 |
 |
|
|
 |
New QA Review Toughens PCI Assessors
Written by David Taylor
October 15, 2008
Guest Columnist David Taylor is the Founder of the PCI Knowledge Base, Research Director of the PCI Alliance and a former E-Commerce and Security analyst with Gartner.
I wrote in last week's column that there are changes in the PCI 1.2 standard that should increase the focus on risk assessment as part of an effort to be responsive to concerns about the perceived "checklist mentality" of the PCI standards. But in the last week I've been given an "earful" from merchants I've spoken with that the PCI SSC's new Quality Assurance process is actually having the opposite effect.
Specifically, we are hearing that assessors, fearful of having their work more closely reviewed, are being very "letter of the law" when doing their assessments. There are several specific areas of security where this is affecting merchants, so we'll offer advice about how best to address each of these problems, to avoid bloodshed between merchants and their assessors.
Wireless Networking
There is additional clarification in PCI 1.2 on this topic, and Wireless IDS/IPS is mentioned specifically, which is the only technology to be named for the first time with the 1.2 version.
Because of the TJX security breach and general concerns about "war driving," assessors are being extra careful when doing wireless security reviews. In addition to doing scans at headquarters, they are doing more scans at the stores, as well.
More importantly, it seems that some assessors are also insisting on quarterly wireless scans of all facilities with wireless networks, which is a very comprehensive interpretation of the testing procedure for requirement 11.1a.
As a response to this, we'd recommend using a wireless IDS/IPS. Now that they're named in the standard, the purchase of such a tool could have a "halo effect" by producing comprehensive reports that the assessor can use to document his/her review for the QA review. They also have a better ROI when the cost of doing in-store wireless scans is taken into consideration.
Store Visits
As we noted last week, PCI 1.2 includes additional focus on sampling facilities outside headquarters. In the past, most assessors did few if any store visits. They focused on the IT infrastructure documentation.
As long as the merchant could show that store IT configurations were standardized and the proper networking, access control and encryption controls were in place, the need for (or number of) store visits was subject to negotiation.
With the new QA process and specific mention of sampling non-HQ facilities, there seems to be less flexibility on this topic. One possible response to this is for the merchant's PCI manager (or team) to assemble all of the store security documentation into a neat package for the assessor, requirement by requirement.
Focus on providing the assessor with what he/she needs for a QA review. Another possible response is to carefully "orchestrate" the store visits by doing significant preparation with store operations and regional managers to select "representative" stores where local management understands security and is "sympathetic" to the cause of security. Either way, documentation is the key to reducing the cost and impact of additional focus on stores.
Software Development
Merchants who do not use a rigorous, standardized software development process (or who haven't documented or don't enforce the one they have, which is more likely) are learning that between PCI 1.2 and the new QA process, they are being told to make changes to their SDLC methods and procedures.
This is particularly true for Web applications development and any applications that involve card data. But because no one uses a separate SDLC for certain applications, essentially your whole software development methodology comes under review. One of the most important responses is to be able to prove that code involving confidential data (or all code) is under change control and that access to (and encryption of) card data in development/test is functioning properly.
Closer scrutiny of "power users" is likely, as is conformance to the current version of the OWASP development guidelines. Documentation that these controls and techniques are followed is the key to making this review go more smoothly.
QSAs vs. Internal Audit
In PCI 1.2, the role of the Internal Audit team is mentioned for the first time. If the QA process and the prospect of an even more strict interpretation of the PCI standards is causing concern, then it may be time to go for the Internal Audit option, even if you're a Level 1 merchant.
If you have an IT-savvy Internal Auditor, it may be more cost-effective to send that person to a 2-day class on PCI assessment and "bring your assessment in house." You will need to prove that this person is independent from the IT organization he or she assessing, but that is what having Internal Audit is all about anyway.
It's important to understand that this option may not make PCI "easier." It will give your company additional control of the process. But because Internal Auditors tend to "know where the bodies are buried," their review may be even more rigorous than that of a QSA.
There are, of course, political implications to controlling this process and it's reasonable to believe that the PCI Council's QA process will be expecting Internal Audit teams to be "easy graders" and will test for this prospect. Nonetheless, for those Level 1 merchants staffed to handle this (and most should be) bringing assessment in house could increase the awareness, control and predictability of a process that has been problematic, at best, for many larger merchants.
