How Independent Are PCI’s Software Testers?
Written by Evan SchumanFellow blogger Steve Sommers, over at Shift4, has been following up some of his sharper comments from last week about PCI’s efforts to charge listing fees to get on the official list of PCI-compliant applications. He made such an elegantly clean argument on Tuesday, I felt the need to share.
“PCI’s justification for the fee is that they want to be self sufficient and independent for the card brands. This is good in theory if you ignore two glaring obstacles,” he wrote. “First, the card brands make up the entire executive committee. And two, a majority of the General Managers and Working Group Chairpersons (possibly all, some titles are missing) are people that represent the card brands.” I’ve disagreed with Sommers from time to time, but that’s a hard argument to ignore.
-Marc
October 9th, 2008 at 9:50 am
I think anything that adds to the overhead of achieving brand-mandated PCI compliance is ridiculous at this point and inherently offers an advantage to larger market players. The folks asking to be listed already paid the premium to have one of the eight PCI approved labs evaluate their product. Being listed should be automatic upon certification.
October 9th, 2008 at 7:38 pm
You are very correct; the PCI costs are definitely going to be a barrier to entry for many small vendors. I don’t think there is any consideration given by the PCI SSC to entry costs or ongoing costs to vendors. I guess some would argue that these small vendors inherently produce less secure code because they obviously don’t have the money to produce secure code. I think this argument is bull and I would argue that a majority of true innovation comes from small vendors. Unfortunately, until people start to squawk more, you can expect more fees.
October 11th, 2008 at 5:36 pm
The following comparison may be simplistic, but surely the principle is the same as smog testing a road vehicle. The smog standard is set by an independent board and the tests are done by independent verified testers who are not permitted to carry out repairs.
What we have in the PCI industry is the equivalent of Ford and GM setting the smog standard.
Furthermore, the PCI vulnerability scanning is done by firms like Ambiron Trustwave who offer both conformance testing (smog testing) and consultancy (smog repair), a clear conflict of interest.