PCI Fines: Nuisance Or A Ticket To ROI?

Written by Evan Schuman
November 30th, 2008

GuestView Columnist David Taylor is the Founder of the PCI Knowledge Base, Research Director of the PCI Alliance and a former E-Commerce and Security analyst with Gartner.

Eduardo Perez of Visa has called its fines for non-compliance "nuisance" fines. In other words, the fines are not large enough to be a big financial burden to retailers but are large enough to get the CFO pissed off about having to pay them and maybe large enough to get a CEO to at least show up for a meeting to discuss PCI.

In theory, these fines are designed to drive greater security awareness. In reality, they seem to be merely driving "fine avoidance." Only a minority of organizations—about 15 to 20 percent, depending on the specific topic—has anything close to a "strategic" view of security. Of those organizations, most are focused on a common security infrastructure, increased centralization and improved responsiveness to threats.

But here’s the killer stat: Fewer than 5 percent of the people we’ve spoken with have a "business view" of security, in that they can relate the impact of specific PCI-mandated controls on such critical business metrics as fraud reduction.

To build an ROI case for compliance, companies must do more than "fine avoidance" calculations. Why? Because non-compliance places the fate of your security budget at the mercy of Visa, the Federal Trade Commission and a bunch of data thieves who, sadly, cannot be counted on to commit a regularly scheduled series of breaches that have a high enough profile for a CEO to actually pay attention.

  • The Dollars and Sense of PCI
    The PCI standards are very detailed, of course. But even with all that detail, the standards are rarely definitive about how to implement a specific control. The most notorious case of this is PCI 6.6, related to Web application security, which says you can use a Web application firewall, do a manual code review or use an automated code review tool.

    Clearly, the cost of these different control implementations can vary widely. If you wish, you can get away with spending almost nothing and pass this control via a homegrown code review process with some documentation found on the Web and customized to meet your needs. Although this approach can help a company avoid a fine, it makes no sense, given the high percentage of security breaches that are the result of poor Web application security.

    On the other hand, using PCI compliance as the excuse to re-vamp your entire SDLC makes no sense either. Why? Simply because the lead time for this approach will necessarily force the organization to buy an application firewall—or several—so you can wind up spending easily $250 thousand for a Level 1 or 2 firm and only get a single checkmark for all that money.

  • Cost-Effective Compliance
    This brings us to our favorite topic: cost-effective compliance. We argue that the essence of compliance-driven security is about choosing "middle ground" approaches that can address more than just PCI, in that other types of data can also be protected using the same controls. Examples of cost-effective compliance are mainly found in the automation of manual tasks such as log management, configuration management, identity management and access controls. This, of course, assumes that an organization already has security basics in place, such as AV, IDS/IPS and internal firewalls for network segmentation.

    Our point is that out of all the things that PCI and other compliance mandates require, there are tools and techniques that have specific work-effort-related ROI. Security managers and vendors need to focus less on the overall ROI of PCI and more on the cost-effectiveness of specific controls, be they technical, procedural or human-oriented controls.

  • The Bottom Line
    We are currently working on two different reports based on our research, and we’d like your help. For the National Retail Federation’s "Big Show" in January 2009, we’re working on a "Cost-Effective Compliance" project that will feature many of retailing’s Best Practices in PCI. The other effort of the PCI Knowledge Base is an analysis of the impact of PA DSS (Payment Applications Data Security Standard). If you are involved in either of these areas, or otherwise want to ask questions or discuss PCI, just send us an E-mail at

  • advertisement

    Comments are closed.


    StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

    Most Recent Comments

    Why Did Gonzales Hackers Like European Cards So Much Better?

    I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
    Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
    A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
    The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
    @David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

    Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.