PCI security standard remains solid, chief says

Breaches at Target highlight need for multi-layered security effort, Bob Russo says.

The head of the organization in charge of maintaining security controls over credit card transactions insisted Monday that its standards remain solid despite the concerns raised by data breaches at Target and other companies.

Speaking with Computerworld, Bob Russo, general manager of the PCI Security Standards Council, downplayed criticisms about the effectiveness of the Payment Card Industry Data Security Standard (PCI DSS) and said it remains a vital part of the multi-layered approach needed to secure payment card data.

"Any time there's a breach it sheds a spotlight on what we do," Russo said. But instead of pointing fingers at PCI, there should be more focus on working collaboratively to address security issues in the payment card industry, he said.

"Everybody is looking for a silver bullet," in the wake of the recent breaches, said Russo, who is scheduled to testify before Congress pn Wednesday on the issue. "As far as I know, no silver bullet exists. It's a combination of people, process and technology."

The PCI Council and the PCI standard in general have come under scrutiny in the past few weeks following the data breaches at Target, Neiman Marcus and several other retailers.

All organizations that accept credit and debit card transactions are required to implement the security controls prescribed under PCI. Companies, especially major retailers like Target, have spent billions of dollars over the past several years implementing PCI requirements and billions more in mandatory third-party compliance assessments.

Yet compliance with the standard has been no guarantee against data breaches, prompting some to question whether the problem lies in the standard itself, or the manner in which it is implemented and assessed.

According to Russo, a company that implements all required PCI controls should be well-protected against data breaches. The standard not only prescribes controls for blocking security intrusions but also for detecting them in the event that an intrusion occurs, he said.

Companies have often complained that they suffered a data breach even though they were fully certified as being compliant at the time of the breach. In reality, though, with every major payment card data breach in the past, companies were not PCI compliant when the breach happened, Russo said.

Though a company might be certified as PCI compliant, it's important to remember the compliance certification is just a snapshot in time, he noted.

"You can be in compliance today and be totally out of compliance tomorrow," because of a failure to implement some required small security measure, he said. "This is really about security. Not about compliance. These are the bare minimum things you should be doing."

Russo said the PCI Security Council is open to making changes to the standards if they are identified as necessary. For instance, the council is reviewing its recommendations around data encryption, he said.

Currently, the PCI standard only requires encryption for data at rest, but not while the data is in transit along the transaction chain. The council recommends that retailers and others in the payment industry adopt a more comprehensive point-to-point encryption approach, although it is not a requirement.

According to Russo, point-to-point encryption is one of the issues the council will look at in the coming months. The council is also looking at approaches like tokenization for protecting cardholder data, he said. With tokenization, card data is substituted with a random string of numbers so even if the data is compromised, it holds no value for data thieves.

Broad adoption of the Europay MasterCard Visa (EMV) smartcard standard could also enhance debit and credit card security, Russo said.

The recent breaches have fueled fresh calls for adoption of the standard in the U.S., which remains the only major country in the world not to have moved to it already. Visa and MasterCard have both said they will move over to EMV by the end of next year.

But as with every other aspect of payment card security, the EMV standard is just one piece, Russo said. Though EMV is widely touted as being better than magnetic card technology, it would not have prevented the Target data compromise, he said. It would have only limited, but not stopped, how the stolen cards could be used, he said.

One area where the council has received feedback from stakeholders is on the consistency of the PCI compliance assessment process, Russo said. In response, the council enhanced testing to ensure that assessments are done in a more consistent and standardized manner.

"Additionally, throughout the standards, we've built in more education around the intent of the requirements so that those implementing the standards in their organization have more information regarding the goal of the controls and how they need to be implemented," he said.

This article, PCI security standard remains solid, chief says, was originally published at Computerworld.com.

Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed. His e-mail address is jvijayan@computerworld.com.

See more by Jaikumar Vijayan on Computerworld.com.

Read more about data security in Computerworld's Data Security Topic Center.

Join the CSO newsletter!

Error: Please check your email address.

Tags retaildata securitysecurityendpoint securityencryptionNeiman Marcusindustry verticalsdata protectionTarget

More about TopicVisa

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Jaikumar Vijayan

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place