 |
GuestView Column: Many QSAs Do Not Have The Background, Expertise To Assess PCI
Written by Joel Weise
April 15, 2008
Joel Weise is a Principal Engineer and Chief Technologist for the Sun Microsystems GSS Security Program Office. Prior to that, Joel was a security practitioner with Visa International where he established the original IT security department and worked in the R&D and Risk management departments.
Although there are many qualified security assessors (QSAs), a few who simply do not have the background and expertise in systems security manage to distort the original intent of PCI.
I often hear of QSAs that simply use PCI as a checklist, without thinking about an organization's overall security posture or architecture. For instance:
• Do you or do you not have an antivirus package?
• Do you or do you not have a firewall?
• Do you or do you not have unique user IDs?
Great. But a good QSA would ask not only if an antivirus package existed or if a firewall appliance was installed or if a unique user ID policy was followed, but also how these were designed, architected, implemented, configured and monitored. In addition, a good QSA would ask to what security policy must applicable operational procedures adhere and whether anyone looks at the alerts and logs generated by the antivirus or firewall products.
When these questions are not asked, a poor understanding of the intent of PCI is typically at issue. But is this the result of a lack of qualification on the part of the QSA? Or is this poor understanding of PCI just one component of a larger problem where the inherent ambiguities of PCI are reflected in assessments? Or, worse still, is it because a QSA can both assess an organization and function as a consultant—someone who is available to remedy flaws uncovered in an assessment (which can, perhaps, suggest ulterior motives)? I would say that many of the current problems with PCI are a result of all of these possibilities.
Given the questions that I hear regarding how a QSA should apply PCI, it is clear that some QSAs are simply not qualified to function as security assessors. This is problematic in and of itself, but when we add in the issue that a QSA can not only find fault with an organization's compliance with PCI but turn around and sell a solution to address out-of-compliance findings, it's not unreasonable to question that person's motives.
The obvious ambiguities we find in PCI complicate matters. But at the base of the problem are the associated struggles to address an organization's insistence that its solution satisfies PCI when a QSA will not accept that solution. Although the PCI Security Standards Council is chartered to evaluate these 'disputes,' what we often see is the council's deferral to the QSA.
For example, the FAQ on the PCI Security Standards Council Website (https://www.pcisecuritystandards.org/) lists the question, "What is meant by ‘adequate network segmentation' in the PCI DSS?" The response, "....the PCI Security Standards Council is not able to offer an opinion about how your organization can achieve adequate network segmentation since it requires an understanding of security features and controls implemented in your environment. We encourage you to contact a Qualified Security Assessor (QSA) to assist in scoping your cardholder data environment and recommend methods specific to your organization to help reduce the scope of your PCI DSS assessment...."
What if your QSA thinks that segmentation must be done via physical separation and you are using a virtualization technique? Who is the ultimate arbiter here?
The Key PCI Questions
Many people ask me, "How does PCI really work? Why does it appear as a simple checklist? How do I 'pass' a PCI assessment (or better, why didn't I pass my assessment)? Why is it such a hassle? What are compensating controls?"
All of these questions are quite understandable, given what PCI has morphed into and how the cottage industry that has grown up around it has interpreted PCI. To help you understand what PCI is and is not—right or wrong—here are some of my thoughts.
First off, some personal background, to give credence to my stance. I spent my formative years at Visa. It was great fun being on the bleeding edge and inventing new, innovative ways of greasing the skids of worldwide commerce. I still look back quite fondly on those days. I participated in the creation of many of Visa's internal and external security efforts, including erecting the first security office internally. I also participated in the development of technology such as SET, EMV and the Open Platform chipcards. One of my favorite activities was working on technology risk.
Among other reasons, PCI was originally developed as a response to some of the early attacks on e-commerce sites. Merchants often would rush to build their e-commerce sites without giving much thought to the security of those sites. As with many things in life, it sometimes takes a catastrophe to get people thinking about the issues and risks at hand.
