Evan Schuman's StorefrontBacktalk

Tucked away in forgotten corners of your network sits a wide range of old, forlorn applications. Beyond collecting electronic cobwebs, these apps potentially pose one of the most serious threats to your data security.

Visa routinely compiles a list of applications that, it believes, store sensitive authentication data after a payment has been authorized. Many app versions on this “Bad Apps” list are outdated and no longer being sold. But that doesn’t mean they are not lying around in hidden corners of quite a few major—and some not-so-major—retail chains.

Perhaps it’s an app that was inherited through an acquisition. Maybe it was used for a trial that was aborted. But when someone resurrected that trial, the company simply continued to use the now out-of-date version it initially ran on. Maybe a smaller chain used the app and never bothered to update it.

No matter the reason, this list serves as an effective heads-up for retailers so they can look for these old app versions. The latest edition of the list—dated June 2—details applications from 31 software vendors, including some of the largest in retail: IBM, Micros, NCR, Radiant and VeriFone, among others. In many cases, these are older versions of applications that are indeed certified compliant with PA-DSS (PCI Payment Application Data Security Standard, which replaces the old Visa Payment Application Best Practices, known as PABP). However, a decent minority of the apps—especially those from outside the U.S.—do not have any PCI-compliant versions.

(See the full list of apps that Visa sees as retaining prohibited data.)

Even for those apps that have newer compliant versions, the status of the older versions vague. After all, the PCI Council also has a “Good Apps” list of approved applications. If the council says a vendor’s versions 5.8 and more recent are compliant, it might mean that only those versions were tested. This view suggests that the earlier versions may or may not be safe. The Bad Apps document goes further, however, and strongly implies that the application does indeed retain such prohibited data.

Retailers could theoretically just take the safe route and only use application versions that are listed on the public compliant list, which is what PCI Columnist Walt Conway advocates.

The Bad Apps list is not one that Visa wants to be too easy to get. Indeed, the brand would rather the list only be available through its acquirers. Visa stamps these updates to acquirers “this list is not to be published publicly” and “when sharing this list, acquirers must not publish the list to a Web site or to a place where the list may be made publicly available.”