advertisement
advertisement

Missed A Vulnerability Scan? The PCI Council Just Threw You A Lifeline

Written by Walter Conway
February 24th, 2010
The PCI Council may have thrown a compliance lifeline to retailers that are missing a required quarterly external vulnerability scan. This means you might—just might—be deemed PCI compliant even if through accident, poor planning or sheer blockheadedness you manage to screw things up and miss a vulnerability scan, pens PCI Columnist Walt Conway. Passing isn’t easy, and a successful result is not guaranteed. But if you do everything else right, your QSA may be able to assess you as compliant in spite of yourself. Then again, did the Council both offer an option and take it away?

During an onsite assessment, QSAs confirm that merchants have met PCI Requirement 11.2 by examining the passing vulnerability scans for each of the last four quarters. The problem is, what if the merchant has missed a scan? If this happens, is the merchant noncompliant until it can get four quarters of passing scans? Ouch.

This Story Is Only Available For Premium Subscribers. Click Or Login In Below To Read The Rest Of This Story.

Pages: 1 2

Posted in E-Commerce, In-Store, IT Strategy/Industry, Payment Systems, Premium Content, Security/Fraud
advertisement

Leave a Reply

Readers, specifically those who want to comment on a story:
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.

Weekly, Monthly Newsletters

Quickly catch-up on the latest in E-Commerce and Retail Tech with our free weekly report, with urgent bulletins as news merits—along with our monthlies on Mobile, Security, In-Store, E-Commerce and CRM.
advertisement

Most Recent Comments

"Is there really an improvement between a mag swipe and contactless tap if multi-factor authentication is required?" -Ed

Neiman Marcus Goes Down, But Only For A Special Few

Steven P
We insist our staff check all changes (how ever small) on all the popular browsers. Its something we'd recommend to everyone. Read more...

The Never-Ending Dance Of Contactless Security

ed
Contactless should require multi-factor authentication for financial transactions. However, multi-factor authentication will nullify the main benefit of contactless transactions which is speed. Is there really an improvement between a mag swipe and contactless tap if multi-factor authentication is required? Read more...

Home Depot's Try At Not Shutting Down Completely Leaves Customers Running In Circles

Bill N
This is SO Home Depot -- a lack of vigor resulting in rookie mistakes. I see it all the time in the stores. Read more...

MasterCard Pushing EMV PIN. Visa? Not So Much

James L.
When our company switched from AmEx to MC for business travel expenses, I thought we finally had the opportunity for chip/PIN & signature cards to facilitate the travel in Europe. "They're not available in the US yet", I was told by the bank representative who conducted the training on the new related expense reporting website. It was interesting to see that the chip card with mag stripe was available to my colleages in Canada. I thought the idea with chip & signature was to allow its use in both US & EU markets. One card - dual authorization methods. Read more...
Dan
I want Chip & PIN. With Chip & Signature, sure it has a an EMV chip, but then a fraudster could just steal my card, run it through the chip reader and then sign my name. The PIN adds an extra layer of security as only I (should) know it. At the very least, I would like to see a dual method wherein if the US insists on using Chip & Signature, our cards would work as Chip & PIN in countries where that is the norm. I am just sick of this back and forth. America needs to get off its high horse and comply with the world payment standards. Visa says Chip & Signature, MasterCard wants Chip & PIN and then Amex is mysteriously quiet. All of this talk....the government, banks, acquiring banks and card networks need to work together to make it affordable and easy to fast track EMV. Read more...

In The Security Vs. Compliance Battle Of The Mind, Security Is Winning

Andrew Jamieson
I think that this has the potential to provide a terrific win for the merchants in scope for these sorts of systems, and also to the security posture of payments as a whole - exactly because it should ensure that people who know what they are doing are the only ones involved in the details. Read more...

Guess CIO On iPad Trial: "This Is The Consumerization Of IT."

John Pruban
Because Apple provides little support at the enterprise level, it is interesting to watch the struggles as retailers implement. In Mike's case, he talks at great length about the augmentation of the customer experience. The biggest hole we see retailers struggle with here is basic wireless coverage. The experience goes bad quickly if, while your walking around, you get into the middle of a function and can't recover. Read more...

Brook
This phone is not "from Verizon". The operating system was written by Google. The hardware was manufactured by Samsung. The reason a person might buy such a device is to run Android software. Verizon is just the service provider that links the device to the telephone backbone and the Internet. Verizon has no right to tell users what software they can or cannot run on their devices. And "Google Wallet" or Verizon's (vaporware so far) competing product should be treated as just what they are: software. The users should be able to download and install their own choice. Read more...

Macy's In Australia: No, John, It's Not All Thanks To eBay

Ric
John Donahoe is so anxious to impress his Wall Street Masters that it comes as no surprise he exaggerated and got the facts wrong during the conference call. Read more...

In Theory, E-Commerce Sites Are Way Too Slow. But Do Customers Care?

Jason Goldberg
I love it when the data in vendor studies directly contradicts the conclusion, and thanks for calling it out. In the case of page load speed, while I am skeptical of the urban legends quantifying the effect of page load (1 conversion drop per 100ms, etc...), I have seen a number of first hand examples of improved performance directly improving bounce rate and conversion. So my own experience tells me that speed is an important factor in customer experience. I just don't believe it can be reduced to a simple equation. Read more...

Fortnum & Mason's PCI Weakness: Customer Service

Walt Conway
This is a great example of "customer service" trumping security. This situation also has me wondering if they also have a call recording system that captures and stores card data, too. Just for quality purposes, of course. It is disappointing that a leading retailer like Fortnum's would be so casually dismissive of their customers' security. Read more...

Wal-Mart's Stealth Social Strategy: Pretend This Isn't About Customers

Rajan
Very clever indeed. It is effectively 'crowd sourcing' product selection. Read more...
StorefrontBacktalk
Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.