If you have a question about PCI 1.2, you can ask the PCI Knowledge Base panel of more than 75 PCI experts in our discussion forums. Also, if you're a retailer, we want to get you involved in the PCI Best Practices study we're doing with the National Retail Federation. It's 100 percent anonymous. Just send us an E-mail at David.Taylor@KnowPCI.com. |
|
 |
 
|
Evan Schuman is the former retail technology editor for eWEEK.com, PCMagazine, CIOInsight and retail reporter for RISNews and Consumer Goods Technology. Having covered IT issues for 21 years - and other stuff like legal affairs, politics, Wall Street and the environment for about eight years before that - Schuman is in a good position to gripe about technology trends and sometimes accidentally make a good point.
|
|
|
Sears.com Melts Down On Black Friday, But Costco, Walmart, Saks and Kmart Have Issues, Too
 Sears.com suffered the worst Web problems on Black Friday (Nov. 28), experiencing a series of complete site crashes for much of the day. Although no other major retailer came close, according to preliminary reports, many of the industry's largest merchants suffered site slowdowns or other Web problems, including Walmart, Kmart, Saks, Overstock, Amazon, Target, Kohl's, Costco and Buy.com.
|
|
|
 |
 |
|
Questions dominate a Dec. 20 incident where some 8,000 Macy's customers had their debit cards charged as many as three times for the same transaction. One source said it involved a payment processor's slowdown.
A financial report on the troubles found last year with major department stores places the blame for the revenue drop not on the economy, but on chains that are "increasingly out of touch. The problem is that these stores have relied too heavily on the things shoppers care least about, like coupons, loyalty programs, delayed payments and contests."
Some of the latest stats pouring in from the 2008 holiday shopping season are raising some interesting trends, including a sharp (not-before-seen) increase in traffic right after Dec. 25 along with a much deeper cut in site visits from those earning more than $150,000/year.
Amazon.com issued a statement on Thursday (Dec. 30) giving its customers fewer than 12 hours' hours notice that it was cutting off Bill Me Later as a payment option as of Dec. 31. The highly anticipated move was a result of Ebay's purchase of Bill Me Later in October.
E-Commerce holiday purchases this year dropped 3 percent from the corresponding period last year, hitting $25.5 billion, according to ComScore.
Allowing customers of Gap.com to easily jump to other Web sites in the Gap family, and put all their selections in one shopping cart, undermined perception of the brand and eroded user satisfaction, said the president of a company that tracks E-tail site satisfaction.
For years, Google has given its Google Checkout service to retailers for free, as long as they bought ads on Google. Alas, no more. Explained one Google manager: "Why have it as a loss leader if it's doing OK? We saw very healthy results after we decided to charge for the service."
Amidst the avalanche of downright depressing retail economic news this holiday season, there are recurring hints that E-tailers—as a group—fared far better. But because we're starving for any sign of optimism, are we interpreting those signs unrealistically?
As retailers debate how much they truly want to embrace mobile payment efforts, the Mercator Advisory Group is reporting that the tide will soon become unavoidable.
Extensive analysis of a consumer's Web interactions has been used for years to try and target sales pitches more effectively. But new research suggests that such analysis may pale in comparison to the next wave, where every digital comment made by consumers anywhere—in a product comment, an IM, on a social network site, in E-mail and via exchanges with a live chat tech support person, coupled with Web traffic analysis—can be mined for hints as to their emotions and other thoughts.
Tracking global retail from the United States, it's clear that Canada is the country most similar to the United States when it comes to retail procedures. Surprisingly, the next closest region is not the United Kingdom but Australia, and then arguably South Africa. So it's always interesting to see the few technology areas where American and Australian retailers diverge, and EPC is shaping up to be one of them.
Kraft Foods, Nestle and Procter & Gamble are now able to synchronize item data with Metro Group stores in Russia, a collaborative effort being touted by the players as a "landmark" deal that illustrates the rapid expansion of the Global Data Synchronization Network (GDSN). Not all are convinced, though.
The story of the technologist who crafted an elaborate RFID poker table, complete with an HD camera to stream real-time games globally, is interesting mostly in how he attached ultra-thin and extra-flexible RFID tags to each playing card in such a way as to make it not interfere with the way the cards felt. But does it have implications for the future of retail?
'Tis the season to be jolly. Unless you're in charge of uptime at upscale retailer J,Crew's Web site. Having suffered outages during Cyber Monday, J.Crew again became unavailable—to at least some prospective customers—for an extended period Wednesday (Dec. 17).
Despite the putrid economy and the tightening of holiday shopping lists globally, the number of site visits logged in at comparison shopping sites has gone down sharply, some 15 percent lower than was recorded during last year's identical period, according to Hitwise. More logically, Hitwise found an even larger increase—25 percent—in the number of visits to Web coupon sites this year.
In a sharply down economy, retail IT budgets are going to go on a roller coaster ride in the need for greater efficiency. And given how small a percentage of corporate spending is typically represented by the IT capital expenditure budget, IT will probably feel less of the pain than many other divisions. But...
