MasterCard Vs. Visa: Dueling Compliance Philosophies
Written by David TaylorAugust 18th, 2009
People don’t seem to “get” MasterCard. For most of the last 4 years, MasterCard has been criticized for their apparent willingness to let Visa play the “bad guy” who issues fines to acquiring banks (and, through them, to merchants), who extends the PCI standards to application vendors (through PABP, now PA-DSS) and who generally takes the heat for PCI.
Now MasterCard is taking what can only be called a “get tough” policy, issuing larger fines and, most significantly, forcing both Level 1 and Level 2 merchants to use assessors rather than take on the task of self-assessment. But still, opines PCI Columnist David Taylor, merchants, banks, processors and service providers aren’t happy with MasterCard. They just can’t seem to get a break. After numerous conversations with companies on the receiving end of MasterCard’s “get tough” efforts, Taylor thinks it's all a difference of philosophy.
This Story Is Only Available For Premium Subscribers. Click Or Login In Below To Read The Rest Of This Story.
Already a Subscriber? Login Here
4 Comments | Read MasterCard Vs. Visa: Dueling Compliance Philosophies
Leave a Reply
Readers, specifically those who want to comment on a story:
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
-Christine
August 19th, 2009 at 10:25 am
Dave –
Thanks for another good article at StoreFrontBackTalk. Very interesting topic, but I do have a couple of points that I wanted to raise regarding internal vs. external PCI auditing.
(BTW – in full disclosure, as Dave knows, I work for a security consulting firm that also happens to be a QSA)
1) There is always the argument that a company is going to know their systems and processes better than some outsider coming in for a short period of time to perform an audit.
I’ll actually agree with this idea – any outside firm, unless they have a long history working with a client, does not have nearly the same familiarity and knowledge of a client’s environment as the client’s own team.
That’s one of the reasons why an outside review can be valuable – sometimes there needs to be a bit of separation in order to get a proper perspective, to make certain that assumptions are accurate, and to bring an outside viewpoint into the conversation. But this assumes a certain approach to PCI by the merchant in question… Which get’s me to my second point…
2) Any PCI program should be an extension (or subset) of your overall security program. At its heart it’s not just an audit procedure – it should be viewed within the context of your overall security program.
If a company is focusing on the bigger picture of overall security improvement and is actively assessing systems, finding vulnerabilities, closing gaps in security, updating policies, etc. then I don’t think having the internal audit team perform the PCI audit is necessarily a problem.
Where I do see difficulties is when merchants are looking to ‘just get the damn thing done’ and look at compliance as an exercise unto itself.
In that case, I think finding an outside firm that can provide both PCI auditing and broader security expertise is extremely important.
A good number of the ‘PCI’ clients that we work with actually don’t have us do the audits – we work with them on PCI ‘readiness’ which really means they are working to operationalize security and compliance in a broader sense.
Anyway – just my two cents…
Thanks again for another good article…
August 19th, 2009 at 11:40 am
HI, Alex,
Thanks for your feedback. I certainly agree that PCI needs to “fit” with the overall security program and that getting an external perspective / review of PCI, security, and its business as well as technical implications, is a great idea.
For me the most interesting part about this issue is the underlying assuption (the philosophy) that’s being made about what sources (and what process) creates the “best” assessment.
I appreciate the feedback.
thx, Dave
August 19th, 2009 at 4:46 pm
Re the “culture of security” (or culture of security awareness)– not sure why you find that a surprising term and approach. It has been around for quite some time. Most of us in security strive for such a situation, where our users, developers, management, etc, have an appreciation of security / governance so that they will keep these things in mind when developing new projects, services, etc. It’s a place where security is security et al is built into processes, not slapped on later at great expense and resistance; we want our user community to appreciate the value of security and its role in contributing to the success of business initiatives.
As I tell my colleagues and business users, my job is to help ensure no one tampers with or interferes with their applications, and be part of our competitive advantage by ensuring our applications and services are up and running while our competitors are “off the air” because they are busy dealing with the latest security threats.
As to MasterCard, they seem to be devolving PCI DSS into the SOX free-for-all and money grab. They remind me of power-obsessed grade school teachers who rather than deal with an unruly student, seem to think punishing the whole class will solve the problem.
August 19th, 2009 at 5:05 pm
re: my “culture of security” comment. I suspect sometimes that my sense of humor is lost in my columns. I use quote marks to set off things, but that doesn’t do the trick sometimes. I was trying to get a joke out of “culture” vs “cult” – i am familiar with the term.
Dave T.