After Target, Neiman Marcus breaches, does PCI compliance mean anything?

Security failures at companies certified as PCI compliant suggest problems in standards and implementation

The recent data breaches at Target and Neiman Marcus have once again shown that compliance with the Payment Card Industry Data Security Standard (PCI DSS) is no guarantee against an intrusion.

What's unclear is whether the problem lies in the standard itself, or the manner in which it is implemented and assessed.

Neiman Marcus on Thursday became the latest company to suggest that PCI compliance had brought it little security against a major intrusion.

In a letter to U.S. Sen. Richard Blumenthal (D-Conn.) explaining the recent breach that exposed 1.1 million payment cards, Neiman Marcus CIO Michael Kingston claimed the intrusion happened even though the company had security measures that exceeded PCI standards.

Target, which last month disclosed a data breach that exposed credit card data on 40 million people, is also believed to have been PCI compliant at the time of the intrusion.

Several other companies that have suffered major data compromises in recent years have also claimed they were compromised despite being certified as PCI compliant.

Security analysts and researchers have differing takes on what might be going on.

Visa, MasterCard, American Express and other major credit card associations established PCI several years ago to get companies to adopt a set of security controls for handling credit and debit card data. Over the years, the retail industry in particular, is believed to have spent billions of dollars implementing PCI requirements and billions more in mandatory third-party compliance assessments.

That companies like Target and Neiman Marcus were compromised in such spectacular fashion despite adhering to PCI has vexed many.

The breaches "highlight weaknesses in PCI and in the security industry," said Avivah Litan, an analyst with research firm Gartner. Nothing in the PCI standard, for instance, would have helped Target detect and block the intrusion before it happened, according to Litan.

"PCI does mandate checking for malware but none of the typical anti-malware products could find the Target malware, and PCI doesn't mandate next-generation anti-malware security that's starting to emerge," she said.

Some of the problems may have to do with the manner in which compliance is assessed, Litan said. Most assessments are done using previously known attack vectors and threats. Companies are not being assessed for their readiness in dealing with new threats. "That's why we need a new paradigm and stronger security inside the payment system," Litan said.

James Huguelet, an independent PCI consultant, said the biggest problem with the PCI standard is that it doesn't require companies to encrypt data in motion. While the standard has requirements for encrypting data at rest, there is no such requirement for data in action during the entire transaction processing chain.

"This leads to many points along the path of an active transaction where criminal malware can 'spy' on the information as it passes by which is what appears to have occurred at Target," Huguelet said. The best approach is to require that all card holder data be encrypted at the point it is swiped all the way until it reaches the merchant's bank for processing.

"This would take merchants' entire retail infrastructure out of the gun sights of payment criminals. There would simply not be any payment data that could be stolen from the retailers," he said.

Such end-to-end encryption can be costly, Huguelet said, but it is a one-time cost that is sure to drive real and lasting improvements in retail security.

John Pescatore, director of emerging technologies at the SANS Institute, said the breaches point out PCI implementation failures rather than a lack of controls in the standards itself. There's plenty in the standard that should have enabled Target and Neiman Marcus to catch the intrusions on the way in or to find and block the path the intruders took to break into the networks, Pescatore said.

"Doing security right is not trivial. But the problem is not some lack of requirements in PCI DSS or other standards," he said. "In fact, it would be counter-productive to try to jam attack-specific requirements into standards. It makes no sense."

The part of the PCI process that needs change is the compliance assessment process, Pescatore said.

The certified security assessors who verify a company's compliance status often don't do a good enough job. "Implementation or process failures should be caught by the assessors who do the yearly evaluations, or by quarterly vulnerability scanning," he said. "But too often the yearly assessments don't catch much and quarterly vulnerability scanning is not frequent enough."

The PCI Security Council, which administers the standard, did not have any immediate comments.

This article, After Target, Neiman Marcus breaches, does PCI compliance mean anything?, was originally published at

Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed. His e-mail address is

See more by Jaikumar Vijayan on

Read more about data security in Computerworld's Data Security Topic Center.

Join the CSO newsletter!

Error: Please check your email address.

Tags retaildata securitysecurityendpoint securityNeiman Marcusindustry verticalsCIOdata protectionTarget

More about American Express AustraliaGartnerKingstonSANS InstituteTopicVisa

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Jaikumar Vijayan

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts