to me: “I dont need the PAN, I have requested the bank to not send me the PAN, I dont want the PAN!!!”…. but you know: The bank send that number, increasing the risk of fraud.
I think banks have the power, the money, and because of that, they enjoy some liberties, who needs who? who depends of who?
if the banks, accord that they dont like PCI, what can the brands do?? who’s bigger?? who’s stronger?? who’s the boss??… I’ve always have that doubt.
June 17th, 2011 at 7:51 am
Up until now the breaches occurred at PCI certified entities. What does it say about PCI, as a process? How could it be possible to buy by a PCI compliance seal for $299, and PCI compliant overnight at this place: https://www.trustwave.com/trustedCommerce.php
June 23rd, 2011 at 4:57 pm
I think the issuers should be held to higher standards – not weaker… But then again I also think people high in the public eye should be held to higher standards as they’re our decision makers and/or role-models… sadly that isn’t the case either… if anything, they’ve proved to me if you have enough money or are high enough up the food chain – you can get away with a lot more than the general public. Unfortunately I believe the same will be true with the issuers… they’re high enough up the food chain to be able to get away without many consequences.
June 24th, 2011 at 9:31 am
@Patrick – Dear Patrick, I am not an employee of Trustwave, nor will I derive any benefit at all from what I am about to elucidate…
I work with Trustwave professionally, and they are fast becoming one of the most recognised names in the PCI DSS compliance industry, because they are highly professional and 100 trustworthy (which I infer is accepted by the PCI Security Standards Council). They work with everyone from retailers to large national banks and government agencies (i.e. this is by no means a “fly-by-night” company, as your comment implies).
The seal you refer to is available for $299, but only if one is an ongoing member of Trustwave’s Trusted Commerce programme to achieve and maintain PCI DSS compliance. The seal is not just purchased over the counter to “be compliant overnight”.
If you have any further questions please contact a Trustwave sales representative and put in the investigative work to establish a proper case before going online with (possibly libellous) assertions. Sorry, don’t want to sound pedantic (too late!), and I also have my reservations about PCI DSS. I don’t have any reservations about Trustwave, however.