A PCI Holiday Wish List

Written by Walter Conway
December 15th, 2010

A 403 Labs QSA, PCI Columnist Walt Conway has worked in payments and technology for more than 30 years, 10 of them with Visa.

As we enter the holiday season, it seems like a good time to put together my holiday PCI wish list. Unlike most lists you may receive, I am targeting each of my wishes to a particular party. And because it seems like a shame to exclude anyone, my PCI wish list includes card brands, trade associations, certain retailers and, of course, the PCI Security Standards Council itself.

It makes sense to start at the top, so I would like to ask the PCI Council to publish a full, one-year schedule of training sessions. The Council’s training programs are excellent. Because of that, they are very popular and fill up quickly. As of this writing, the Council has not yet posted future training classes on its Web site. When that list is posted, my wish is that it be a complete schedule for all 2011 courses.

Planning a year out is difficult, and certainly I would understand or even expect changes to meet demand. But a full year’s schedule lets merchants (and QSAs!) make plans and budget for the session and location that is best for them.inflatable double slip and slide with pool

I’ll risk being greedy by asking for a second present from the Council: an RSS feed on the Frequently Asked Questions (FAQ) page. The FAQ section of its new (and very informative) Web site addresses many questions for merchants and QSAs, and the Council committed at the recent Community Meeting to update it regularly. Unfortunately, most retailers and their QSAs cannot check the Web site for updates every few days.

The need for an RSS feed was raised at the 2009 Community Meeting in Las Vegas and again at the 2010 meeting. Many of us subscribe to Visa’s RSS feed, which offers a choice of security- and PCI-related topics. Perhaps this could be a model?

Speaking of card brands, I have a wish-list item for them, too. It is one that will benefit thousands of retailers and other merchants. I wish brands would update the contract provisions of their new connected processors to make it easier for customers to comply with PCI DSS.

I’m referring to Requirement 12.8.2, which requires merchants to “maintain a written agreement that includes an acknowledgment that the service providers are responsible for the security of cardholder data the service providers possess.” That merchants have difficulty meeting this requirement is not new news and hasn’t been new news in quite some time. What is new is that merchants continue to have difficulties even when their processor is now connected to a card brand.

Therefore, my wish is for card brands everywhere to have any processing operations revise their contracts immediately to include language that complies with Requirement 12.8.2.

My holiday wish for the industry associations is to have them do more to help their members become PCI compliant. The PCI Council’s training programs are excellent, but they only go so far. They deal with PCI in the abstract. What merchants need is training that builds on the Council’s programs with more industry-specific, hands-on case studies of how real live merchants—retailers, restaurants, convenience stores, gas stations, hotels and software providers—implement PCI compliance.


One Comment | Read A PCI Holiday Wish List

  1. Todd Michaud Says:

    Great column as always. Tis the season, so let me through an analogy at you…

    PCI compliance is a lot like dieting. There are a ton of people out there that know they need to do it, but they don’t. Just like dieting, there is a big gap between knowing what you should do and actually doing it.

    Educating an overweight person about the risks of heart disease, etc. will not encourage them to diet and exercise, no more than educating merchants about the risks of PCI will get them to install a firewall.

    Education is needed, but it is NOT the answer. What is needed is for someone to figure out the secret sauce that creates ACTION. The existing “liability potato” approach is not working.

    I don’t have the answers, but I have some thoughts as to what would help…

    In my mind there has to be financial benefit to becoming compliant and EVEN MORE for those that become secure. Reduce interchange for those who are compliant (versus fining those are not).

    Incentivize POS providers or processors to offer secure network services for merchants. Why couldn’t a processor offer a secure network connection to their facility? Why couldn’t POS provider integrate a firewall into their solution?

    For this to work, the merchant needs to do no more than sign a check. (At least for the Level 4 merchants out there.)

    Just my two cents…


StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

Most Recent Comments

Why Did Gonzales Hackers Like European Cards So Much Better?

I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
@David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.