Evan Schuman's StorefrontBacktalk

There are many causes for this, but jurisdiction is a big part. Some retailers have had Loss Prevention take on store-level PCI compliance as part of their regular audits, but most LP departments have very limited IT skill sets, so this rarely works. At other retailers, PCI is managed out of the IT department, and we all know how much IT people like going into "the field," so that rarely works, either. In still other cases, there's a separate Compliance function that owns SOX and PCI, HIPAA. Most of these people are lawyers or "wannabe lawyers" who rarely show up at meetings let alone visit the stores. Read more...

Last week, StorefrontBacktalk ran a story chastising a security vendor, Shift4, for having issued a news release that said retailers using its products wouldn't have to worry about PCI requirements because they would be excluded. The vendor on Monday issued a news release, apologizing for the earlier one and corrected the record. But the core question--about it's encryption approach--still stands. Read more...

My favorite aspect of writing about security is that software designers work so hard to craft sophisticated, multi-level strategies to protect data, which is then periodically sidestepped by some kid with $18 worth of equipment, engaging in an easy blunt force attack that no one anticipated.

Case in point: Some clever folk at Princeton came up with this delicious and low-cost way around typical encryption methods. It’s based on RAM chip’s tendency to keep all data–including encryption keys–for seconds or even minutes after power is cut off. The Princeton approach then used a common dust removal aerosol can to deep-freeze the chip before killing power, a cooling tactic that sharply lengthy how long the RAM remembered the desired key data. From there, simple pattern recognition software quickly found the keys. This Princeton video demo is worth watching.…

This move comes on top of an incident earlier this month when an undersea cable was cut near Dubai, also wreaking havoc with global Internet traffic. Are more robust safeguards needed? Is these kinds of disruptions can be happen so easily by accidents, how vulnerable would they be to deliberate terrorist efforts? Read more...

The stops and starts of mobile commerce in the U.S. has been well reported, along with the fact that many parts of Europe and Asia are well ahead of us. But here is a fascinating CNN report out of Kenya that details mobile-commerce efforts among–so help me–goat traders.

No, we’re not talking about Wall Street sorts, as in oil traders. We’re talking people working the fields selling and buying goats, where all funds quickly get converted into virtual dollars. There are no bank accounts nor credit cards behind these transactions. It goes from cash to mobile. …

RFID-tagged products will have to be deactivated at the POS throughout Europe, if draft guidelines proposed this month by the European Commission are approved.

A public consultation is being launched into the “soft law” guidelines that EU Information Society and Media Commissioner Viviane Reding hopes will be adopted by the European Union executive to be applied in all the bloc’s 27 member states, according to this Reuters story. The guidelines are “tentaitively scheduled to be adopted before the summer of 2008,” the Commission said in a statement.…

The token approach is hardly new and it simply replaces a credit card number with a token that acts as the number throughout the payment approval cycle. It's fair to say that such a method—in theory—would reduce the risks of card transactions by shrinking the window of vulnerability. But it's hardly fullproof protection and as long as retailers accept credit card payments, they are almost certainly under the PCI jurisdiction. That didn't stop Shift4 on Wednesday from issuing a statement that "merchants concerned about PCI DSS compliance have an option that enables them to avoid its burdensome requirements." Read more...

But a recent court ruling and some congressional legislation threaten to change the rules retroactively. Read more...

Taking some cabs in New York City this month, I was thrilled to see the contactless devices in the backseat, only to be told by three different cabbies to not use them because customers were complaining about getting double-billed. This week, visiting three different grocery chains in New Jersey, tried unsuccessfully to use my contactless card there. The first time, a cashier looked at me as I asked about using my contactless card.Read more...

Referring to $178 million the chain had set aside to deal with data-breach-related costs, TJX said that on Jan. 26, 2008, "TJX reduced the reserve by $19 million, primarily due to insurance proceeds with respect to the computer intrusion, which had not previously been reflected in the reserve, as well as a reduction in estimated legal and other fees as the Company has continued to resolve outstanding disputes, litigation and investigations." Read more...

The reasons are many, but a frequent issue is that the chains are not able to get close enough to these independent or affiliated stores to accurately determine whether a breach at one of these stores could compromise the corporate network and data assets. Perhaps worse, they believe that any breach of such stores, whether or not corporate data is compromised, will cause corporate brand damage. Read more...

Nearly one-third of merchants dismiss the concept of tokenization because they consider their environment to be too complex, with card data in so many places. But a related reason for the quick dismissal is they see their card data as very "dynamic" — being used by many different applications and service providers. Read more...

With CRM systems trying to interact with Web analytics, mobile databases, purchase and returns histories and tons of other non-payment databases, the amount of non-credit-card data that is at risk easily dwarfs Visa transactions. Read more...

Although that amount might seem trivial, the librarian initially argued that it was likely more than most consumers who filed class-action lawsuits ever received (after attorney fees are paid) and it would be received much more quickly.Read more...

Breach letters are being sent out so frequently that I wonder if it's going to pique the business interests of Hallmark. A card for every occasion, when you care enough to breach the very best. Perhaps a merger with their Get Well cards? "Sorry to hear that you're not getting around these days.... [open card] .... but your CVV sure as heck is. Call 1-800-DATA-OOPS for your free year of credit monitoring, courtesy of your neighborhood retail chain." Read more...

But, for better or for worse, that's not a long-term situation. Like the presidential candidates who had to fly South for the winter (or fly the coop entirely), these compliance salesfolk have a limited lifespan. Within the next year or so, retailers are going to shift from trying to become PCI compliant to having to maintain PCI compliance. Read more...

"This is very good news for most retailers who were struggling with the previous questionnaire and PCI process," said Gartner security analyst Avivah Litan. Read more...

At least that's one of the core conclusions from a report released Thursday from technology analysis firm Gartner Inc. Read more...

The point that these vendors make is that if you don't have the data, then you've outsourced your risk. But Taylor writes that he's always lived by the principle that "you don't outsource risk" because when it comes time to file lawsuits, the merchant will still get named. Read more...

Yes, it's never a good idea to ignore E-mails from FTC attorneys. But these folk had some excellent points, most of which amounted to an agreement that the enforcement was lethargic but that Congress is to blame. Read more...

When these alerts and log files are allowed to "sit around" without being processed, the data and the lack of action become "evidence" that could be used to show negligence, in the event of a breach. Read more...

EBay’s PayPal confirmed Monday that it is paying $169 million in cash to buy an Israeli online risk tool vendor.

The companies said that “key personnel” from Fraud Sciences Ltd.—including Yossi Barak, Fraud Sciences’ COO, and founders Shvat Shaked and Saar Wilf—will join eBay while “Gadi Maier, Fraud Sciences’ President and CEO, will provide strategic and operational support to the company during the integration period.”…

The new interim CEO, Bruce Johnson, came up through the KMart side of the business and he had gone to KMart from French retail empire Carrefour, where he had been director, organization and systems and a member of the management board. Before that, he spent 16 years at Colgate-Palmolive and had worked as a management consultant at Booz Allen & Hamilton and Arthur Andersen & Company.Read more...

The 389-store grocery chain—employing about 59,000 in Massachusetts, Connecticut, Rhode Island, Maine, New Hampshire, New York and New Jersey—has been running this trial since October at 90 of its stores in Massachusetts, Connecticut and Rhode Island. Read more...