What’s Missing In The New PCI Regs?

Written by Evan Schuman
August 22nd, 2008

When the PCI Security Council this week detailed a bunch of changes it will include in PCI 1.2, what might be more worthy of note is what they didn’t address.

There were technical issues—such as segmentation and tokenization—that didn’t get referenced, but also policy issues. Why isn’t there a more clear-cut appeal process, for retailers who believe their assessor is improperly interpreting the rules? Today, the council will try and address technical questions, but that rarely involves overruling an assessor. Visa has been known to get involved with a retailer who has an assessor complaint, but that’s a very rare occurrence. Read more.


2 Comments | Read What’s Missing In The New PCI Regs?

  1. Walt Conway Says:

    Good points on QSA conflicts of interest — all of them. Right now, the best way to respond is to make sure to send in the “QSA feedback form” to the PCI Council detailing your experience. Didn’t get one from your QSA (or ASV, for that matter)? They must have forgotten to give it to you… No problem: download the form from the Council’s website ( and send it in. The Council has been talking about their quality assurance program for QSAs, but if merchants don’t send in their experiences nothing can be done to get rid of the ethically-challenged or simply incompetent ones. And to be fair, there are a lot of pretty good QSAs out there who share your opinions.

  2. Steve Sommers Says:

    I fully agree that some QSA’s are pushing wares that they have some sort of vested interest in pushing. I would go one further. I suspect that some conflicts of interest start in the committees that are creating the PCI requirements. Case in point, PCI 6.6:

    6.6 Ensure that all web-facing applications are protected against known attacks by applying either of the following methods:
    • Having all custom application code reviewed for common vulnerabilities by an organization that specializes in application security
    • Installing an application layer firewall in front of web-facing applications.

    A few discrepancies here that throw up a red flag in my mind: 1) Code reviews and application layer firewalls (ALF) or web application firewalls (WAF) address different aspects of security. 2) Organizations and individuals that specialize in application security are not governed or certified by any controlling body, so therefore there is no consistency or confidence level in their offering. 3) Since these organizations are not governed, does PCI-SSC accept any liability for zero day (or zero hour) exploits attributed to a less then ethical organization? (watch how many Russian and Chinese startups pop up in the near future that “specialize” in application security) 4) Does PCI-SSC accept any liability for loss of trade secrets from these same unethical organizations? 5) To my knowledge, ALF/WAF’s do not re-encrypt on the application side so this forces cardholder data (CHD) to be transmitted in the clear within the DMZ – to me, this opens a larger hole than it plugs. 6) Lastly, what happens when PCI 1.3 comes out requiring CHD transport encryption on both public and private networks to plug the Hannaford exploit? Are people purchasing ALF/WAF’s today going to have to fork out upgrade fees or repurchase in the near future or will they be grandfathered in leaving a long term security hole?

    Numbers 3 & 4 above are referring to the thin grey line that separates white hatters from black hatters (ethical vs. unethical hackers). I’ve ranted enough on 6.6. Other sections have similar discrepancies, though not as glaring. IMHO, this tells me that whoever added this language was dabbling in something beyond their expertise or multiple parties with different agendas threw this section together.

    While I believe that PCI has been a great benefit to the point of sale industry, I also believe that more thought and oversight needs to be put into the development of the program. One idea that I think would help, a thorough intentions document; one that states the goal and risk that this requirement is litigating. The intent must go beyond “annual key changes – this is a best practice.” If the thorough intent was a prerequisite to rule additions, changes, or the existing requirements, this would help point out conflicts and discrepancies to whomever was overseeing the program.

    Steve Sommers
    VP Applications Development
    Shift4 Corporation —


StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

Most Recent Comments

Why Did Gonzales Hackers Like European Cards So Much Better?

I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
@David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.