Evan Schuman's StorefrontBacktalk

The truth is that the influence of age, income and background are trivial—in terms of projecting how long that person will wait for a page to display—when compared with something much more personal: Why is that person trying to access that Web page right now? If they're in an airport trying to find an alternative to a snowed-in flight, they have little choice but to be patient. Or a 16-year-old trying to download a new hot song. And if it's a consumer merely browsing to kill time? Almost any delay will make that consumer flee.Read more...

But Conway sees the data discovery prediction the most significant. "If you have a lot of locations, you have work to do setting up and scanning all those databases, workstations and servers. Especially watch to see if the Council decides to implement data discovery like it did wireless scanning (Requirement 11.1). If this happens, merchants will not be able to sample locations and will have to search each one. The good news is that you can conduct these searches internally and there are good open source products available. Your QSA likely would only need to verify the results of your automated discovery and to review the scope of your search."Read more...

The controversy involves Visa forcing chains to accept more expensive signature—as opposed to the more retail-friendly PIN—authorization. Best Buy is still accepting Visa magstripe cards plus other brands' contactless offerings. "After several discussions with Visa produced no agreeable changes," the chain started removing its acceptance of Visa contactless cards in October, completing the cutoff in November, said one Best Buy executive involved in the decision. The cutoff happened store by store along with POS upgrades. "Our decision was based on the costs associated with requiring contactless debit transactions be processed as signature debit."Read more...

Sounds like a dream-come-true right? The perfect answer to “What do you want to be when you grow up, Billy?” It is very frustrating to try to hire someone for this role and get it wrong.Read more...

In tracking PCI issues within various major chains, we have seen that the differences in perception can be staggering. In an attempt to get a handle on where most companies stand, we’re putting out a small survey on usage and challenges.

As a thank you for retailers involved in PCI completing the survey, we are offering them a free autographed copy of Hacking Exposed: Network Security Secrets, which Amazon has labeled a best-seller.

[SURVEYS 2]

The denial of a preliminary injunction ruling wasn't entirely a surprise, as reports of Heartland's apparently contradictory statements had already surfaced. But when U.S. District Court Judge Mary Cooper issued a ruling in the case on December 23 that dismissed so many of Heartland's claims against VeriFone, that was a bit startling.Read more...

In what’s being described as a delayed Y2K programming issue, the move to 2010 has apparently shut down some 30 million cash and credit cards since New Year’s Day, according to data available Tuesday (Jan. 5) from the country’s three largest banking associations, according to this Wall Street Journal story. The problem was tied to a chip in the smarts that wasn’t able to properly process the year 2010.

Interestingly enough, U.S. retailers were, for the most part, spared this problem for their domestic stores because smart cards are still a minority of the cards in use. See? Being backward can have its advantages. It reminds me of a conversation I had at a restaurant tradeshow in mid-December 1999, where I was seated with the CIOs of several huge restaurant chains. When asked if they feared the weeks-awayY2K moment, all said they didn’t. “Yeah,” I agreed. “Most upgrades have cleaned up the issue.” No, you don’t understand, the CIOs said. “We’re not worried because most of our stores are still using DOS.”…

John Verdeschi, the senior business leader for fraud management at MasterCard Worldwide, said he had heard "no complaints" about the timing from retailers. "We didn't hear that as a specific issue," he said, adding that the PCI SCC's new training program was the only reason for the deadline change. Another element of the December 13 change is a little less cut-and-dry. Until about three to four months ago—Verdeschi described it as "August or September"—MasterCard had posted on its site a description of the rules for which PCI level (1, 2, 3 or 4) it would consider retailers. MasterCard described parity with any "competing payment brand," wording that it had used since 2005. But in "August or September," Verdeschi said, that wording was removed.Read more...

The chain has thus far avoided some of the read-rate accuracy problems that have plagued other trials (A&P last month swore off scanning directly from cell phone screens due to concerns about inaccuracies), pointing to an approach that determines the make, model and carrier of a phone before trying to scan. It then adjusts the scan parameters to be the most effective for that particular device. But 7-Eleven is also running smack into the delicate ethics issues around mobile marketing, where chains need to collect phone numbers and E-mail addresses to begin. In this case, for example, many of the consumers being targeted are children, officially as young as 16 and potentially as young as 14. Those youngsters are mixed with a target group of young adults, as old as 24.Read more...

Kathleen Edmond, the chain's Chief Ethics Officer and an attorney, thinks it's not only realistic, it's indeed about survival and profit-retention. A common theme among Edmond's examples is that even a moment that seemingly serves the interests of both the buyer and the seller may be unethical and ill advised. "If you're going to use someone's lack of sophistication in a way to benefit you and they've not objected, that doesn't mean that it's the right thing to do," she said. "There were throngs of people signing up for mortgages that were not good for them." Was it ethical for banks to approve loans to consumers if the banks knew that it was unwise in those cases?Read more...

As a philosopher might say, the only safe way to delete a file is to have never recorded it. As silly as that may sound from a data security perspective, it shouldn’t be dismissed. Consider this scenario: A chain notices a PDA app that uses geolocation to match consumers with local happy hours. (For those outside the U.S., it’s a time when bars tend to heavily discount alcoholic beverages.) It throws the app onto its mobile site as a service for customers and thinks nothing of it.