When e-commerce sites started to experience external attacks from the Internet, it was recognized that credit card holders, banks (both acquirers and issuers) and Visa (and other brands) were at risk for basic fraud. But more importantly for Visa, such attacks had an adverse impact on the brand. Trust in the brand and in merchant-bank-interchange relationships is paramount. PCI was the card associations' response to this. It attempted to recommend best practices for securing sites.
The goal of PCI was to instill trust in e-commerce in general and in the brand and its merchant-bank-interchange relationships and capabilities that support e-commerce in particular, thereby enabling the reduction of risk and liability for the various participants (i.e., Visa, the banks and merchants). The issue of trust is critical to the success of e-commerce. It doesn't take many poorly designed e-commerce systems that could enable identity theft to turn people away from the Internet as a safe
and sane place to do business.
PCI is a living standard. It is intended to grow over time and be flexible enough to allow the use of new technology (e.g., virtualization). This means that a QSA should not disallow the use of new technology such as virtualization simply because there is no provision within PCI explicitly allowing its use. It also means that a good QSA keeps abreast of current technologies and keep an eye out for future possibilities and how they affect the security of both the data and the systems that data resides on. A better QSA expands upon such knowledge and seeks to understand how new technologies can be leveraged to better secure an infrastructure.
Its intent was to ensure organizations implement a comprehensive security architecture. In other words, PCI is not a checklist but rather a baseline against which one can evaluate their security posture or architecture. It is not a hard and fast list of mandatory elements dictated by the powers that be. The intent is to ensure that a holistic security effort exists and includes various security elements and constructs to limit the threats and risks to sensitive information and processing resources.
Being a QSA means understanding security architecture for what it is—an art form. QSAs must be capable of understanding how PCI can be implemented in an unlimited number of ways. This is not to say that any organization that states they have a security architecture, published security policies, a complete security awareness training program, and manages and monitors their systems will necessarily comply with PCI. But those that have a security program that exhibits such characteristics have a better chance of satisfying PCI.
Besides getting hassled about PCI in general, most questions I get involved compensating controls. According to version 1.1 of PCI, "Compensating controls may be considered for most PCI DSS requirements when an entity cannot meet a technical specification of a requirement, but has sufficiently mitigated the associated risk."
This statement really gets to the core of PCI. For example, if you do not have an anti-virus system enabled, what compensating controls do you have that will prevent the spread of a virus and more importantly, prevent the disclosure, destruction, or loss of integrity of some sensitive data element? Possibly you are using a hardened Unix OS that is not "commonly affected by viruses." The question here would be, "If I'm using a hardened Unix OS, do I even need compensating controls?"
So what is a compensating control? For better or worse, this is left up to the QSA to determine, And where does that leave the organization being assessed?
The good news here is that the intent of compensating controls is to allow an organization undergoing a PCI assessment to argue that the particular controls they implemented have "mitigated the associated risk." Thus a risk analysis indicating that the controls put in place do in fact reduce risk should be sufficient justification to allow those controls to be used, assuming that a QSA is convinced the reduction in risk is adequate.
One of my favorite is "Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters." Buried inside here is: "2.2.1. Implement only one primary function per server (for example, web servers, database servers, and DNS should be implemented on separate servers)."
Let's forget for a moment the issue of why a requirement for passwords and security parameters includes a process separation requirement. I have heard this interpreted by QSAs as meaning any and all functions related to credit card processing must be on physically separate servers.
Notice that PCI does not make any mention of physical separation. The original intent here was to ensure compartmentalization of risk by isolating sensitive data. That of course is a reasonable goal. A good QSA should have a solid understanding of security architecture separation techniques. And one of the most popular today is virtualization. Thus virtualization is a reasonable security separation technique and a good QSA should consider a properly architected and configured system using it to be in compliance. Yet, many QSAs do not understand virtualization and then reject its use out of hand.
Key Management
One of the more critical yet esoteric requirements of PCI covers key management. "Requirement 3: Protect stored cardholder data" includes 3.5's "Protect encryption keys used for encryption of cardholder data against both disclosure and misuse."
Unfortunately, this is yet another case of a laundry list of requirements. And of much greater concern for one being assessed, how many QSAs are actually qualified to evaluate cryptographic systems and operational key management processes?
