Feeds

Merchants call credit card industry's bluff on compliance

PCI DSS off the agenda

Security for virtualized datacentres

Nine in ten (88 per cent) European firms have failed to achieve compliance with a credit card industry standard for processing ecommerce transactions.

European merchants are behind their US counterparts in getting up to speed with the Payment Card Industry's Data Security Standard (PCI DSS), according to a survey by management tools firm NetIQ. The findings of the survey come less than two weeks before a 30 June deadline for compliance with a significant revision in the standard that adds web application security requirements.

PCI DSS was introduced by the major credit card companies as a means of encouraging merchants to engage in best practice security. The 12 point guidelines cover a basic set of requirements such as the need to keep systems up to date with patches and to encrypt cardholder data, for example.

A poll of 65 merchants across Europe by NetIQ revealed that two years after the standard was introduced the majority of firms are still way off being compliant. Worse, the majority (54 per cent) have no timetable for getting up to speed. Only 17 per cent of respondents reckoned that they would be compliant within six to twelve months.

By comparison, 23 per cent of respondents to a similar survey of 300 US organisation said they were already PCI DSS compliant. However more than two in five (44 per cent) of those quizzed had no idea when they would achieve compliance.

At first sight attaining PCI DSS compliance may seem easy enough but the path to getting a sign-off on the standard can be tricky in practice. Half of those working towards obtaining the PCI DSS seal of approval have been doing so for more than six months. Although failure to achieve compliance with the standard allows credit card firms to levy penalties, many organisations are postponing compliance out of a belief that it's a stick card issuers are reluctant to wield.

Seven out of 10 of those quizzed by NetIQ reckoned that the penalties for non-compliance would only occasionally be levied, while 23 per cent said that fines would "almost never" be issued. Many of the merchants are more worried about dishonest workers than external hackers or business partners.

Compliance with the PCI DSS standard involves self assessment in the case of smaller ecommerce firms, ranging up to annual audits for the largest firms. Achieving the PCI DSS standard can lead to lower merchant fees but doesn't necessarily mean every organisation that goes through the process is secure.

For example, US grocery chain Hannaford warned in March that an information security breach (later blamed on malware) had exposed an estimated 4.2 million credit card records. Hannaford had achieved PCI DSS compliance prior to the breach but the approval process failed to uncover the flaws that led to the breach. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Scrapping the Human Rights Act: What about privacy and freedom of expression?
Justice minister's attack to destroy ability to challenge state
WHY did Sunday Mirror stoop to slurping selfies for smut sting?
Tabloid splashes, MP resigns - but there's a BIG copyright issue here
Google hits back at 'Dear Rupert' over search dominance claims
Choc Factory sniffs: 'We're not pirate-lovers - also, you publish The Sun'
EU to accuse Ireland of giving Apple an overly peachy tax deal – report
Probe expected to say single-digit rate was unlawful
Inequality increasing? BOLLOCKS! You heard me: 'Screw the 1%'
There's morality and then there's economics ...
Hey Brit taxpayers. You just spent £4m on Central London ‘innovation playground’
Catapult me a Mojito, I feel an Digital Innovation coming on
While you queued for an iPhone 6, Apple's Cook sold shares worth $35m
Right before the stock took a 3.8% dive amid bent and broken mobe drama
EU probes Google’s Android omerta again: Talk now, or else
Spill those Android secrets, or we’ll fine you
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.