PCI Fines: Nuisance Or A Ticket To ROI?
Written by Evan SchumanGuestView Columnist David Taylor is the Founder of the PCI Knowledge Base, Research Director of the PCI Alliance and a former E-Commerce and Security analyst with Gartner.
Eduardo Perez of Visa has called its fines for non-compliance "nuisance" fines. In other words, the fines are not large enough to be a big financial burden to retailers but are large enough to get the CFO pissed off about having to pay them and maybe large enough to get a CEO to at least show up for a meeting to discuss PCI.
In theory, these fines are designed to drive greater security awareness. In reality, they seem to be merely driving "fine avoidance." Only a minority of organizations—about 15 to 20 percent, depending on the specific topic—has anything close to a "strategic" view of security. Of those organizations, most are focused on a common security infrastructure, increased centralization and improved responsiveness to threats.
But here’s the killer stat: Fewer than 5 percent of the people we’ve spoken with have a "business view" of security, in that they can relate the impact of specific PCI-mandated controls on such critical business metrics as fraud reduction.
To build an ROI case for compliance, companies must do more than "fine avoidance" calculations. Why? Because non-compliance places the fate of your security budget at the mercy of Visa, the Federal Trade Commission and a bunch of data thieves who, sadly, cannot be counted on to commit a regularly scheduled series of breaches that have a high enough profile for a CEO to actually pay attention.
The PCI standards are very detailed, of course. But even with all that detail, the standards are rarely definitive about how to implement a specific control. The most notorious case of this is PCI 6.6, related to Web application security, which says you can use a Web application firewall, do a manual code review or use an automated code review tool.
Clearly, the cost of these different control implementations can vary widely. If you wish, you can get away with spending almost nothing and pass this control via a homegrown code review process with some documentation found on the Web and customized to meet your needs. Although this approach can help a company avoid a fine, it makes no sense, given the high percentage of security breaches that are the result of poor Web application security.
On the other hand, using PCI compliance as the excuse to re-vamp your entire SDLC makes no sense either. Why? Simply because the lead time for this approach will necessarily force the organization to buy an application firewall—or several—so you can wind up spending easily $250 thousand for a Level 1 or 2 firm and only get a single checkmark for all that money.
This brings us to our favorite topic: cost-effective compliance. We argue that the essence of compliance-driven security is about choosing "middle ground" approaches that can address more than just PCI, in that other types of data can also be protected using the same controls. Examples of cost-effective compliance are mainly found in the automation of manual tasks such as log management, configuration management, identity management and access controls. This, of course, assumes that an organization already has security basics in place, such as AV, IDS/IPS and internal firewalls for network segmentation.
Our point is that out of all the things that PCI and other compliance mandates require, there are tools and techniques that have specific work-effort-related ROI. Security managers and vendors need to focus less on the overall ROI of PCI and more on the cost-effectiveness of specific controls, be they technical, procedural or human-oriented controls.
We are currently working on two different reports based on our research, and we’d like your help. For the National Retail Federation’s "Big Show" in January 2009, we’re working on a "Cost-Effective Compliance" project that will feature many of retailing’s Best Practices in PCI. The other effort of the PCI Knowledge Base is an analysis of the impact of PA DSS (Payment Applications Data Security Standard). If you are involved in either of these areas, or otherwise want to ask questions or discuss PCI, just send us an E-mail at David.Taylor@KnowPCI.com.
Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code.
-Marc