Many people think that encryption of data is a general panacea for addressing all threats of confidential data disclosure. Encryption done properly will certainly help to address this, but often overlooked is the necessity for solid key management processes. A failure of key management will most likely nullify any benefits derived from using encryption.
Let's look at just a few of the key management requirements listed in PCI. 3.5.1 notes that access to keys must be "restricted" and 3.5.2 states that one must "store keys securely."
Does this mean access to a public key should be restricted? Since PCI discusses encryption in a generic sense, we will put aside the discussion of public key [asymmetric] crypto-systems vs secret key [symmetric] crypto-systems for another day.
How would one go about restricting access to keys? And then how does one test that the restriction methods are adequate? Should keys be store securely via physical means such as locked in a safe or via logical means or both?
Cleartext secret key components, for example, are often stored on paper, tokens or chipcards. Must all of these be physically secured? It is left to the QSA to make the critical value judgments needed to evaluate the methods used for restricting this access and determine their adequacy. |
|
 |
 
 
|
Evan Schuman is the former retail technology editor for eWEEK.com, PCMagazine, CIOInsight and retail reporter for RISNews and Consumer Goods Technology. Having covered IT issues for 21 years - and other stuff like legal affairs, politics, Wall Street and the environment for about eight years before that - Schuman is in a good position to gripe about technology trends and sometimes accidentally make a good point.
|
|
 |
 |
By this Halloween, the PCI Council will unveil the first major revision of the PCI DSS payment card security program in two years. But with the council not releasing any true details about the changes, nervous retailers are truly wondering "Trick or Treat?"
That which keeps consumers satisfied seems to be part of an E-Commerce site's culture, as top (and bottom) players tend to show little movement, year to year. The latest results from measurement firm ForeSee Results seem to reinforce that.
From his perch in the world of security, Guestview Columnist David Taylor sees delegation as a good thing. Some of the retailers with the best strategies have figured out how to "deputize" internal audit, HR, data owners and store managers and give them specific things to do, from employee education to access monitoring to policy enforcement.
It was April 2007 when a pair of cyberthieves from the Ukraine and Estonia set out to try and grab payment card data from the 49-store Dave & Buster's restaurant chain. But according to a federal indictment and U.S. Secret Service affidavit unsealed May 12, 2008, the pair quickly discovered that software can be an equal-opportunity crasher.
When TJX announced a MasterCard agreement last month to pay $24 million for data breach costs stemming from the industry's worst payment card data breach, it was contingent on at least 90 percent of the banks agreeing. No surprise, but TJX made that acceptance rate with room to spare, coming in at 99.5 percent.
NeoCatena Networks has in the wings a product designed to stop fraudulent or bad tag data from getting into the system from the supply chain.
Retailers focused on contactless payment might want to circle July 24, 2008, on their calendar. That is when the U.S. Federal Trade Commission will hold a hearing in Seattle "to explore the growth of contactless payment systems and the implications for consumer protection policy."
Guess this is what the cliche-afflicted would call a "sign of the times." Macys is killing the Bloomingdale's catalog while Amazon.com is selling copies of Bloomingdale's 1886 catalog for $12. (Can you imagine the number of out-of-stocks in that thing?)
For e-tailers who still think that Web video may be a fad, consider this stat: In March, U.S. Internet users watched 11.5 billion online videos. That's a 13 percent gain from the prior month and a 64 percent gain from the identical month the prior year, according to Comscore.
Thanks in no small part to soaring traffic on YouTube, Google for the first time took the top slot in American consumer reach in April, besting Yahoo. But it took that top slot just barely, reaching 141 million Americans in April. Yahoo ranked second with 140.6 million visitors.
California authorities have arrested two men in connection with another retail card-reader switch scam, an effort that police say brought in about $225,000 from 222 victims who swiped their debit cards at a regional grocery chain.
With the many new self-checkout offerings being introduced this week from the likes of IBM, NCR and Fujitsu, it's not a bad idea to focus on what will truly decide whether these machines do anything to help retailers.
