Evan Schuman's StorefrontBacktalk

The good news is that training has the biggest financial payoff for achieving and maintaining compliance. Training is cheap. It is a few hours once or twice a year. It is having users sign a piece of paper acknowledging their responsibility each year. I firmly believe people want to do the right thing, either because they are moral beings or because they want to keep their jobs. Either way, the idea is to tell users what they can and cannot do with cardholder data—and then enforce the rules.<pPCI v2.0 requires a comprehensive effort to determine a merchant's PCI scope. This requirement, coupled with the spread of personal technology, means educating users should be a high priority for IT managers.

The NRF/First Data survey of small to midsize retailers leads me to a related conclusion about the criticality of education for security and PCI compliance. In that survey, the overwhelming majority of businesses (86 percent) said they care about protecting their customers’ card data and they feel payment card security is important to their business. That certainly is great news, but what followed had me scratching my head.<pOf those businesses that store PAN data, only 68 percent reported taking any steps at all to protect that data. That sounds a bit like me saying I recognize traffic accidents are dangerous, so I'll use my seatbelt about two-thirds of the time. Or telling the IRS I know I should pay my taxes, but how about I just pay two-thirds of them.

That nearly a third of small and midsize retailers are retaining cardholder data without protecting it should be very frightening news for security professionals and, unfortunately, very good news for the bad guys.

Once again, I believe education can be a big part of the solution. It’s good that smaller retailers have heard of PCI (66 percent of survey respondents), but we have to do better. For example, about the same percentage (64 percent) made the incredible statement that their business is not vulnerable to payment card data theft. I don’t know what newspaper these merchants are reading or where they get their news, but it seems like a lot of small retailers are not making a connection between storing cardholder data and their risk of a very expensive data compromise.

As an industry we have done a good job of raising awareness of PCI DSS, but we now need to move to convincing the majority of small retailers that they are at risk. I want to commend the NRF and First Data for this survey. It paints a very interesting and complex picture, and I’m only looking at a small part of it. The challenge now will be what the industry can do to get the rest of the PCI message to vulnerable small and midsize retailers.

An alternative to education might be technology. Actually, it might be two technologies. For retailers who feel they need to retain cardholder data, tokenization can be an attractive solution. They can track what they need to track, but by using meaningless tokens instead of PANs. For the rest of those retailers, a point-to-point encryption approach that encrypts cards when they are swiped might be a good way to reduce PCI scope and risk.

Right now, we are all waiting for additional guidance on these promising technologies from the PCI Council. But the potential for reducing retailer risk is enormous.

What do you think? I’d like to hear your thoughts. Either leave a comment or E-mail me at wconway@403labs.com.