One of every three customers walking into an Office Max store to buy a consumer electronics product left empty-handed (and probably bitter) this year because the product was unavailable, according to new research by IHL Group. But Office Max certainly wasn't alone in the research company's hall of shame, with Office Depot and Circuit City keeping it company.
On the one hand, many clicks on a retailer Web site indicate user engagement. And that's a good thing, unless cumbersome site design is forcing users to click unnecessarily. In its recent audit of Cyber Monday shopper activity, site-monitoring company ClickStream Technologies found that too many clicks during the checkout process prompt frustrated buyers to wriggle from the hook.
Online retailers are relying too little on automation to thwart online fraud, meaning too many employee hours are spent reviewing orders that shouldn't have raised any flags of suspicion.
Gift card exchange site Leverage, which had pushed one of the more creative CRM ideas out there, has laid off its entire workforce and is hoping economic fortunes will improve next year, according to company CEO/Co-Founder Mark Edward Roberts.
Around this time of year, GuestView Columnist David Taylor starts to wax nostalgic about the good old days at Gartner when he used to make grand announcements about his vision for the future of technology.
Amazon.com this week jumped in with a clever gift card strategy that bordered on brilliant, a tactic that could simultaneously boost revenue and steal sales from multiple competitors. So with such a wonderful plan, what would possess Amazon to put a statement that, at the most charitable, could be described as a phrasing so deceptive that even a New Jersey or Illinois politician would find it too over the top?
Amazon is far from alone this holiday season is pushing some new mobile efforts, standing alongside Walmart, Target, Gap and Sears in the popular holiday "let's fling random things at the cellular tower and see what sticks" game.
As the hoopla surrounding Black Friday and Cyber Monday mercifully subsided, some e-tailers were still struggling to keep their sites up, with Office Depot and Sephora suffering repeated outages while Walmart and Office Max—among others—experienced more sporadic mishaps.
The early holiday shopping season found fewer consumers hitting U.K. retail Web sites compared with last year's identical period, with some major sites seeing double-digit declines, according to Comscore.
Payments for taxis, parking and movies may prove less patient in waiting for new technologies than E-Commerce, a move that could be a bad sign for once-promising mobile payment method Near Field Communication (NFC).
Dollar General, the $10 billion discount retail chain, on Wednesday (Dec. 10) agreed to install specially-designed POS units intended to safeguard the privacy of visually-impaired consumers in all of its 8,300 stores in the U.S. "in less than eighteen months." The intent is to give those shoppers an alternative to touchscreen interfaces by offering tactile keys.
The economy sucks so GuestView Columnist David Taylor suggests that this would be an ideal time to shift budget away from regulatory compliance and spend it on something that will actually make money for your company, like direct mail advertising. No, he doesn't actually believe that, but he has the feeling that some executives are on the defensive when it comes to maintaining a focus on their areas during these dark times.
E-Commerce avatars—computer-generated 3-D replicas of consumers with precise measurements to help purchase clothes that fit better—may soon use digital video to incorporate a consumer's posture, facial expressions and smile.
Best Buy Chief Technologist Bob Anderson has been talking lately about the value of lending an ear to young innovators in the company. "You don't need a big, honking server and lots of funding or 50 people to start something innovative."
One columnist writes about the stampede death of a Wal-Mart assoiciate in New York when he was opening the doors for Black Friday shoppers. "No doubt," he wrote, "they were the same shoppers who complained bitterly about the ‘appalling lack of help' in the store." Indeed.
A service level agreement (SLA) is a guarantee from a site that its uptime will be as promised, n'est pas? Actually, quite the opposite. It's more likely a complicated document designed to protect the site (not the retailer) in case of any problem.
Walmart.com is saying that they want to clarify that position, but then E-mailed a statement that, well, doesn't clarify much of anything. But it does do a nice job of hinting at something without actually saying it.
Whether the wing flapping of a bug can eventually cause a tornado is debatable, but Cyber Monday 2008 should serve as a warning to E-tailers to avoid the lesson learned by Staples and Dell on Monday (Dec. 1): Don't ignore the butterfly effect.
At about 6 AM New York time on Black Friday (Nov. 28), Wal-Mart's site went down for about an hour and then came back up. But this time, the company had moved its content pages to an outside service. Wal-Mart said this was a scheduled change, a concept that Gareth Evans, head of client services at Web tracking firm Sitemorse, finds unlikely.
Microsoft's Live Search cashback program—which gives rebates to those who comparison shop online and choose stores that are part of the program—was a bit too popular on Black Friday (Nov. 28) and crashed for several hours, leaving consumers with no cashback and a lot of anger.
