PCI Hypocrisy: Citi’s Data Breach
Written by Walter ConwayA 403 Labs QSA, PCI Columnist Walt Conway has worked in payments and technology for more than 30 years, 10 of them with Visa.
This past week, Citigroup announced its credit-card systems were hacked, compromising the card information on approximately 360,000 individuals. If this were a retailer, we would expect to see the card brands order a formal review by a PCI Forensic Investigator (PFI), a re-assessment of the retailer’s PCI compliance at the time of the breach and possibly significant fines and other penalties. Will Citi treat itself as harshly as it does its retailer customers that are breached? I wonder (and I imagine just about every merchant or processor that paid for PCI compliance or suffered a breach is wondering, too) if Citigroup will face similar consequences?
Just about a year ago, I raised the question of whether payment-card issuers should have an outside assessment of their PCI compliance. Everyone understands that issuers need to be PCI compliant. The PCI Council’s Frequently Asked Questions (FAQ) #5391 confirms this position with the statement: “PCI-DSS applies to any entity that stores, processes or transmits cardholder data and any such entity is expected to comply with PCI-DSS, including issuers.”
The big difference between merchants and issuers, however, is how they validate their compliance. Or I should say, whether they even need to validate their compliance. That same FAQ continues: “At their discretion, payment-card brands may require issuers [emphasis added] to validate PCI-DSS compliance.” In this case, the payment-card brands are American Express, Discover, JCB, MasterCard and Visa.
Let’s be clear on one thing: This data breach is a big deal. Based on public reports (I have no first-hand or inside information), hackers broke into Citi Account Online sometime in May and made off with the names, PANs, E-mail addresses and other personal information on roughly one percent of its 21 million North American customers. Maybe one percent doesn’t sound like a big number, but it translates into about 360,000 compromised accounts, which is a big number. Note, too, that the “other personal information” compromised could lead to identity theft and much more serious consequences for individuals than the inconvenience of having their credit or debit card replaced.
We should give Citigroup credit for going public to the extent it has fairly soon after the breach. But other than replacing the compromised cards, I have not read anything to indicate what Citi is doing internally to fix its system and network vulnerabilities. I would also be curious to know whether the card brands are involved.
If a retailer lost 200,000 PANs and cardholder names, the affected card brand(s) would want some answers. I know an organization that was ordered to investigate a breach, and it involved only 12 cards. A card brand could order Citigroup to go through a more formal forensic investigation (which Citi would get to pay for). Even if such an investigation isn’t ordered, it sounds like a good idea because Citi announced the breach was due to an external attack. (Full disclosure: I work for a QSA firm that is also a PFI.) Will Citigroup be ordered to conduct such an investigation?
-Marc
June 14th, 2011 at 12:22 pm
More data here:
http://www.dailymail.co.uk/news/article-2003393/How-Citigroup-hackers-broke-door-using-banks-website.html
Sadly the article claims this is a “sophisticated attack”. It is certainly not.
Changing the URL in an address bar is not “a vulernability in the browser.”
June 16th, 2011 at 12:21 pm
Generally speaking, banks only have two rules.
1. We make the rules
2. You must follow them
June 16th, 2011 at 2:31 pm
Walt poses an interesting question to say the least. “Will Citi treat itself as harshly as it does its retailer customers that are breached?” If PCI doesn’t force issuers to follow the same protocol as the merchants/retailers in the event of a breach, we may see a StorefrontBacklash from the retailers.
June 17th, 2011 at 1:01 am
Great article,
I know small companies, here in Colombia, investing great quantity of money, and great effort, in order to become PCI Compliant, just for one reason: The bank gives them all complete PAN, even if the small service provider doesn’t need it… the owner of the company told to me: “I dont need the PAN, I have requested the bank to not send me the PAN, I dont want the PAN!!!”…. but you know: The bank send that number, increasing the risk of fraud.
I think banks have the power, the money, and because of that, they enjoy some liberties, who needs who? who depends of who?
if the banks, accord that they dont like PCI, what can the brands do?? who’s bigger?? who’s stronger?? who’s the boss??… I’ve always have that doubt.
June 17th, 2011 at 7:51 am
Up until now the breaches occurred at PCI certified entities. What does it say about PCI, as a process? How could it be possible to buy by a PCI compliance seal for $299, and PCI compliant overnight at this place: https://www.trustwave.com/trustedCommerce.php
June 23rd, 2011 at 4:57 pm
I think the issuers should be held to higher standards – not weaker… But then again I also think people high in the public eye should be held to higher standards as they’re our decision makers and/or role-models… sadly that isn’t the case either… if anything, they’ve proved to me if you have enough money or are high enough up the food chain – you can get away with a lot more than the general public. Unfortunately I believe the same will be true with the issuers… they’re high enough up the food chain to be able to get away without many consequences.
June 24th, 2011 at 9:31 am
@Patrick – Dear Patrick, I am not an employee of Trustwave, nor will I derive any benefit at all from what I am about to elucidate…
I work with Trustwave professionally, and they are fast becoming one of the most recognised names in the PCI DSS compliance industry, because they are highly professional and 100 trustworthy (which I infer is accepted by the PCI Security Standards Council). They work with everyone from retailers to large national banks and government agencies (i.e. this is by no means a “fly-by-night” company, as your comment implies).
The seal you refer to is available for $299, but only if one is an ongoing member of Trustwave’s Trusted Commerce programme to achieve and maintain PCI DSS compliance. The seal is not just purchased over the counter to “be compliant overnight”.
If you have any further questions please contact a Trustwave sales representative and put in the investigative work to establish a proper case before going online with (possibly libellous) assertions. Sorry, don’t want to sound pedantic (too late!), and I also have my reservations about PCI DSS. I don’t have any reservations about Trustwave, however.