Regulatory compliance 'irrelevant' to security

PCI DSS credit card 12 commandments standard flawed


Companies who get hung up on regulatory compliance are developing a false sense of security which leaves them just as open to malware attacks the chief exec of tools vendor Protegrity has warned.

The Payment Card Industry Data Security Standard (PCI DSS) was developed by the major credit card companies as a means to bolster the security posture of organisations that process card payments.

The 12 point guidelines framed by PCI DSS are a basic list of "thou shalt" (or shalt not) commandments for network security covering the need to run a firewall, maintain up to date anti-virus software, encrypt cardholder data, and the like. A revision of the standard (version 1.1) covering web application security is due to come into force in June.

Protegrity chief exec Gordon Rapkin said compliance with the standard should only be viewed as a useful first step towards becoming secure. However, too many ecommerce outfits view it as a test that needs to be passed - in order to avoid higher merchant fees or fines that come with non-compliance - before lessons learned by going through the process can be forgotten.

"The regulation itself gets firms to do something. But after passing the tests it can create a false sense of confidence," Rapkin explained.

Compliance with the standard involves self assessment for small ecommerce outfits stepping up to annual audits for the largest firms. Self assessment can encourage respondents to tick boxes without having any idea what they have answered while security auditing, a less mature process than financial auditing according to Rapkin, can also have its problems.

US grocery chain Hannaford warned last month of an information security breach that exposed an estimated 4.2 million credit card records. The Hannaford breach was later blamed on a sophisticated malware attack. The grocery chain had achieved PCI DSS compliance, but the process failed to unearth the flaws that led to the breach. "Just because you are PCI compliant doesn't mean you are secure," Rapkin noted.

Protegrity makes tools to encrypt data, safeguard web applications, and manage and report on security policy. One aspect of security policy involves achieving compliance with regulations such as PCI DSS.

Rapkin is a supporter of PCI DSS in general. He reckons that its prescriptive approach is better at improving security than US health sector regulations on maintaining patient data confidentiality (covered by the HIPA Act), for example.

However, he is critical of aspects of how the regulations work in practice, particularly the assessment process. "Assessment is not uniform. Some firms shop for assessors who they know are going to pass them. Meanwhile, some less scrupulous accessors use the assessment process as an opportunity to sell clients remediation technology to achieve compliance," Rapkin told El Reg.

In addition, more could be done to make the process more transparent. For all its faults PCI DSS is better than nothing, according to Rapkin.

"PCI DSS is prescriptive, which is a good approach as far as it goes. It raise the bar on security - and has probably reduced fraud but it doesn't go far enough," he concluded. ®


Other stories you might like

  • Iceotope: No need to switch servers to swap air-cooled for liquid-cooled
    Standard datacenter kit just needs a few tweaks, like pulling off the fans

    Liquid cooling specialist Iceotope claims its latest system allows customers to easily convert existing air-cooled servers to use its liquid cooling with just a few minor modifications.

    Iceotope’s Ku:l Data Center chassis-level cooling technology has been developed in partnership with Intel and HPE, the company said, when it debuted the tech this week at HPE’s Discover 2022 conference in Las Vegas. The companies claim it delivers energy savings and a boost in performance.

    According to Iceotope, the sealed liquid-cooled chassis enclosure used with Ku:l Data Center allows users to convert off-the-shelf air-cooled servers to liquid-cooled systems with a few small modifications, such as removing the fans.

    Continue reading
  • Gartner predicts 9.5% drop in PC shipments
    Stark contrast to 11 percent increase year-over-year in 2021 shipments

    The party is over for PC makers as figures from Gartner suggest the market is on course for a breathtaking decline this year.

    According to the analysts, worldwide PC shipments will decline by 9.5 percent, with consumer demand leading the way – a 13.5 percent drop is forecast, far greater than business PC demand, which is expected to drop by 7.2 percent year on year.

    The PC market in the EMEA region is forecast to fare even worse, with a 14 percent decline on the cards for 2022. Gartner pointed the finger of blame at uncertainty caused by conflicts, price increases and simple unavailability of products. Lockdowns in China were also blamed for an impact in consumer demand.

    Continue reading
  • Samsung beats TSMC to be first to produce 3nm chips
    Lower power consumption, improved performance, and a second generation of the technology on the way

    Samsung has started production of chips using its 3nm fabrication process, beating rival TSMC, which expects to begin making chips with its N3 node generation later this year.

    The resultant chips are claimed to reduce power consumption by up to 45 percent and improve performance by up to 23 percent, with further gains promised in a second generation of the process.

    Korea's electronics giant said it has started initial production with its 3nm process node, which introduces what the firm calls Multi-Bridge-Channel FET (MBCFET) technology. This is Samsung's version of the Gate-All-Around (GAA) transistor architecture, where the gate material wraps around the conducting channel.

    Continue reading

Biting the hand that feeds IT © 1998–2022