Jaikumar Vijayan, Computerworld
04.01.2009

The PCI standard, long touted as one of the private sector's best attempts to regulate itself on data security, is increasingly showing signs of coming apart at the seams.

At a hearing in the U.S. House of Representatives Wednesday, federal lawmakers and representatives of the retail industry challenged the effectiveness of the PCI rules, which are formally known as the Payment Card Industry Data Security Standard (PCI DSS). They claimed that the standard, which was created by the major credit card companies for use by all organizations that accept credit and debit card transactions, is overly complex and has done little thus far to stop payment-card data thefts and fraud.

The hearing, held by a subcommittee of the House Committee on Homeland Security, also highlighted the longstanding bitter divide between retailers on one side and banks and credit card companies on the other over the role that the latter organizations should play in protecting card data.

In one of the bluntest denouncements of PCI DSS to date, Rep. Yvette Clarke (D-N.Y.), chairwoman of the subcommittee that held the hearing, said the standard by itself is simply not enough to protect cardholder data. The PCI rules aren't "worthless," Clarke said. But, she added, "I do want to dispel the myth once and for all that PCI compliance is enough to keep a company secure. It is not, and the credit card companies acknowledge that."

Much of PCI's limitations have to do with the static nature of the standard's requirements, according to Clarke, who said the rules are ineffective at dealing with the highly dynamic security threats that retailers and other merchants now face.

For instance, she pointed to the data breach disclosed early last year by Hannaford Bros. Co., which said that attackers had stolen card numbers and expiration dates by installing malware on servers at each of the Scarborough, Maine-based grocery chain's stores and capturing the data as cards were swiped at cash registers.

Hannaford was certified as PCI-compliant by a third-party assessor in February 2008, just one day after the company was informed of the system intrusions, which had begun two months earlier. That means the grocer received its PCI certification "while an illegal intrusion into its network was in progress," Clarke said.

Similarly, RBS WorldPay Inc. and Heartland Payment Systems Inc. were both certified as PCI-compliant prior to breaches that the two payment processors disclosed in December and January, respectively. Visa Inc. dropped Heartland and RBS WorldPay from its list of PCI-compliant service providers last month and is requiring them to be recertified, although it has said that merchants can continue to do business with the two companies in the meantime.

Clarke also blasted the credit card companies and card-issuing banks for continuing to use what she described as "1950s-era" payment systems. She called on them to make the investments that are needed to move away from magnetic stripe and signature transactions to the kind of approaches used in Europe and Asia, such as so-called chip-and-PIN techniques.

"The bottom line," Clarke said, "is that if we care about keeping money out of the hands of terrorists and organized criminals, we have to do more, and we have to do it now."

An independent governing body called PCI Security Standards Council LLC, with representatives from the credit card companies, banks and merchants, was set up to administer PCI DSS in 2006.

But Michael Jones, CIO at arts and crafts retailer Michaels Stores Inc. and one of the people who testified at Tuesday's hearing, said that the PCI rules appear to have been developed more "from the perspective of the card companies, rather than from that of those who are expected to follow them." As a result, he contended, the requirements aren't always about better securing...

Continue Reading at The Industry Standard