Ecommerce Security: PCI, Risk and Cost

jvm — Mon, 26 Oct 2009 08:45:00 GMT

PCI standards evolve but they do so often at a more languid pace than does the technology itself. Toss in economic considerations and you've got a real Ecommerce conundrum...

Recent literature published in the PCI Knowledge-base examines security and compliance migrations, cost reductions, and virtualization in recessionary times. Ecommerce solution provider ShopVisible offers up insights into its own PCI assessment process while trying to stay on top of recent Ecommerce security news in order to provide its clients and readers a glimpse into the rapidly blossoming arena of Ecommerce payment protection.

For many online merchants, or at least those wrestling with PCI and security measures to protect the CDE or cardholder data environment, the strident 12 requirements of PCI coupled with serious security budgets and IT infrastructure has created headaches and handicapped wallets...especially now. For many, as evidenced in the PCI Knowledge-base's expert’s blog, the arduous compliance process has become tarnished by a "checklist mentality and ineffective implementation and enforcement." It can be argued as a best practice in Ecommerce, or at least in an effort to pass compliance levels, that reducing risk and documenting to assessors that effective controls are in place exudes risk management policy, and thereby can help cut costs during the implementation.

PCI security experts have been discussing sophisticated elements of online commerce and their relation to development of both policy and technology. For instance, with regards to network segmentation and scope, the PCI Knowledge-base notes that “network segmentation is still not a requirement, for some reason, but it’s the single action that will save you the most money in the assessment.” In the PCI 1.2 version, segmentation is discussed and noted as being adequate along with the appropriate network diagrams if in place. One solution available to many merchants with the right budget is a variation of a network monitoring tool. These can “tell you, continuously, of attempts to access specific network resources.” They can in doing so show the assessor the positive impact of your network segmentation policy and thereby quantify risk and help cut back on PCI compliance costs.

Store sampling is another facet of the compliance process and in PCI 1.2, “the goal of the sampling process is to understand the risks posed by stores, since many security breaches originate there…” one here must show the assessor that store policy is commensurate with Ecommerce provider policy and high levels of consistency are maintained constantly again helping to reduce risk and cut costs. Again, automated tools can benefit providers here in an attempt to cut time and costs resources associated with manual configuration management. The PCI Knowledge-base notes that “the ability to place server configuration under change control is valuable for both PCI requirement 2, as well as requirement 10.” Automated tools will often justify a smaller sample size thus again reducing assessment fees.

The latest post from the PCI Knowledge-base also delves into discussion of compensating controls in the Ecommerce eco-system and states that “while compensating controls are too often used as a PCI cost cutting technique by merchants, they are really the heart and soul of risk management relative to PCI…a weak process for documenting and quantifying risk usually shows up in poorly defined compensating controls, which can cause compliance failure and additional assessment and technology costs.”

Basically, PCI compliance is an arduous process for any company regardless of organizational complexity, IT infrastructure and budget size. Above are just a few methods to try and cut back costs. When selecting an Ecommerce provider, it helps to do your due diligence and “in PCI 1.2, there is specific mention of the need to prove due diligence as to risk ‘prior to engaging’ service provider, and need to prove ongoing ‘monitoring’ of compliance status.” Keep monitoring policies up to date and maintain a vigilant stance with regards to data centers. Just because you’re PCI compliant does not mean that a hardened data center will mandate policy to keep you compliant. Prove to your data center, your assessor and to your clients that you care about risk. Show them PCI is an ongoing process and one dedicated to secure online transactions. The more safely your merchants sell, the more they will appreciate all your hard work!

ShopVisible is an Ecommerce solution provider intent on security, integration and SEO.

ShopVisible, LLC Blog RSS Feed

Ecommerce Security: PCI, Risk and Cost