Feeds

Merchants call credit card industry's bluff on compliance

PCI DSS off the agenda

Security for virtualized datacentres

Nine in ten (88 per cent) European firms have failed to achieve compliance with a credit card industry standard for processing ecommerce transactions.

European merchants are behind their US counterparts in getting up to speed with the Payment Card Industry's Data Security Standard (PCI DSS), according to a survey by management tools firm NetIQ. The findings of the survey come less than two weeks before a 30 June deadline for compliance with a significant revision in the standard that adds web application security requirements.

PCI DSS was introduced by the major credit card companies as a means of encouraging merchants to engage in best practice security. The 12 point guidelines cover a basic set of requirements such as the need to keep systems up to date with patches and to encrypt cardholder data, for example.

A poll of 65 merchants across Europe by NetIQ revealed that two years after the standard was introduced the majority of firms are still way off being compliant. Worse, the majority (54 per cent) have no timetable for getting up to speed. Only 17 per cent of respondents reckoned that they would be compliant within six to twelve months.

By comparison, 23 per cent of respondents to a similar survey of 300 US organisation said they were already PCI DSS compliant. However more than two in five (44 per cent) of those quizzed had no idea when they would achieve compliance.

At first sight attaining PCI DSS compliance may seem easy enough but the path to getting a sign-off on the standard can be tricky in practice. Half of those working towards obtaining the PCI DSS seal of approval have been doing so for more than six months. Although failure to achieve compliance with the standard allows credit card firms to levy penalties, many organisations are postponing compliance out of a belief that it's a stick card issuers are reluctant to wield.

Seven out of 10 of those quizzed by NetIQ reckoned that the penalties for non-compliance would only occasionally be levied, while 23 per cent said that fines would "almost never" be issued. Many of the merchants are more worried about dishonest workers than external hackers or business partners.

Compliance with the PCI DSS standard involves self assessment in the case of smaller ecommerce firms, ranging up to annual audits for the largest firms. Achieving the PCI DSS standard can lead to lower merchant fees but doesn't necessarily mean every organisation that goes through the process is secure.

For example, US grocery chain Hannaford warned in March that an information security breach (later blamed on malware) had exposed an estimated 4.2 million credit card records. Hannaford had achieved PCI DSS compliance prior to the breach but the approval process failed to uncover the flaws that led to the breach. ®

Security for virtualized datacentres

More from The Register

next story
Phones 4u slips into administration after EE cuts ties with Brit mobe retailer
More than 5,500 jobs could be axed if rescue mission fails
Special pleading against mass surveillance won't help anyone
Protecting journalists alone won't protect their sources
Phones 4u website DIES as wounded mobe retailer struggles to stay above water
Founder blames 'ruthless network partners' for implosion
Apple's iPhone 6 first-day sales are MEANINGLESS, mutters analyst
Big weekend queues only represent fruity firm's supply
Radio hams can encrypt, in emergencies, says Ofcom
Consultation promises new spectrum and hints at relaxed licence conditions
Bill Gates, drugs and the internet: Top 10 Larry Ellison quotes
'I certainly never expected to become rich ... this is surreal'
Big Content Australia just blew a big hole in its credibility
AHEDA's research on average content prices did not expose methodology, so appears less than rigourous
EMC, HP blockbuster 'merger' shocker comes a cropper
Stand down, FTC... you can put your feet up for a bit
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.