With the nation's largest casino town as its backdrop, IBM and NCR gambled that the ho-hum growth in self-checkout can become a winner if the systems are moved away from the front-of-the-store checkout lanes and moved back toward the deli, bakery and even in the middle of the cereal aisle. All in all, I'd rather take my chances at rolling a 10 the hard way.
Trying to collect some innocuous-sounding information from self-checkout customers, a self-checkout system at a Maryland Home Depot instead accidentally got itself embroiled in a privacy controversy.
The Florida librarian and data breach victim who successfully took Wells-Fargo and Sprint Nextel to small claims court was paid this week, something that some data breach observers doubted would ever happen.
With its sites being unavailable for barely one hour over four months, MySpace has the best uptime of any major social networking site and Twitter (more than 37 hours of downtime during the same period) has the worst.
London-based Marks & Spencer is the RFID tag champ. Attaching 350 million a year to items of clothing, they even blow past Wal-Mart when it comes to tagging individual items. Unfortunately, each and every one of those tags might have used the wrong technology.
GuestView Columnist David Taylor this week discovered that there's a lot more than token opposition to tokenization. One of the concerns is that companies have already spent money on encryption.
Microsoft on Saturday (May 3) gave up its efforts to acquire Yahoo, declaring such an effort too expensive. "Despite our best efforts, including raising our bid by roughly $5 billion, Yahoo! has not moved toward accepting our offer," Microsoft CEO Steve Ballmer said in a letter to Yahoo CEO Jerry Yang.
Rite Aid on May 1 announced an extensive set of E-Commerce and POS changes to accommodate visually-impaired consumers, admittedly under an implied litigation threat from advocacy groups. The $24 billion 5,000-store pharmacy chain joins an expanding list of national retailers who have agreed to make such changes, including 7-Eleven, RadioShack, Safeway, Trader Joe's and Wal-Mart.
As retailers continue to experiment with mobile commerce, one potential problem is when mobile customers prove to be truly mobile. Let's say a national chain sends an E-mail blast to the cellphones of 10,000 Boston-area customers, inviting them to visit the store for a free sample on Wednesday.
Like it or not (place this father defiantly in the "not" category), children are using the Internet's social network sites at a younger age, with retail marketers hovering close by. How young? New stats show 17 percent of boys aged 10-12 used such sites last year, which is more than double the 8 percent who used social sites in 2006, according to the Harris Poll.
This wonderful piece comes courtesy of that time-honored daily newspaper tradition, the police blotter. A woman walks up to an ATM at a Hannaford's grocery store. She connects a laptop to the ATM until an alarm goes off, at which point she packs up and leaves.
With an eye on retailers having to juggle payment systems between many varied environments—far beyond merely online and in-store—a National Retail Federation division this week introduced a set of guidelines called the Retail Transaction Interface.
With a privacy invasion trial about to begin, Best Buy's IT department will be conducting more frequent remote audits of the chain's Geek Squad tech support department.
Microsoft is "leaning toward going hostile in its pursuit of Yahoo," with an announcement "likely" on May 2.
GuestView Columnist David Taylor this week suggests that, today, only a small minority of retailers says that they are getting much value from their security investments. Examples abound: Intrusion alerts that are ignored due to lack of staff, firewalls with rules that are out of date, intrusion detection systems that have not been tuned to minimize the false positives and encryption keys that are never changed. Fixing this stuff is not expensive, but it's not fun either.
Google says it has concocted a better way of searching for Web images, one that involves image-recognition to "see" what the image depicts as opposed to just reading the accompanying text. This technique, called Visual Rank, has tremendous potential to shake up E-Commerce, which heavily relies on product images.
Hannaford CIO Bill Homa, overseeing a data breach probe that exposed some 4.2 million payment cards, said this week that his grocery chain needs to go well beyond PCI to try and be secure, an effort he predicted would cost his department millions of dollars "but not tens of millions."
Pizza Hut is taking the "other people who bought also liked" approach mastered by Amazon.com and is trying to apply it to pizza and breadsticks and their own Web site. The service initially sounded like an ordinary Web upsell package, but a demo of the service suggested it might be more sophisticated than that.
