This is page 2 of:
Clarifying, Somewhat, The PCI Wireless Security Standards
Finally, I rarely quarrel with the language in documents because it’s usually possible to discern the intent, even when the words may be confusing.
But I think the issue of sampling store-level security as part of the PCI compliance assessment is important enough to bring up a quote from this document: “An organization may not choose to select a sample of sites for compliance. Organizations must ensure that they scan all sites quarterly to comply with the standard. The organization’s responsibility is to ensure that the CDE is compliant at all times. With that said, during a PCI DSS assessment, the organization or its assessor may choose to validate compliance with requirement 11.1 by selecting a sample of all locations.”
This reads like the committee started to “get tough” on sampling, then decided to back off. But it does make sense. The point here is that a merchant cannot decide, before the fact, that it will only make some of its stores PCI compliant. All stores have to be made to be compliant. However, when it comes to validation of compliance, you can select a sample of stores for the test.
Store level sampling is one area where we continue to hear “horror stories” – from both sides. Some assessors, to win business with low-cost bids, are still significantly under-sampling or they let the merchants pick the stores to be sampled. Some merchants, doing their own self-assessments, are selecting “known good” stores, rather than doing any kind of random or quota-type sampling.
Given that the merchants bear the risk and liability, all of this may be perfectly reasonable. But it’s not the point of a sampling process that is designed to show “representative” results. The point here is that merchants have come a long way in some areas, but wireless security at the store level is still a “laggard” compared to other aspects of PCI compliance.
There is a lot of activity in the wireless sector, especially with mobile payment starting to come online. I’m personally very interested in hearing about the wireless and mobile security issues and projects because we’re finding many examples that are not addressed explicitly by the PCI standards and companies are wondering if their projects are “safe” or whether they will have to make changes with the next version of PCI DSS comes out in the Fall of 2010. For more on this topic, please visit the PCI Knowledge Base, if you want to view our research. If you want to have a personal discussion about PCI and wireless or mobile payment issues, just send me an E-Mail at David.Taylor@KnowPCI.com.
-Marc
July 23rd, 2009 at 10:36 am
David makes some very good points here. As described in the wireless guidelines document, a wireless IDS/IPS is really the only practical way to achieve PCI compliance. Walkaround audit are expensive, unreliable and not scalable. Traditional, onsite wireless IDS/IPS systems have often come with a high price tag and only a few large organizations can afford them.