The Two Scenarios Coming From The PWC PCI Report
Written by David TaylorIt's clear that Fortune 1000 merchants still enjoy their distaste for PCI DSS and their distrust of the process. And it’s fair to say that many merchants actually hate the PCI standards and their purveyors. Still, at last week’s meeting, the Standards Council and the card brands attempted to embrace their detractors via the oft-repeated “we want your feedback” refrain. The response? The merchants in attendance were generally well behaved in public (perhaps they fear reprisals), and there were no reported fistfights, as much fun as that would have been. And one of the reasons for this less-than-hostile response was the PWC report itself, which made it clear that the SSC (and, presumably, the card brands) were open to making some much-needed changes to the standards.
This Story Is Only Available For Premium Subscribers. Click Or Login In Below To Read The Rest Of This Story.
Pages: 1 2
2 Comments | Read The Two Scenarios Coming From The PWC PCI Report
Leave a Reply
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
-Christine
October 1st, 2009 at 9:16 am
I too attend the PWC presentation at the PCI Community meeting last week and found it to be a complete waste of time. The PCI Council has been pointing to this study and saying we should wait for the results until they would answer any questions related to scoping, tokenization and end-to-end encryption.
Well we waited for the study and in my opinion didn’t get any more information than we already had from reading the articles that have been posted over the last six months on these same topics. PWC just simply published the same data that other sources have been discussing for some time now.
A better question to ask is why does the PCI council even need PWC? If the PCI Council has a Technical Working Group (TWG) and a Chief Technology Officer (CTO) in Troy Leach shouldn’t these people be able to research these technologies and determine what the recommended solutions should be for merchants. Based on what I saw at the community meeting, neither Mr. Leach nor the TWG are technical enough to evaluate these technologies. So merchants continue to wait for guidance from an unqualified group of people as to how to protect their credit card data.
Organizations have tried to reach out to the PCI Council for answers but the emails we submit take two to three months for an answer and then we receive “talk to your QSA” as a response. We tried to ask questions at the community meeting but were told that “they could not comment on specifics”. This group simply does not have the technical knowledge or background to guide the PCI standard in the right direction!
October 1st, 2009 at 10:10 am
For the last 2 years, a consistent them at the community meetings has been the conflict between “the standard is too vague” and the “the standard is to explicit”. It’s a legacy problem with roots in the evolution of Information Security standards
In the Info Sec world, there is usually a policy hierarchy. The old ESF/ISF formula dictated a “Policy > Standard > Baseline > Procedure” approach. There was only one high-level Info Sec policy, accompanied by a few, slightly more detailed Standards (i.e “Data Classification Standard”. Baseline Controls defined the standard control set for a specific technology (i.e. UNIX baseline) and Procedures gave step by step instructions for implementing the baseline (think “Account Request” process).
The PCI DSS is indeed a standard. It is a high-level document, relatively static, that is more oriented towards “what” than “how”. Given the issuing body and the audience, it’s probably the best level form which to approach the issue. It leaves the freedom to develop the “baselines” and “procedures” in the hands of the implementers (where it belongs).
The PwC study is the first foray into “how” for the PCI SSC, and a response to member input into requests for greater detail in that area. It’s also quite probably as far as the Council will be willing to go in that direction. I suspect the council will pursue their historic course of action in this regard. These technologies will be treated like tokenization, with the implementation left up to the merchant and validation left up to the QSAs.
Specific, published guidance will likely be derived from PCI SSC Special Interest Groups (SIGs). The Wireless and Pre-Auth SIGs have been quite productive, and the Virtualization and Scoping SIGs are making progress. I would not be surprised to see SIGs spring up surrounding these study topics, with guidance forthcoming in 2010. But I’ve been wrong before……