“Why can’t we just ignore PCI DSS and get on with life?”
Now if that didn’t get you jumping off your seat with a certain “Hang on, what was that?” spot of confusion, then we admire your restraint. It certainly got us animated, curious and chatting away.
Why so? Well, this is the question that passes through the mind of many people, something that Jeremy King, European director for the PCI Security Standard Council, knows all too well.
Speaking soon at the next Manchester RANT forum, and having already presented this at the London RANT, Mr King discusses that while many people may indeed have this opinion of PCI DSS (Payment Card Industry Data Security Standard), the alternative – which he equates to burying one’s head in the sand – would be somewhat regressive.
PCI DSS is, after all, designed to be a full-bodied, comprehensive security standard applicable for ubiquitous use, geared towards service providers and organisations that handle cardholder information. Its aim is for safety and preservation of the integrity of information at every step, for all sorts of cards including debit, credit, prepaid and POS.
As the PCI Security Standard Council states on its website, PCI DSS provides a robust security process that includes prevention, detection and appropriate reaction to most security incidents. The most visible security measure is in thwarting criminals from accessing card payment details for fraudulent purposes. It is effective, yes, but critics go further and say that the weaknesses inherent in the system are serious.
Robert Havelt, director of penetration testing at Trustwave’s SpiderLabs, states that PCI-compliant networks are open to exploitation because refined malware, custom-made, allows criminals to bypass certain barriers, opening the back door, and allowing them to navigate through other channels to the jackpot: the store of sensitive data. This, he argues, downplays the effectiveness of segregating payment card data. It can be accessed.
It’s a topic that gets people heated up. It’s interesting, it’s relevant and it affects everyone involved. The idea behind PCI DSS is to be applauded and it is an effective measure against security breaches. However, it can be improved. Listen to what Mr King has to say at the end of the month and offer your thoughts.
The RANT forum takes place in London on the last Wednesday of each month.