Could you please validate the use of tokenization in the wallet’s payment scheme? I’m looking at the wallet API and there is no mention of tokenization, only OAUTH identity tokens.

-Adrian

@Christine: That is an interesting point about employee poaching. I wonder, though, if it isn’t any worse that we have today with listing QSA and ASV employees, or even all the other online social/professional media sites. Wouldn’t it be great — especially for retailers — if we ended up launching a race to the TOP instead of the other way around!?!

Again, thanks for the thoughtful comments (and the emails, too, from the rest of you).

Walt

I have an ops mentality but have worked directly or indirectly in IT for over 30 years. I think, naturally, young people and/or go-getter personality types are, by nature, “operations” types. However, as responsibility, experience, and maturity increases, people who may even be naturally “ops-oriented” can and should make the transition to an “IT” mentality like that you describe above.

My boss is, by background, an “operations” person who never had a strong technical background or interest. Very smart, and capable when focused, but not that turned on by learning the intricacies of “how stuff works.” In other words, despite over 20 years in the “IT” industry, still fixing tractors in the field.

As a person who, by training, natural interest, and experience, has transitioned from “ops” to IT, especially given my responsibilities for preventing the failure of deployed IT systems, I continually butt heads with my “ops” boss. It has negatively impacted my health, my demeanor, my sense of satisfaction with my career field. This insightful post provided a glimpse of understanding into why, in a small org with no “IT” mentalities, I was increasingly ostracized for recommending caution, greater examination of risks, and “go slow” approaches to deploying systems on the Internet that had not been sufficiently tested (i.e., not at all with regard to security).

PCI DSS, although at first seen as an unnecessary burden even by myself, has forced the “ops” people in charge at too many organizations deploying web-based tools and services into the light of day. Sadly, I think far too many decision-makers, both business and “IT”, lean towards “ops” rather than reasonable approaches to risks and rewards. Those that can and have read and recommended fixes to get in compliance with PCI DSS likely find themselves ridiculed, demeaned, and ostracized as the self-congratulatory “ops” people charge forward with “innovation” and highly visible new services.

Thanks for writing this article. Helped put a logical framework for seeing the dynamics that I, and probably many others, are caught in the middle of.

A startup supplier or product manufacturer no longer need to meet Wal-Mart strict specifications and minimum order requirement to stock products for sale in-store. They can now market throught Wal-Mart.com to a bigger crowd that can also pay with cash and use Wal-Mart expansive logistic system to deliver just-in-time.

Kat: I guess timing is everything!

Nathan: Actually, the QIR program has a lot to do with the DSS (or PCI). Since merchants rely on their reseller or integrator to implement their PA-DSS validated application, these resellers and system integrators play a critical role in merchants achieving and maintaining PCI compliance. As far as I can tell, the QIR program is designed to help merchants stay compliant by making sure their payment applications are installed according to the PA-DSS Implementation Guide, for example ensuring default passwords are changed (and protected), that the data encryption keys are properly set and secured, that the merchant’s data retention policy is set, that no sensitive cardholder data are stored, and often that a firewall is in place and properly configured.

Right now, a good reseller or integrator will make sure the payment application is installed and maintained securely. However if your reseller or integrator does things like install the wrong version, fail to implement security patches, use the same password for all their customers, or retain sensitive cardholder data, then the merchant is vulnerable to a damaging security breach that could potentially put them out of business. BTW, if you don’t believe this can and has happened, see here: http://storefrontbacktalk.com/securityfraud/retailers-suing-card-processor-questions-raised-as-to-where-pci-duties-stop/ or here: http://storefrontbacktalk.com/securityfraud/when-it-comes-to-pci-compliance-
franchisors-are-screwed/ .

As I said in the column, as a QSA I am a big fan of the QIR program. It is not a panacea for merchants, nor is it a silver bullet. But it can be one step to helping small and medium sized businesses (including franchisees) continue to stay in business and operate in a secure manner. And after all, that is really the purpose behind PCI.

Walt

Great article. This exact issue has been bothering me for years, and I was JUST talking about it with someone only yesterday. This may well be my favorite article from you, mostly because I’m biased and have hated this particular problem forever. Keep up the good writing, kind sir, and keep those insights coming.

-KJ Valentine

In fact, many car manufacturers will orchestrate ‘recalls’ as a measure for getting people to attend at their local dealership to complete the recall work, and anything else that can be suggested or done at the time. (We all have minor maintenance matters that need to be done but are not important enough to create a priority)

The recall notice turns everything into a priority. (We don’t want the flux capacitator to blow up and catch fire!)

Of course, prima facie, a recall notice may suggest that the manufacturer’s workman ship was shoddy, or it’s product inferior, however most people actually perceive a recall notice as the company putting customers ahead of profits.

Turning a positive into a negative should be every marketers goal.

Privacy will be an issue forever but my guess is that the power of relevance will overwhelm consumer concerns about privacy. After all, that’s what Facebook is all about.

Sounds to me like hackers overseas are calling in these prepaid account phone banks with random prepaid credit card numbers (they likely don’t need to know the number) and can tell once it has been open. Once they can validate a prepaid card number was open, they can start spending in less than 30 minutes. The fast turnaround time indicates this may be an automated dialing script run on multiple computers worldwide.

This has widespread security implications throughout the whole prepaid industry as many low-income people and expats are putting their cash into these prepaid cards for remittance purpose as well as spending.

Texas, Florida, California, and many others have escheatment laws. Now if you really want to get confused and have a craving for bureaucratic red tape, analyze California where they have escheatment laws requiring funds to go to the state within a certain timeframe but also require never-expiring gift cards that merchants must honor forever — all with no fees (assuming certain amount thresholds and other stipulations).