Cloud Computing Viewpoint
Will You Comply or Just Check the Box?
There are a couple interesting PCI developments coming over the next rc year
Oct. 22, 2009 06:45 PM
Some of both, apparently. A recent
Ponemon Institute PCI-DSS Compliance survey revealed that
71% of companies actually admitted that data security is not a top priority and
55% say they are only protecting credit card data and not other sensitive information like bank account info, social security numbers and drivers license data.
Additional statistics show that a miniscule 28% of smaller companies (501-1000 employees) are
PCI-DSS compliant and around 70% of large companies (>75,000 employees) say they meet the Regulations. The one that jumps out for me is the small merchant stat. I understand that
cost is a large factor for smaller companies to be PCI compliant but just imagine how many companies and industries that fall into the 501-1000 employee category.
And that doesn’t count all the even smaller ‘Family Owned’ restaurants, auto repair shops or any other service where you say, ‘I like them because they are local or family owned.’ Unfortunately, those friendly establishments
might not be a BFF with your sensitive data. I’m not saying to avoid your favorite Chinese take-out but also be aware that the numbers are against you.
There are a couple interesting PCI developments coming over the next 
year. As I mentioned in Regulation Roundup back in February, the PCI deadline for unattended, Point-of-Sale PIN entry devices is July 10, 2010.
These are those standalone ‘Pay for your parking’ machines, gas station terminals, ticket kiosks, vending machines and any other terminal where a PIN might be entered. First, July 1, 2009, was the deadline for Triple-DES to be mandated for all debit transaction processing. And next July, all fuel pumps (and like terminals) will need to have encrypted PIN entry pad, be able to encrypt the PIN itself and process using TDES. I imagine there will be another mad dash next spring for merchants to get in compliance.
The other PCI piece is come summer 2010, PCI will be making some regulatory changes to update PCI standards including 3rd party audits (Level II), tokens, end-to-end encryption and potentially Virtualization Security. Some of these changes should help in protecting our data.
And if you think skirting regulations might be a money saver, take a look at this article where the FTC has recently fined ChoicePoint for not adhering to the agreement made in 2006 for the huge 2005 data breach. They just got whacked with another $275,000 for removing a database security monitoring tool.
As I finish up the 18th entry of 26 Short Topics I’ve noticed Regulatory
Compliance, especially PCI, comes up frequently. Maybe it’s the constant surveys, startling numbers, never ending breaches and media reports or maybe, it’s that PCI-DSS, while not perfect, affects almost all of us and it’s like we’re in it together. You might not know, get along with or like your neighbor but if you shop at the same store and they are breached, suddenly you’re both in the same boat – ‘Hey, that happened to me too!’ It’s one of those things that we all should care about.
ps
- #18 out of 26 Short Topics about Security
- previous stories: 17, 16, 15, 14, 13.5, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1
UPDATE - Added 10.22.09: ChoicePoint would like to clarify the characterization of the FTC situation and I'm happy to include this for accuracy:
"Your piece titled "Will you Comply or Just Check the Box" touches on recent ChoicePoint/FTC news and the company would like to request a clarification. 1. In regards to your report that a "fine" was levied by the FTC a. While the Commission has authority to seek a civil penalty, http://ftc.gov/ogc/brfovrvw.shtm it expressly did not do so in this case, as the language of the Order and the amount of monetary relief indicate. The Supplemental Stipulated Order itself in Part I provides for "monetary relief...to be used for equitable relief, including, but not limited to consumer redress and any attendant expenses...." The FTC incorrectly characterized the monetary payment as a "penalty" in its initial press release and has since revised its press release to correct this point. The payment was made pursuant to the courts equitable authority to address compliance with its orders. The payment is not punitive in nature and neither the Order nor the FTC press release (as modified) characterizes the payment as a fine or a penalty. Thank you so much for you time and attention. We would very much appreciate your correction of the record."
- Not a problem, thanks for the update and appreciate the clarification. ps
Read the original blog entry...
About Peter SilvaPeter Silva covers security for F5’s Technical Marketing Team. After working in Professional Theatre for 10 years, Peter decided to change careers. Starting out with a small VAR selling Netopia routers and the Instant Internet box, he soon became one of the first six Internet Specialists for AT&T managing customers on the original ATT WorldNet network.
Now having his Telco background he moved to Verio to focus on access, IP security along with web hosting. After losing a deal to Exodus Communications (now Savvis) for technical reasons, the customer still wanted Peter as their local SE contact so Exodus made him an offer he couldn’t refuse. As only the third person hired in the Midwest, he helped Exodus grow from an executive suite to two enormous datacenters in the Chicago land area working with such customers as Ticketmaster, Rolling Stone, uBid, Orbitz, Best Buy and others.
Bringing the slightly theatrical and fairly technical together, he covers training, writing, speaking, along with overall product direction and evangelism for F5’s security line. Prior to joining F5, he was the Business Development Manager with Pacific Wireless Communications. He’s also been in such plays as The Glass Menagerie, All’s Well That Ends Well, Cinderella and others. He earned his B.S. from Marquette University, and is a certified instructor in the Wisconsin System of Vocational, Technical & Adult Education.
.gif)
Oracle seems to have divided the open source ranks over the MySQL delay it’s having closing its acquisition of Sun. Eben Moglin, the GPL’s most ardent defender and delineator, the lawyer who has worked hand in glove for years with the Free Software Foundation’s founder Richard Stallman...
Cloud computing is a game changer. The cloud is disrupting traditional software and hardware business models by disrupting how IT service gets delivered. Entrepreneurial opportunities abound as this classic disruptive technology begins to proliferate, so it is no surprise that SYS-CON'...
The irony is that Oracle has advanced MySQL, lost money in the process, and helped its competitors - all at the same time. When Oracle buys Sun and controls MySQL the gift (other than to Microsoft SQL Server) keeps on giving as the existential threat to RDBs is managed by Redwood Shore...
WSO2, the open source SOA company, today announced the launch of the WSO2 Cloud Platform. Available today, the new WSO2 Cloud Platform features a family of WSO2 Cloud Virtual Machines; WSO2 Cloud Connectors for enabling fast, secure cloud services; and the multi-tenant WSO2 Governance-...
Now, the open source Mozilla Thunderbird client software can be used with Open-Xchange collaboration software. The "Community OXtender for Thunderbird" software connector gives users full access to appointments and contacts stored in the Open-Xchange Server and enables them to use Thun...
Morph Labs, a leading provider of enterprise cloud computing technology, today announced an introductory trial of the Morph CloudServer, an open, standards-based server IT organizations can use to rapidly model and evaluate their cloud implementations. A miniature "Cloud Environment in...
