Experts concerned over PCI rule relaxation

gallery

As PCI requirements come into effect at the end of this month, experts have expressed concerns that that some organisations will rush through changes in order to make deadlines.

The two main companies behind the Payment Card Industry Data Security Standard (PCI DSS) initiative, Visa and Mastercard, have relaxed rules so that smaller retailers only have to deal with securing customer data on systems first by the end of this month, rather than complying with every part of the new regulations. The PCI DSS is a set of requirements for enhancing payment account data security

But there are worries that that the regulations are too onerous for companies and short cuts will be made in trying to meet the deadline.

"When dealing with information as sensitive as credit card details, it is absolutely crucial that everything possible is done to ensure the complete protection of this data," said Jacob West, Security Research Group manager at IT security company Fortify Software.

He said that given the rush for businesses to comply with the PCI standard, particularly the requirement to maintain secure systems and applications, he was concerned that some organisations won't do as thorough a job as they should.

"To achieve meaningful compliance with PCI, organisations have to design, build, test, and deploy their credit card systems with security in mind from the very beginning," said West.

West said that the PCI standard would be more effective and that more companies would pass the PCI audit the first time if it outlined specific steps necessary to implement a secure development lifecycle.

"Rather than alluding to industry best practices, we would like to see PCI mandate specific activities, such as architectural risk assessment, static source code analysis during development, security testing with specific measures of breadth and depth, and application-aware security defences applied to deployed applications," said West.

Email to a friend

Print this page