The E-Commerce folk over at the National Retail Federation—Shop.org—are not so quietly putting out feelers for a new VP gig to pull in other e-tailers.
Wal-Mart executives this week promised Arkansas legislators that any product with a radio tag would be clearly labeled, as the retail giant tries to put the inventory-tracking devices on all products sold at Sam's Clubs by 2010.
A difficult to duplicate RFID chip? That's the claim of an RFID startup, which is using MEMs resonators to create a unique signal, or "voiceprint," which can't be cloned and can be used to authenticate the chip.
EBay's PayPal is following the path set by other alternative payment players and is starting to appear in physical stores. It's not a huge chain, but it's a start. Moosejaw Mountaineering and its seven stores will now accept PayPal and the chain is also starting to use in-store kiosks to display online customer reviews.
We've been seeing a bizarre trend this national recession. It seems to be hitting hard the companies that expected to be hit, the ones that cut back spending in anticipation of the downturn. Lo and behold, after cutting back on customer service and marketing programs, they see revenues fall. Did they correctly predict the sales drop or did they unintentionally cause the sales drop?
Starbucks on April 23 cut back its financial projections for the year, citing continuing declines in its store traffic, especially in California and Florida. This is announced just a few weeks after Starbucks said it would shake up its Web presence.
China POS shipments soared some 19 percent last year, figures that show China's retailers quickly becoming some of the biggest POS purchasers in the world, according to a new global POS report from consultancy IHL Group.
One of the most annoying parts of many a casual restaurant outing is at the end, when you just want to say "Check, please" and all wait staff seems to sense this and decide instead to join the Waitress Relocation Program. Microsoft has created a device that permanently sits on the table.
The National Retail Federation's Shop.org is lobbying the U.S. Federal Trade Commission to not flag consumers when their shopping behaviors are being tracked online, arguing that it would merely serve to frustrate those consumers.
In case there are two or three of you who are still skeptical about whether Web video will have an impact, consider these new figures. In February, U.S. Internet users viewed more than 10 billion online videos, which represents a 3 percent gain versus January (despite February being two days shorter) and a 66 percent gain versus February 2007, according to ComScore.
GuestView Columnist David Taylor this week questioned why PCI doesn't protect non-payment card information, such as Social Security numbers. Any security consultant will tell you that it's important to have a data classification scheme. Although it makes a nice spreadsheet, we have seen only a few leading-edge merchants and banks that actually attempt to enforce it and use it to drive access controls. Why? Taylor has concluded that it's for a single strategic reason: "Data classification is boring."
The PCI Security Standards Council on April 15 officially rolled out version 1.1 of the Payment Application Data Security Standard (PA-DSS). The specifics of the standard were spelled out last November and this is just the expected formal unveiling.
A DVD rental kiosk outfit has rolled out a kiosk that keeps track of orders and awards free videos for frequent shoppers. The idea of a kiosk that has a long-term memory and an active CRM component is a wonderful next step (OK, a baby step) for intelligent kiosks.
Blockbuster is trying to acquire Circuit City--a chain that is reporting twice its annual revenue--by offering a 50 percent per-share premium, Blockbuster announced early on April 14.
As of June 17, anyone in Australia buying from eBay online will be told: "PayPal" or "Forget It, Pal." With the exception of in-person pickups and cash-on-delivery, plus a handful of large-ticket items, sellers will be required to offer eBay-owned PayPal as a payment method by May 21, in anticipation of the June 17 ban on anything else.
A group of 109 McDonald's restaurants in the Salt Lake City region are doing a mobile commerce trial, with participating consumers getting free iced coffee. Although those 109 stores are barely one coffee bean's worth, given the $22.8 billion chain's 31,377-store network, the trial is interesting both for its capabilities and for how much data-control McDonald's was willing to give up.
When Best Buy removed annual fees from its bonus card, the company yielded about 10 times the number of shoppers opting to sign up for its rewards program.
The European Commission is cracking down on search engine data-retention, with a new proposed rule that search engines should delete personal data about their customers within six months.