In a trial initially limited to the United Kingdom, Switzerland, Israel and Italy, Visa Europe is starting a trial this month of a card with an 8-digit alphanumeric display, 12-button keyboard and a long-life battery. The card has the ability to offer reciprocal authentication, which is designed to allow consumers "making transactions via phone or the Web a way to identify the party on the other end before transmitting identifying credentials."
Black Friday (Nov. 28) E-Commerce sales hit $534 million, reflecting a one percent increase from last year's Black Friday, ComScore reported Sunday (Nov. 30).
A group of credit card thieves in Seattle tried to maximize their profits by using their stolen credit card data to open a loyalty card account with Best Buy, where they could get could extra benefits along with their stolen products, according to a federal indictment filed Nov. 19. One had tried a similar rewards scam with a Home Depot reward card and a Sears gift card.
Recently released numbers raise questions as to whether online will be much of a savior at all. New figures from eMarketer project that E-Commerce sales will top last year's numbers by some $5.6 billion, a 4.1 percent increase from $136.8 billion to $142.4 billion.
Eduardo Perez of Visa has called its fines for non-compliance "nuisance" fines. In other words, the fines are not large enough to be a big financial burden to retailers but are large enough to get the CFO pissed off about having to pay them and maybe large enough to get a CEO to at least show up for a meeting to discuss PCI.
The IT struggle with knowing where all payment data is—let alone trying to enforce rules that pretty much try and keep it there—was the topic of a StorefrontBacktalk a podcast this week with our own PCI columnist, David Taylor, and security specialist J.D. Oder, the chief technology officer at Shift4.
Wal-Mart has agreed to pay $1.4 million to settle complaints that it overcharged customers in California. The Nov. 24 deal involved the mispricing of some 1,043 items over four years. Some of the problems happened because associates would make pricing changes to items in the store's register database but not in the aisle.
There's an E-mail campaign that says consumers can identify American products by the first three digits of the barcode. In theory, this would allow people who only want to buy American products an easy way to do that. The only problem is that the trick doesn't always work, which means it could have the opposite effect.
When are related product lists helpful and when are they distracting? Is it an obviously useful upsell or is it doomed to the fate of the salesperson who shows a customer one too many choices? HP thinks it's often the latter and has sharply trimmed the number of related items it shows. And the company is claiming a 30 percent sales increase as a result.
As more retailers try to go where the customers are rather than getting them to come to the retailer, TiVo and Domino's are taking the next logical step with a TV-as-E-Commerce-Device approach.
We make calls on PCs and surf the Web on our phones. The lines of separation are blurring fast. But in the world of retail technology, the difference between a kiosk and digital signage is one of the more difficult distinctions to make. How to describe that difference? To one CFO, the answer was obvious: A poem. In rhyming verse. Rhyming verse that is so bad it's almost good.
The further employees get from corporate, and from corporate networks, the more likely they are to do things with their computer that security managers would rather they didn't. GuestView Columnist David Taylor asks if these people might be doing things (e.g., downloading malware) that could bring down your company?
Podcast panelists debate card replacement problems, including inadvertently printing encryption keys on customer receipts and the refusal of the card brands to shorten how long expiration dates are valid. "We now have to worry about data that's been there as many as 12 years."
A loyalty card that consumers can turn on and off could potentially usher in a consumer revolution of sorts, allowing the majority to punish merchants they see as misusing CRM data that has been entrusted to them. At least that's one scenario painted by the president of the company that is pushing the card.
Amidst an avalanche of hype about the desirability of gift cards this holiday season, the National Retail Federation on Tuesday (Nov. 18) predicted a six perfect drop in gift card sales this season, from $26.3 billion spent during last year's holiday season to a projected $24.9 billion for this season.
Some 30 meters below solid bedrock underneath Stockholm, an abandoned nuclear bunker has been transformed into what could only be described as the world's coolest datacenter.
Several factors are lining up—including rushed technology upgrades, more site handoffs for everything from mobile to social networking widgets and a surge in traffic from bargain hunters—that could easily make this holiday shopping season one of the crashiest in years, if not the crashiest. (Note to copydesk: I don't care if crashiest is not a word. It should be.)
When Sears rolled out its mobile effort (Sears2go) this month, it illustrated the challenges for a retailer trying to craft a clean and stable mobile strategy at a time of extreme flux for the mobile space.
When E-Commerce execs try and understand abandoned shopping carts, they often overlook concrete clues. One of the best is whether shoppers clicked on the store locator link right before leaving. But deciding what to do about abandoned carts, that gets complicated. The innocuous-looking store locator is akin to waving a red cape in front of the face of an E-Commerce manager bull.