This is page 2 of:
PCI Talk is Cheap: Even Small Merchants Can Afford It
They get to fill out PCI DSS Self-Assessment Questionnaire (SAQ) A. Only 11 questions and they’re done. But many small businesses don’t have it so easy. They have multiple locations, multiple (usually older) POS systems, a flat network, systems with default passwords, unsecured system configurations, and lots of employees who have access to confidential data they don’t need.
They are small businesses, with big business security problems. But they feel they are not vulnerable because they don’t have “lots” of credit card data. The problem is that the bad folks typically use automated attacks to find unsecured servers, websites and can insert malware. Another popular method of compromise is that malware is uploaded by unsuspecting employees who visit social networking websites and download “member generated content” from any of the millions of bogus accounts that hackers can create automatically on some sites.
Although larger (Level 1 and 2) organizations typically have tools in place to prevent this or isolate its impact, many small businesses do not, and are therefore much more vulnerable than they believe.
One of the by-products of making it easy for small businesses to report their PCI compliance through the use of the 4 SAQs is that companies often fill them out without actually doing all the things they should be doing. Wow, what a shock! To try to detect how prevalent these “false positive” self-assessments are, we asked the small businesses whether they would have the documentation to back up their SAQ findings. As we expected, 23 percent said they did not have the documentation, and another 22 percent were unsure they could prove that they are compliant if asked to do so.
The point is: merchants are often “liberal” (which, in this case, is bad) in how they answer their SAQs. This finding of companies taking liberties with their SAQs may be one of the reasons why MasterCard recently decided to force both Level 1 and Level 2 merchants to use outside QSAs. The point here is that security and payment professionals who want to help small businesses improve their data security must come to grips with the fact that even though 86 percent of small businesses say they are aware of the PCI standards, and 65 percent say that data security is a high priority, there continue to be fundamental factors, such as a low sense of risk, other spending priorities, and a simple-to-fudge SAQ process that will continue to hinder efforts to get small businesses to take the actions that will materially reduce their IT security risks.
Although I realize it’s possible to read the PCI and Small Business report and get a really positive sense that small business managers are starting to care about security and PCI compliance, I believe that contrasting supportive comments with actions taken is a reasonable, if cynical, analysis of the findings. If you’d like to learn more about our research on PCI and small business, or any other topic, please visit the PCI Knowledge Base, and our “Contact us” page, or if you want to have a personal discussion about PCI and small business issues, just send me an E-Mail at David.Taylor@KnowPCI.com.
-Marc
August 13th, 2009 at 4:27 pm
I agree with you David. Opinion does not always translate into action when it comes to merchants taking the necessary steps to achieve compliance and secure credit card data. At the same time, I think that service providers in the payment processing industry are getting much better at developing solutions that lessen PCI Compliance scope and secure sensitive data for merchants – which will help move things along faster.
August 13th, 2009 at 5:31 pm
Hi, Bryan,
Good point. I really ought to write more about the use of service providers & outsourcing. It keeps coming up in our interviews with merchants. If you or anyone else reading this has suggestions for an “angle” for the piece, let me know. Remember, Evan always wants the topic to have a fresh approach. So, suggestions anyone?
thx, Dave T.
August 18th, 2009 at 8:19 pm
David you bring up some great points. Small businesses are targets for credit card hackers. In fact, a recent Visa review of fraud cases found that small businesses account for the vast majority of credit and debit card data breaches.
October 12th, 2009 at 12:55 pm
Rubbish,
The entire drive to PCI compliance is more driven by PCI committee members greed (many of which are involved in the network scanning and on-site consulting review business) than it has anything to do with any real steps toward reforming the overall card processing industry. Small businesses, like a martial arts school or a bicycle repair shop that just happen to process credit card transactions over an Internet connection are the least of the Industry’s problems. Hackers simply are not interested in spending a few days setting up to crack into a small merchant’s computer on the hopes of intercepting 50 – 100 credit card transactions a month. It just is NOT going to happen. They want the middle to large tier processors where they can be assured of a quantity of data to either resell or use directly.
What is happening is that small businesses, like the ones I mentioned above, are helping fund hundreds of new PCI compliance businesses with plenty of cash from unnecessary quarterly network scans. It simply results in wasted time from paperwork and trying to understand an industry that is not their core business. PCI DSS at this level, as currently implemented, does little to nothing to provide any more security to the card industry in general.
I am not bemoaning security standards or best-practices for keeping customer card data safe. I am just pointing out that it is the small businesses that are the absolute least contributors to the overall card industry losses that are paying the biggest price when tallied up. When I approach a new customer interested in accepting credit card payment and mention they will need to tag another $100 – $200 a year for quarterly network scans of their PC that they process credit cards on, in addition to any costs in time and software to GET compliant, they will likely tell me to go jump in a lake.
In the old days, the hard sell for a merchant account was always an argument of “will you waive the $50 set-up fee, we really can’t afford that as a small business.” Now I have to add these fees into the sales process. All these additional costs for small businesses via PCI DSS are an absolute death knell for anyone trying to sell these services to small businesses or for small businesses themselves.
If the PCI DSS committee members had focused their energies more on the card processors, gateway providers, and the myriad other middle to top tier providers, developed new standards for secure data transmissions, network compliance, etc., I would venture that some 25% – 75% improvement on losses could be seen by the industry in the next 5 years. Then, they could focus on education services for the small business owners and offer free (yes free) network scans and advice on making a merchant’s data safer for their own peace-of-mind and for the entire industry.
Let us not forgot the forest for the trees. The small mom-and-pop merchant is not the one making money to accepting credit cards. Indeed the merchant gives away between 2% and 5% of every transaction to Visa/MC/AMEX, etc. on each transaction. Yet it is the merchant having to pay even more to assure that those profits keep flowing to the big providers and their middle-man partners.