Chip-And-PIN Is Not A Free Pass On PCI
Written by Walter ConwayFebruary 18th, 2010
Reports of the latest successful attack on chip cards based on the EMV standard should remind all of us once again that there is no such thing as absolute security. Retailers and consumers worldwide--especially those in Canada who are currently implementing chip-and-PIN--need to understand this fact and not count on any single technology to remain secure. That is why PCI remains relevant even in a chip-and-PIN environment.
From a security perspective, PCI Columnist Walt Conway pens, retail CIOs should understand a few things about these chip cards or smart cards (i.e., payment cards with an embedded integrated circuit or microchip). Chip cards can reduce fraud losses, but chip-and-PIN zealots can overstate the benefits.
This Story Is Only Available For Premium Subscribers. Click Or Login In Below To Read The Rest Of This Story.
Already a Subscriber? Login Here
Pages: 1 2
2 Comments | Read Chip-And-PIN Is Not A Free Pass On PCI
Leave a Reply
Readers, specifically those who want to comment on a story:
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
-Christine
February 18th, 2010 at 1:24 pm
I don’t understand where the false assumption that EMV addresses security comes from? (well, I do understand, but I’ll keep my mouth shut) EMV attempts to address fraudulent card usage, not security. To me EMV and the Magnasafe technology that Magtek developed (swipe fingerprint) address the same thing in different was, but Magtek never promoted their technology as a security protocol.
October 4th, 2010 at 7:25 am
More mis-direction: it just does not follow that because EMV does not solve ALL fraud problems, that PCI remains relevant.
We hear lots of talk about chip and PIN zealots supporting what appears to be a near useless enhancement on the magstripe card. Truth is that chip and PIN displaces some fraud as the crims move into other areas – any security geezers worth their titles know this, so why is such an issue? It was expected and it can be addressed. Bottom line is that you can’t copy a card!!!!!!!
You can implement all the PCI ludite nonsense you like, the problem is not going to go away – because you may or may not have noticed, but the card data is still there on the card, and I can still copy it, and then use it. Which part of the PCI standard is going to EVER address that one? You’ll be telling us we need QSAs for crims next …
Also, if you understand EMV you’ll know that whilst the Prof’s scam does work, it isn’t particularly useful, because he still needs the physical card (because it won’t work with a copy), and the issuers can spot it.
Bottom line is that card data is not inherently sensitive – this is certainly the case in EMV-land. In magstripe-land, the story is different, and you choose to transact with stoneage technology. Fine by me – if you want to “secure” it with PCI, off you go; just don’t expect us to do it as well.
Last bit isn’t worth much comment – fallback to signature will result in a decline, unless there is a valid technical reason. More mis-direction. It’s got to stop!