Congress Probing PCI, Threatens To Get Involved
Written by Evan SchumanHearing a litany of PCI problems, the U.S. Congress threatened to get involved, passing laws making certain provisions mandatory. Although few retailers argue that PCI isn’t in need of serious help, Congressional assistance wasn’t quite the help desired. It’s akin to calling for help because your basement is flooded and having a tsunami respond. Suddenly, the basement flood looks a lot more tolerable.
On Tuesday (March 31), the House of Representative’s Committee on Homeland Security held a hearing where, according to this detailed report from Forbes, committee chairman Rep. Bennie Thompson suggested that the PCI rules were written by card companies to shift blame to retailers and partners rather than actually preventing cybercrime. “I’m concerned that as long as the payment card industry is writing the standards, we’ll never see a more secure system,” Thompson said.
-Marc
April 2nd, 2009 at 7:42 am
This couldn’t be more true. The standard is vague in many areas and instead of upgrading the technology where it is the weakest it focuses on areas where the data is stored. If they mandated a better hardware encryption and key management system that required end to end encryption of card data and information, we wouldn’t even need to worry about the rest of the PCI spec. They also need to make cards that can’t easily be cloned.
April 2nd, 2009 at 1:00 pm
I truly agree that the PCI DSS standard was created by the card brands to shift risk from them to the acquires and the merchants. And some of this risk should be shifted. However, wouldn’t the industry be better served if 1. All pre authorization data was encrypted end-to-end and 2. that the PAN was no longer needed by the merchant for any reason (charge backs, refunds, etc…) after authorization to the point where storage of the PAN is also considered prohibited.
April 16th, 2009 at 5:58 pm
As I understand it, the PCI rules are intended to be technology-agnostic so these “beyond PCI” solutions are just that. If you do store or transmit cardholder data then elements of the PCI standards apply. There’s so many complexities to end-to-end encryption for financial transactions that are just being ignored. David Taylor just scrapes the tip of the iceberg and most these comments are so myopic to regional challenges, technology challenges and may (probably) not be a long-term solution as Mr. Taylor hinted at.
May 6th, 2009 at 3:26 pm
Someone commented that PCI is technology-agnostic… I would strongly disagree. The wording of most the SAQ checklist questions indicate they are based or focused on WINTEL environments. While the questions do not highlight a specific vendor solution, the wording quite clearly reveals a WINTEL solutions bias.