E-Commerce is growing sharply—much more rapidly than in-store sales. It grew some 21 percent, to $175 billion last year, crediting E-Commerce with six percent of all retail sales, according to new figures from Forrester Research.
With reports out this week that Boeing's much-celebrated upcoming aircraft—the 787 Dreamliner—would be again delayed because of technology problems, some wondered if the delays involved 
ISPs have been quietly expanding their use of deep-packet inspection. They are capturing everything a user does—to the point where "at least 100,000 U.S. customers are tracked this way, and service providers have been testing it with as many as 10 percent of U.S. customers, according to tech companies involved in the data collection."
The Web world defies prediction—or does it? Conventional wisdom would have the new up-and-coming retailers faring better online, while the old-style bigbox merchants lag behind. And yet, Starbucks has had far more online troubles than it should have while Sears is soaring online.
Focusing on recent improvements in refrigeration technology, the 115-store Piggly Wiggly is pledging to radically revamp its store. The grocery chain is shaking up product positioning issues—all frozen foods are kept together, for example—that have been considered sacrosanct for decades.
Home Depot CIO/EVP Bob DeRodes has resigned and will leave the $77 billion home improvement chain "at the end of the year," according to a statement Home Depot issued Thursday. DeRodes will continue to run IT until he leaves, the statement said, as the chain starts a search for his replacement.
With the background of repeated recent payment data breaches coupled with wireless security concerns, the U.S. Patent and Trademark Office last issued a trademark for a cellphone payment that leverages current retail equipment, an instantly encrypted validation code and completely sidesteps wireless communications. Plus, it avoids the retailer having to store the credit card number at all.
Guest Columnist David Taylor is baffled by how often security safeguards are purchased, installed and then not meaningfully used. It's not uncommon for merchants to turn on security controls shortly before an audit, and turn them off afterward.
A series of restaurant chains—including Subway, Tully's and Brinker (Chili's, Macaroni Grill, On The Border, etc.)—have been experimenting with a way to use regular credit and debit cards as loyalty cards.
Amazon.com on Wednesday rolled out a new service called TextBuyIt, which allows consumers to comparison shop online working solely with fast text messages. But the move may not sit well with other retailers, who could see this making it easier to find better deals elsewhere, especially in bookstores.
There is this fairy tale belief that legal justice in civil lawsuits punishes those who act poorly, while protecting and vindicating those who consistently do the right thing. Nowhere is this myth more wrong—indeed, polar opposite wrong—than when dealing with security breach issues of U.S. retailers.
TJX will pay as much as $24 million to cover databreach losses suffered by MasterCard banks, assuming 90 percent of the banks agree to the settlement offer, TJX and MasterCard announced on Wednesday. TJX last year announced the world's worst payment data breach, which impacted some 100 million cards.
Although the coupon redemption rate has been steadily declining for at least 10 years, a new vendor survey suggests the recession may turn that around. Of the 1,529 U.S. consumers who responded, 67 percent said they are much more likely, or somewhat more likely, to use coupons during a recession, according to the survey performed by ICOM Information & Communications.
Bankrupt Pay By Touch—officially using the name Solidus Networks—has sold off two key units for a total of $4.8 million. Phoenix Check Cashing dropped $4.2 million to pick up Pay By Touch's check-cashing division, known as BioPay Paycheck Secure
Pushing a convenience/ease-of-use argument, payment processors have spent much of the last two years trying to get consumers to use different payment methods. But 2008 has thus far not been friendly to them. This week brings the news that American Express is halting its ExpressPay keyfob, some six years after the payment giant started offering it.
In the multi-year databreach at TJX—the worst in credit card history—the retail chain "created an unnecessary risk to personal information by storing it on, and transmitting it between and within, in-store and corporate networks in clear text," according to a complaint issued Thursday by the U.S. Federal Trade Commission.
The security exec then asked an annoyingly thought-provoking question: What do you think would happen if retailer were given perfect encryption? He painted a picture of retailers who would use their perfectly-protected data and would confidently let it ride atop the public Internet. At that point, paying for the private security tunnels of a Visa or MasterCard would no longer be essential.