Security Means Something Different To A Targeted Retailer
Written by David TaylorFebruary 11th, 2009
The Heartland and RBS WorldPay breaches should serve to remind us that some types of organizations are real "targets" for bad folks. Banks (and bank robbers) figured this out a while ago.
But GuestView PCI Columnist David Taylor says that the rules can be different for "targets" and "non-targets." And he clues us in on what those differences are.
This Story Is Only Available For Premium Subscribers. Click Or Login In Below To Read The Rest Of This Story.
Already a Subscriber? Login Here
One Comment | Read Security Means Something Different To A Targeted Retailer
Leave a Reply
Readers, specifically those who want to comment on a story:
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
-Christine
February 12th, 2009 at 1:25 am
I agree completely that good key management is critical to long-term success, but it is both hard and expensive. The problem some organizations find themselves in now is that PCI caused them to rush to protect data across the enterprise, and in that rush they bypassed coordination efforts. They are now stuck with an ad hoc collection of keys and no centralized key managers.
Retrofitting a key management infrastructure on top of an existing deployment of hundreds of keys is also a challenge. On the plus side, the keys created should all have been well documented in accordance with PCI standards, so it shouldn’t be a nightmare to hunt them down.
As far as best practices go, a good starting place is the creation of a data security standard. An organization needs to lay out clear principles regarding security. They need to identify the data to be protected, roles that must be filled, separation of duties, types of keys, key life cycles, approved tools, protocols and algorithms, etc. They should also institute a security review process with a qualified party (a reputable PCI auditor or security firm should be able to provide this service.)
Unfortunately, such things do not simply come in a download off the internet or from a lecturer’s notes, they require creating and fostering an ongoing commitment to data security. Having a stable of qualified security professionals to create this movement is almost impossible for any but the largest of organizations, so these efforts usually require outside help to get them jump-started.
Sadly, an organization trying to “skimp” on PCI is equally likely to not see the value of the creation of a data security team. Yet these same organizations will spend money on cameras, anti-theft devices, and trained investigators, because they understand the value of physical security. It’s a curious gap.