PCI Safe Harbor? In Your Dreams, Breach Boy
Written by Evan SchumanMarch 28th, 2008
If there's one thing that can be said about CFOs, they love their absolutes. They love absolute assurances that if they do X-and-Y, they'll be protected against Z.
They like to buy liability insurance, buying into the line that shareholder assets will then be safe no matter what that boneheaded new Operations VP does in a year. They like Poison Pill plans, believing their lawyers that it will prevent them from ever being taken over. And, most recently, they are simply ga-ga for those who say that a PCI compliance letter means they are in a magical safe harbor, where they can do anything with their security that they want and be utterly immune from liability.
This Story Is Only Available For Premium Subscribers. Click Or Login In Below To Read The Rest Of This Story.
Already a Subscriber? Login Here
2 Comments | Read PCI Safe Harbor? In Your Dreams, Breach Boy
Leave a Reply
Readers, specifically those who want to comment on a story:
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
-Christine
March 28th, 2008 at 11:13 am
I believe Visa provides a merchant “safe harbor” if they are compliant at the time of the breach and the merchant’s compliance was validated before the breach. The important thing is the “at the time of the breach” part. One quote that stuck with me from the PCI Community meeting in Toronto was “you are only one system change from being non-compliant.”
You point out that one-time compliance does not guarantee safe harbor. I’d expand that to include: validation does not guarantee compliance, and compliance does not guarantee security. There is no such thing as 100% security…so much for “Breach Boy” easy answers to complicated questions…
March 28th, 2008 at 6:03 pm
While “validation does not guarantee compliance, and compliance does not guarantee security,” the opposite is true:
breach = !secure = !compliant = $fine