The WiKID Blog

Viewing posts tagged pci

networkworld-on-pci-conflicts-of-interest

Posted by: admin 14 years ago

NetworkWorld has an article on the potential for conflicts of interest in the PCI world. In sum:

• There are only 60 qualified security assessors (QSAs).
• Many QSAs also sell products.

more-on-pci-security-random-pen-testing

Posted by: admin 14 years ago

In thinking a bit more about PCI security since my post on PCI visibility. I think what Visa and Mastercard need to do is to hire independent 3rd party penetration testers to pen test merchants and processors.

The PCI Three are making a big switch in September, when they will start fining acquiring banks non-compliant merchants. However, there are two problems with the auditing procedures: Auditors are paid by the companies they are auditing and audits are static snapshots. I'm not insinuating anything here about the ethics of PCI auditors, just pointing out the agency conflict and that a company might get compliant for an audit, then lapse out of compliance.

pci-expanding-to-europe

Posted by: admin 14 years ago

According to Security Fix Visa is going to enforce PCI DSS in Europe:

Visa Inc. on Monday dramatically expanded its credit and debit card security requirements to retailers in Europe, an unexpected move that could be a financial boon to security auditing companies, but a huge cost for European merchants already feeling the pinch from the global financial crisis.

I'm fascinated that this is a surprise. My reaction was, "hmm I would have thought the PCI already applied in Europe".

merchants-are-not-going-to-make-the-pci-dss

Posted by: admin 14 years ago

No surprise there, security is hard. Read the story on PCI compliance at Dark Reading

maybe-they-will-pay-it-with-a-credit-card

Posted by: admin 14 years ago

A credit union has sent TJX a expenses related to the breach at TJX. Interestingly, $500k is for "brand damage":

"The bill was for both direct operational costs that we incurred reissuing new debit cards to our customers, as well as the costs to us from a reputational standpoint," he said. According to Blake, the TJX breach resulted in HarborOne having to block and reissue about 9,000 cards at a cost of around $90,000. The remaining $500,000 is what Blake believes the breach cost the credit union in terms of brand damage.

And it looks like more states are pursuing regulations requiring retailers to take responsibility for data breaches.

HarborOne's action comes amid growing pressure from credit unions and other financial institutions around the country to get retailers to take financial responsibility for data compromises. Credit union associations in various states are vigorously lobbying lawmakers to approve bills that would require retailers to implement stronger data-security measures and to reimburse costs associated with reissuing payment cards after a breach.

One such bill is the Plastic Card Security Act that was signed into law in Minnesota last month after being actively pushed by the Minnesota Credit Union Network. And the California Credit Union League is now pushing a bill similar to the one in Minnesota. Other states, including Texas and Connecticut, have considered similar proposals recently.

Will the PCI data security requirements be too little too late?

• Page 10 of 10
• ←
• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• 10
• →