Evan Schuman's StorefrontBacktalk

In explaining its reason for creating the 33-page document, the PCI council’s Special Interest Group (SIG) on wireless technologies said its goal was “to help organizations understand how PCI DSS applies to wireless environments, how to limit the PCI DSS scope as it pertains to wireless and practical methods and concepts for deployment of secure wireless in payment card transaction environments.”

Troy Leach, technical director of the PCI SCC, said there was an obvious need to gather together and better explain the many references to wireless security that are sprinkled throughout the PCI DSS. “When someone says `wireless technology and PCI,’ most people go to section 4.1 of the standard, which goes into transmitting cardholder data over a wireless network,” Leach said. “But they might overlook the fact that throughout the 12 domains of the PCI standard there are (other) references to wireless.”

The PCI DSS Wireless Guideline is, in essence, “a set of shared concepts that everyone can use, be they merchants, network processors, IT departments or assessors, so everybody is kind of using the same language,” said VeriFone Director of Product Security Doug Manchester, who served as the chairman of the SIG. For example, the document specifies what the PCI DSS considers to be “in scope” and “out of scope” when it comes to a wireless network and PCI. Manchester noted that, while a network that doesn’t intentionally broadcast any cardholder data over a WAN is considered out of scope, the guideline “goes to great length to say you can’t be wireless agnostic or unaware” because it is easy for somebody to install a rogue wireless card or access point into a network and compromise the system security.

To that point, Taylor and others note that the new guideline, while pointing out the danger of rogue wireless devices being installed, “is explanatory but could be more explanatory and more helpful” to companies intent on preventing them.

Even so, some retail IT executives were underwhelmed by the guideline. One, requesting anonymity, said it would be “onerous” for most companies to conduct quarterly scans of all their facilities, using wireless signal sniffers, in an effort to unearth rogue access points. As pointed out by others years ago, these scans tend to raise all sorts of false alarms that take time to track down, especially if the scanned facility is in an urban area full of external Wi-Fi networks. The IT executive also contended any smart hacker wouldn’t allow the rogue access point to broadcast its SSID or even be run in anything other than a response-only mode.

Manchester said he expected such critiques of the guideline. If nothing else, the guideline helps make companies aware of the dangers, he said. “Criticisms are going to exist no matter how many referees you put on the playing field and how many video replays you have,” Manchester said. “I think the guideline helps with this common vocabulary and it helps give people mental models they can share.”