Home » Data Protection » PCI and Compliance

Opinion

FUD Watch | Vendor Hype Escalates Over PCI Deadline

Monday is the day merchants must be in compliance with PCI DSS Requirement 6.6. That means the security vendor PR machine is in overdrive

By Bill Brenner, Senior Editor

June 27, 2008 —

About FUD Watch: Senior Editor Bill Brenner scours the Internet in search of FUD - overhyped security threats that ultimately have little impact on a CSO's daily routine. The goal: help security decision makers separate the hot air from genuine action items. To point us toward the industry's most egregious FUD, send an e-mail to bbrenner@cxo.com.

Merchants have to comply with Requirement 6.6 of the Payment Card Industry's Data Security Standard (PCI DSS) by June 30, and those who haven't done what's necessary probably won't meet the deadline no matter what they do between now and Monday.

But that won't stop security vendors from using the deadline as an excuse to drum up a little publicity, laboring under the hope that some businesses will line up at the last minute to buy their product. In the past week, I've taken my share of PR calls asking if we wanted to speak to their client about the deadline.

This is especially the case with those selling application security products, since 6.6 is all about protecting the Web applications. Among the mandates: Merchants must have all custom application code reviewed for common vulnerabilities by an organization that specializes in application security and install an application-layer firewall in front of Web-facing applications.

As the deadline edges closer, debate continues over whether PCI DSS is a genuine road map to better security or just another misguided mandate that will do little to stem the tide of data breaches and identity fraud. A side debate over whether the costs of being in compliance or in violation are appropriate is also smoldering.

As I've said before, I don't blame vendors for trying to seize every opportunity to make a sale.

But security pros need to be able to cut through the hype and assess the best application security fit for their organizations without being blinded one way or another by the mania over the latest deadline.

In the final analysis, much of what's required under PCI DSS is common sense in an age where more and more businesses rely on e-commerce and tend to rush online shopping portals into circulation with security holes easily identified and exploited by the bad guys.

Though skeptics are right to point out that data breaches and identity fraud continue to rage despite the standard (Hannaford's supermarkets suffered a major breach despite all the investments it made in PCI compliance), it's foolish to argue that we'd be better off without it.