Evan Schuman's StorefrontBacktalk

Still, so much of IT these days reflexively responds to a problem by whipping out the purchase orders and trying to throw whatever technology—the more expensive, the more comforting—is available at the issue. Sometimes, it takes a smaller retailer to point out that that is not always the most cost-effective—or even the most “just plain effective”—route.

But let’s be clear. Going back to a non-integrated approach certainly means losing a lot. From a security standpoint, it almost certainly means giving up encryption, so all card data—if accessed—is easy for anyone to read.

Then again, most professional cyber thieves are focused on tapping into such targeted data via the Internet or via physical assault on the card swipe or the POS. So it’s unclear how likely it is that data would be accessed from an analog connection dialing into a card processor. A thief who wanted to access it most likely could, but it’s so much easier—read cost-effective—to stick with Internet access. To make any real money with card data theft, millions—and sometimes tens of millions—of cards need to be accessed. That plain old analog telephone line makes it hard to profitably grab a lot of cards.

Also, the comments about vendor recommendations isn’t intended to suggest that vendors are necessarily being deceitful or greedy. After decades of doing business this way, it’s simply ingrained—not unlike a surgeon who tends to see “cutting a patient open” as the best treatment for almost any malady. After all, it’s what they’re trained to do.

Rather, this cautionary tale suggests not taking the traditional approach if an easier, cheaper method might suffice. It also means thinking through the inherent (and sometimes subconscious) biases of the experts whose advice you seek.

That’s why it’s always made us nervous that PCI assessors can sell the products and services that make a chain PCI compliant. Even the most honest of assessors can’t help but be a little bit influenced by that the revenue from selling their own offerings, especially in a down economy when every dollar means a few more days of not being laid off. Given the latitude that assessors have, can they truly divorce their bonus from what the retailer truly needs to be PCI compliant?

One of the points Cyopsis’ Roberts made was that IT managers—after a breach—should trace everything back to find the root cause of the breach. “They need to train their people to code more securely,” he said.

Maybe IT directors should sit back and not only consider the source code, though. In light of the advice they’re getting and who they’re getting it from, maybe they should think beyond the source code and to also, if you will, consider the source.