Feeds

Merchants call credit card industry's bluff on compliance

PCI DSS off the agenda

Build a business case: developing custom apps

Nine in ten (88 per cent) European firms have failed to achieve compliance with a credit card industry standard for processing ecommerce transactions.

European merchants are behind their US counterparts in getting up to speed with the Payment Card Industry's Data Security Standard (PCI DSS), according to a survey by management tools firm NetIQ. The findings of the survey come less than two weeks before a 30 June deadline for compliance with a significant revision in the standard that adds web application security requirements.

PCI DSS was introduced by the major credit card companies as a means of encouraging merchants to engage in best practice security. The 12 point guidelines cover a basic set of requirements such as the need to keep systems up to date with patches and to encrypt cardholder data, for example.

A poll of 65 merchants across Europe by NetIQ revealed that two years after the standard was introduced the majority of firms are still way off being compliant. Worse, the majority (54 per cent) have no timetable for getting up to speed. Only 17 per cent of respondents reckoned that they would be compliant within six to twelve months.

By comparison, 23 per cent of respondents to a similar survey of 300 US organisation said they were already PCI DSS compliant. However more than two in five (44 per cent) of those quizzed had no idea when they would achieve compliance.

At first sight attaining PCI DSS compliance may seem easy enough but the path to getting a sign-off on the standard can be tricky in practice. Half of those working towards obtaining the PCI DSS seal of approval have been doing so for more than six months. Although failure to achieve compliance with the standard allows credit card firms to levy penalties, many organisations are postponing compliance out of a belief that it's a stick card issuers are reluctant to wield.

Seven out of 10 of those quizzed by NetIQ reckoned that the penalties for non-compliance would only occasionally be levied, while 23 per cent said that fines would "almost never" be issued. Many of the merchants are more worried about dishonest workers than external hackers or business partners.

Compliance with the PCI DSS standard involves self assessment in the case of smaller ecommerce firms, ranging up to annual audits for the largest firms. Achieving the PCI DSS standard can lead to lower merchant fees but doesn't necessarily mean every organisation that goes through the process is secure.

For example, US grocery chain Hannaford warned in March that an information security breach (later blamed on malware) had exposed an estimated 4.2 million credit card records. Hannaford had achieved PCI DSS compliance prior to the breach but the approval process failed to uncover the flaws that led to the breach. ®

Build a business case: developing custom apps

More from The Register

next story
6 Obvious Reasons Why Facebook Will Ban This Article (Thank God)
Clampdown on clickbait ... and El Reg is OK with this
Mozilla's 'Tiles' ads debut in new Firefox nightlies
You can try turning them off and on again
No, thank you. I will not code for the Caliphate
Some assignments, even the Bongster decline must
Kaspersky backpedals on 'done nothing wrong, nothing to fear' blather
Founder (and internet passport fan) now says privacy is precious
Banking apps: Handy, can grab all your money... and RIDDLED with coding flaws
Yep, that one place you'd hoped you wouldn't find 'em
TROLL SLAYER Google grabs $1.3 MEEELLION in patent counter-suit
Chocolate Factory hits back at firm for suing customers
Primetime precrime? Minority Report TV series 'being developed'
I have to know. I have to find out what happened to my life
Ex-IBM CEO John Akers dies at 79
An era disrupted by the advent of the PC
prev story

Whitepapers

Gartner critical capabilities for enterprise endpoint backup
Learn why inSync received the highest overall rating from Druva and is the top choice for the mobile workforce.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.