Gary Palgon
Vice President, Product Management
nuBridges
Onsite in Las Vegas – The Payment Card Industry’s Security Standards Council (PCI SSC) is on a 24-month cycle of reviewing and editing the PCI Data Security Standard (PCI DSS). Version 1.2 was issued in October 2008 and the next major release is expected around the same time in 2010. While last years’ theme seemed to be around “Compliance does not equal security” and “Network Segmentation”, this year’s theme was very much about submitting feedback on the current standard and reviewing new technologies for reducing the scope (and burden) for initial and ongoing PCI DSS compliance.
Pricewaterhouse Coopers (PwC) was contracted by the PCI SSC to “look at technologies out there that have the potential to reduce scope for PCI DSS” and PwC presented their preliminary findings at the meeting this week. They interviewed more than 160 individuals from 125 companies across 10 countries and evaluated 12 technologies. They narrowed their focus down to four, which they drilled into to understand the impact of implementation and affect in reducing scope of the PCI DSS audit: end-to-end encryption, magnetic stripe imaging, tokenization and virtual terminals. The report will be forthcoming; however, it serves as “feedback” to the PCI SSC as they review the standard and recommendations in the coming year(s).
As funny as it sounds, one “aha!” from the meeting was “What is considered cardholder data?” Believe it or not there was no easy answer. The Scoping Special Interest Group (SIG) will take that under review in the coming year.
And finally, the annual meeting is a time where many people express the difficulty in understanding, implementing and changing the standards. Much of that was put into perspective when former Congressman Tom Davis explained how the U.S. government works to create laws! He was the co-author of the Federal Information Security Management Act (FISMA), so standards are near and dear to his heart. I have to remind myself when I submit questions to the PCI SSC and months go by without an answer that it could be worse – I could be in politics!
Until next time,
Gary
