Proving Homegrown Security Is Good Enough

Written by Evan Schuman
July 24th, 2008

Guest Columnist David Taylor is the Founder of the PCI Knowledge Base, Research Director of the PCI Alliance and a former E-Commerce and Security analyst with Gartner.

Leading retailers are spending millions to build customized security architectures only to be frustrated by assessors and acquirers who are looking for "brand name" security products. Should retailers give in and buy packages or just develop better documentation and testing procedures?

This is called the hazard of being too smart. Nothing is more frustrating to a really smart person (so my smart friends tell me) than to do something incredibly clever and then have to explain it to dumb people.

That’s the situation many retailers find themselves in when it comes to developing highly customized or integrated data security packages; they’re frustrated that they have to prove the effectiveness of the package to their PCI assessor or merchant bank, who just doesn’t seem to understand why the retailer didn’t just "buy a package."

In addition, many assessors or banks are looking for a level of testing and independent review that goes well beyond what the developers have put together. I’ve spoken to dozens of retailers who have spent millions of dollars on these systems. Most are very frustrated that assessors, banks and the card brands all seem to prefer packaged software, even if the packages would not meet the needs of the retailer’s business as well as the custom approach.

Even outsourcing is easier if branded. After about 170 hours of interviews for the PCI Knowledge Base, it’s clear that the "easy route" to passing a compliance review is to be able to list a dozen or so "brand name" security products with which your assessor, acquiring bank and the card brands are familiar. This is true even when it comes to the process of outsourcing.

We’ve talked with merchants who have been given a "hard time" (in their view) because their plan for removing card data from their environment involved developing a customized system for substituting non-card numbers for card numbers and then using a third party to secure and manage the single instance of the real card data. This process is often called "tokenization."

You can’t go wrong buying XXXX. In the IT business, whatever technology is being acquired often must be justified to a non-techie, usually the CFO. Branded packages have been the simple way past such reviews for decades. PCI simply exacerbates this situation by adding additional levels of detailed review. Because these people review dozens or even hundreds of merchants’ security each year, it’s logical that they would prefer the "shorthand" answers branded security offerings represent.

Upgrade your SDLC. I’m not suggesting that retailers give up on building custom security controls or management applications. Indeed, for some retailers, their existing environment can only be managed via such approaches. But I am saying that it is important to recognize that assessors, acquiring banks and the card brands will need to review whatever is developed, so building such things as a thorough (preferably external) code review into your SDLC is standard operating procedure for the leading retailers I’ve talked with.

When combined with thorough documentation specifically designed to meet an external security review (i.e., that makes specific reference to security policies that themselves have been reviewed for PCI compliance), then the "proof process" will become much easier.

Why using packages is good. The bottom line is that when PCI or other compliance reviews are conducted, there’s a valid reason for preferring branded products to homegrown ones. An application that has been installed and tested by multiple other merchants is statistically less likely to have vulnerabilities than code written by Retailer X’s developers and has only been tested by Retailer X’s developers.

An external compliance review process that has a built-in preference for packaged approaches is based on that logic. It’s the retailer’s job to prove the effectiveness of what they are doing to secure card data, and it’s important to understand the rationale for why some paths to providing this proof are easier than others.

  • If you’re a retailer, we would like to get you involved in a 100 percent anonymous study of PCI best practices that the PCI Knowledge Base is doing for the National Retail Federation. If you’d like to participate, send me an E-mail at

  • advertisement

    Comments are closed.


    StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

    Most Recent Comments

    Why Did Gonzales Hackers Like European Cards So Much Better?

    I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
    Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
    A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
    The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
    @David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

    Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.