As a matter of policy, the chain decides that it will not use any of that information for marketing or anything else. Fair enough. But what if local law enforcement chooses to subpoena those records so that it can know who frequents happy hours a lot. And if it can tap into real-time data, police could try and catch people in the act. And, maybe some civil attorneys try to subpoena the documents as well, for some automobile accident cases. That’s the subject of our column this week on the McAfee security blog.…

The first MasterCard change made this month was pushing the Dec. 31, 2010, deadline back six months, to June 30, 2011. But MasterCard has also made two other key PCI changes. It has redefined what Level a retailer is (Level 1, 2, 3 or 4) to, for the first time, mirror whatever level Visa has determined. The last of the changes is to allow Level 1 and Level 2 retailers to perform their own assessments—using the retailer's own salaried audit staff—as long as those audit staffers have passed PCI-approved training courses. "A bunch of Level 3 and Level 4 merchants just became Level 2s," said one QSA. "With this reciprocity gotcha, MasterCard giveth and MasterCard taketh away."Read more...

The chain, which has stores in 48 states in the U.S., lost its data connectivity on December 10 when the service provider made a modification that went awry. "It was an inadvertent switch to dynamic IP from fixed IP," said CIO Ray Hamilton. "That shouldn’t happen, and it took us a couple of days to resolve."Read more...

It boggles his mind that millions of dollars are spent each year to “secure” database lookup (authorization) and database write (settlement) transactions. Tokenization and encryption should have been required years ago. Although not all techies agree that this approach is best, I think we all agree that it is much better than nothing. But too many companies--my firm included--are going to have to spend too much money to implement such daydream adventures, so we keep living with a broken system. Unfortunately, this broken system has left franchisors with no “good” options.Read more...

Consider this example: A merchant shows its QSA its Web application firewall (WAF) and asks the QSA to mark it compliant with PCI Requirement 6.6. But the QSA probes deeper, and he finds that the WAF is in “learning” mode, which means it is letting everything through. Indeed, the WAF has been in learning mode since it was installed after the last assessment a year ago, meaning it is pretty useless from a security point of view and definitely not meeting the intent of the requirement.Read more...

The government was asking a federal judge for more time to investigate before a sentencing hearing, said the memo from Assistant U.S. Attorneys Stephen P. Heymann and Donald L. Cabell. "The government has been given no prior notice of either of these assertions, the defendant's intended reliance on expert testimony to support them or that the defendant was undergoing a psychological forensic examination." Read more...

Unlike earlier retail data breach lawsuits—typically with consumers or banks as plaintiffs—this was a shareholder action and merely needed to prove that Heartland execs mislead the public about their security status. U.S. District Court Judge Anne E. Thompson, sitting in New Jersey, concluded Heartland execs had not. She listened to recordings of an analyst call to conclude that, in full context, the processor's security claims were technically true.Read more...

From a non-IT perspective, the move would certainly discourage consumers from accepting—or even pursuing—instant credit, which has been a wonderful thing for merchants. It's unlikely that shoppers will be thrilled when asked by gum-chewing, teenage POS jockeys to whip out paystubs or a copy of last year's 1040s. Consider an analogy: The police chief who lives next door has a town ordinance passed requiring you to store in your basement a ton of heroin and cocaine that the police department has just seized. Read more...

Gonzalez agreed to plead guilty to his role in attacks on Heartland, Hannaford and 7-Eleven in a document signed at 10:14 AM New York time on Dec. 2.Read more...

It’s been almost two years since Sears become the first U.S. retailer to embrace 2D barcodes, a move that launched a tidal wave of, well, pretty much nothing. This week, Google said it was trying to breathe life into these barcodes by mailing 200,000 2D barcode stickers to small businesses throughout the country. Such a move could allow these mom-and-pops to offer in-depth marketing information to anyone at the click of a smartphone.

The Google initiative, first reported by Techcrunch, is proactive and therefore feels much more powerful than Microsoft’s efforts to market its “Tag” code idea. And Google is sweetening the potential adoption-rate odds by giving away 40,000 Quickmark 2D barcode reader apps for the iPhone. Just like contactless, which is also suffering from a heart-pounding string of apathy, 2D needs three things to happen in parallel if it is to succeed: A huge number of places that are showcasing 2D barcodes; a very strong percentage of consumers carrying phones that can easily read 2D barcodes; and plenty of publicized incentives to get those consumers to use the 2D barcodes from those retailers. The phones are well on their way, and Google’s initiative seems like a good faith effort to jumpstart the other two points.…

The four-month-long trial that began in November is significantly limited in scope, involving only BlackBerry devices. And it doesn't even involve BlackBerries with payment chips installed. Instead, the effort involves NFC payment chip stickers attached to the backs of the smartphones.Read more...

All told, one sensitive document created on a company desktop machine may, in a matter of minutes, be unintentionally copied in 10 locations: an employee’s desktop; the LAN server that backs it up; a PDA; the carrier/vendor server that synchs the PDA data; a memory stick; the home computer the employee used that memory stick in; the personal external backup drive connected to that employee’s computer; an offsite backup service the employee uses; the shadow copy on that employee's work desktop machine; and the shadow copy on that employee's home desktop machine. And it can get a lot worse.Read more...

What many franchisees have not discovered, pens Franchisee Columnist Todd Michaud, is that the advanced integration between POS, inventory systems and video surveillance systems can be used to catch these types of activities and dramatically improve the top and bottom line. If you really want to be depressed, go to Google and type the words: “working at BRAND_NAME steal” or “how to steal from BRAND_NAME” or other variations of the same. What you find may be surprising. Many people have actually posted how-to guides for the best way to steal from a certain brand as an employee.Read more...

Most companies issue their employee road warriors with corporate travel cards. Companies also issue purchasing or procurement cards that their staff use to buy everything from office supplies to store fixtures. Most of these cards are American Express, MasterCard or Visa branded. Companies store the PANs in databases that are accessible to travelers and others who use the data for expense reporting and tracking. In my experience, the PANs get printed on hardcopy reports. The question for IT execs is, do you need to include these cards in your (merchant) PCI scope? The surprise answer is that it depends on where you store the cardholder data and, interestingly, on which brand of card you choose.Read more...