This is page 2 of:
A Look at PCI in 2010
I expect no Level 2 merchant blowback against MasterCard. The card brands should remain relatively quiet this year. That is, I don’t look for significant new mandates from Visa or game changing surprises from MasterCard that impact merchants directly.
While I don’t expect it, I will be watching for signs of merchant reaction to MasterCard’s new Level 2 validation requirement. Specifically, I will be interested to see if some reasonably visible L2 merchant drops MasterCard acceptance in a very public display of displeasure over its new PCI validation requirements.
I support MasterCard’s move for more comprehensive validation of Level 2 merchant compliance. Unfortunately, the requirements were communicated poorly and they proved to be a moving target. I still do not agree with the reciprocity provision and shifting the date will only delay the merchant train wreck.
Even with all of that, I can’t see a merchant dropping MasterCard acceptance: merchants want to make the sale. People carry fewer cards these days so reducing your customer’s payment options makes no sense and it is inappropriate to involve the customer in your dispute.
There are, however, at least two precedents. Several years ago, some restaurants very publicly rebelled against American Express’s higher fee structure and stopped accepting that brand. More recently, many colleges and universities have dropped Visa acceptance because Visa is the only brand that does not allow the schools to pass on the merchant fee. And Best Buy has now stopped accepting Visa contactless cards because of what the retailer saw as a fee hike.
Unlike the restaurant boycott of Amex, I don’t think Visa will step in with an advertising blitz supporting a merchant who drops MasterCard. Similarly, there could be negative publicity for a merchant perceived as taking this action because they “do not take customer privacy seriously.” Nevertheless, it will be interesting to see if any L2 merchant gets sufficiently incensed to justify accepting only one bank card brand – albeit the larger one – and not the other.
There will be no technology silver bullets. I expect no major breakthrough in technology easing merchants’ PCI burden this year. I can’t tell you how much I want to be wrong, but I just don’t see it happening.
The Council is investigating several technologies that could impact PCI compliance and even change the DSS itself. The hurdles are pretty high, given all the existing merchant systems and process that would need to change to implement these technologies. And, in this economy, it will be difficult for most merchants to justify the investment and disruption.
Do you disagree? Let me know. Leave a comment below or send me an E-mail at wconway@403labs.com.
-Marc
January 7th, 2010 at 11:39 am
Is anyone seeing movement towards revoking the “free pass” for transferring data unencrypted over private networks? In both Heartland and Hannaford data was being sniffed “on-the-fly”. Will the continuing trend towards malware-based data collection attacks drive the council to consider requiring the encryption of data “in flight”?
January 7th, 2010 at 12:26 pm
Anyone else here reading “I.T. WARS”? I had to read parts of this book as part of my employee orientation at a new job. The book talks about a whole new culture as being necessary – an eCulture – for a true understanding of security, being that most identity/data breaches are due to simple human errors. It has a great chapter on security. Just Google “IT WARS” – check out a couple links down and read the interview with the author David Scott. (Full title is “I.T. WARS: Managing the Business-Technology Weave in the New Millennium”).
January 7th, 2010 at 7:10 pm
@Dave,
The focus of DSS is data at rest, but as you observe, data in transit can be vulnerable. Like you, I would not be surprised to see some move by the Council addressing unencrypted data over private/internal networks. I just don’t know when. I can think of two arguments for sooner rather than later. First, they update the DSS to reflect current attack vectors, which as you point out applies here. Second, the Council is looking at “emerging technologies,” a couple of which can in theory address this issue.
Will PCI DSS reflect this as a new requirement? I’d say it will someday. The uncertainty is when that day will be. Merchants and processors truly interested in security will address this issue without waiting for the Council to mandate it.
January 8th, 2010 at 3:46 pm
Interesting article. I’m curious. What happens to the PA-DSS validation status of a payment application once the Security Council implements a new standards version? Does it have to be re-validated under the new standard in order to remain compliant? It was my understanding that an application would remain compliant and acceptable for new deployments until it hits the re-validation date listed on the Security Councils web-site for that application even if a new standard was issued. Once that date is reached, it would then have to be re-validated under the current standard. Is this a correct interpretation?
January 30th, 2010 at 6:35 pm
Don,
Thanks for your comment and question. My understanding is the same as yours. That is, you would revalidate your app against the new/revised PA-DSS when you next assessed, whether that is at the current expiry date, or when you either introduce a new version or make a significant change to the app. Don’t forget those last two events, either which triggers a revalidation.