Is PCI creating an industry?

The new version of the Payment Card Industry (PCI) Data Security Standard, version 1.1, has been out for a few weeks now. Sources tell me that customers are interpreting the new PCI standard to determine what they have to do to comply. I have not seen many comments on the spec yet, so let me ring up a few +'s and –‘s.

In general, this is a great spec for applying security technologies. I have some quibbles about requiring specific technology instead of problem solutions, but it does deliver enhanced security for credit card data which can only be a good thing. As a product manager I learned to avoid the trap of putting “how to” design requirements into product specifications instead of “what needs to be fixed” functional requirements. PCI 1.0 was a serious offender, but PCI 1.1 is improved in this regard.

Compensating Controls (+). Great idea! Not all companies can implement all sections of PCI. In some cases they have met the intent of the requirement by means other than that specifies by PCI; in other cases the economics of a solution just do not make sense for that business. Compensating Controls allows organizations some needed flexibility in meeting a PCI requirement.

Web application security (+). I like web app gateways for protecting applications. It is only a recommendation in PCI 1.1, but I am glad to see the awareness raised for this technology. One good thing is the segregation of duties: a web application gateway can also detect information loss (e.g. unusually large chunks of outbound credit card data). Places to check out here include Citrix, F5, Imperva and Protegrity.

PCI Consulting Industry (+/-). PCI is spawning a services industry for generating official PCI audits. Anytime that happens you can be sure they'll create demand for more consulting work. Services engagements for security expertise can certainly help with organizations that are short in that skill set (+), but I hate to see an overhead-cost industry spring up just for the sake of PCI compliance (-).

Insufficient focus on data loss (-). In general, PCI is focused on detecting intruders or malicious insiders from penetrating the system. Let's face it, firewalls, anti-x, authentication, physical security and IDS/IPS will not help you detect a breach. PCI 1.1 is surprisingly light on how to detect loss – requirement 10 is mostly about the integrity of audit logs to try to figure out what happened and I must have completely missed egress content inspection, audit reviews for loss or spot checks of outbound email. Seems to me a good value-add from PCI would be recommendations on how to detect a breach followed by what they should do when the breach occurs.

Ideas for PCI 1.2 (+/-). The +/- is because these are just my ideas for discussion for PCI 1.2. There are undoubtedly other concepts that readers can add as comments.

• Tell businesses how to detect data loss. Really, most don't have a clue. Visa/Mastercard/AMEX are experts at analyzing fraudulent behavior. Tell businesses to look for valid users grabbing unusually large chunks of consumer data, accessing data on off-hours, or accessing from home PCs. Then use the audit information to determine the magnitude of the loss.
• Erase confidential data from end-points after SSL. The technology exists and is not a burden to either businesses or end-users. Require cache scrubbing, history file cleaning and temporary file removal whenever SSL is used. These capabilities exist from vendors like Aventail, Cisco, Citrix, and Juniper as well as a bunch more. Use ‘em.
• Define a data loss procedure. It is remarkable that the responsibilities to consumers is missing beyond "12.9 Implement an incident response plan. Be prepared to respond immediately to a system breach." I want to see what the business must do when data loss is detected. Do they need to report cardholders affected? Offer credit-watch services? PCI is structured to reduce credit card fraud for the card companies – I'd like to see something for protecting their customers. It's the right thing to do.
• Create a forum for best practices. There is so much that can help companies that does not belong in a standard specification. Organize a PCI advisor forum and a PCI Compliance Wiki. Let the community help you reduce fraud by sharing their best practice experiences.

I started this on the train to InterOp in NY. This could be my longest blog on Computerworld. Thanks for reading to the end!