FUD Watch | Vendor Hype Escalates Over PCI Deadline

Monday is the day merchants must be in compliance with PCI DSS Requirement 6.6. That means the security vendor PR machine is in overdrive

About FUD Watch: Senior Editor Bill Brenner scours the Internet in search of FUD - overhyped security threats that ultimately have little impact on a CSO's daily routine. The goal: help security decision makers separate the hot air from genuine action items. To point us toward the industry's most egregious FUD, send an e-mail to bbrenner@cxo.com.

Merchants have to comply with Requirement 6.6 of the Payment Card Industry's Data Security Standard (PCI DSS) by June 30, and those who haven't done what's necessary probably won't meet the deadline no matter what they do between now and Monday.

But that won't stop security vendors from using the deadline as an excuse to drum up a little publicity, laboring under the hope that some businesses will line up at the last minute to buy their product. In the past week, I've taken my share of PR calls asking if we wanted to speak to their client about the deadline.

This is especially the case with those selling application security products, since 6.6 is all about protecting the Web applications. Among the mandates: Merchants must have all custom application code reviewed for common vulnerabilities by an organization that specializes in application security and install an application-layer firewall in front of Web-facing applications.

As the deadline edges closer, debate continues over whether PCI DSS is a genuine road map to better security or just another misguided mandate that will do little to stem the tide of data breaches and identity fraud. A side debate over whether the costs of being in compliance or in violation are appropriate is also smoldering.

As I've said before, I don't blame vendors for trying to seize every opportunity to make a sale.

But security pros need to be able to cut through the hype and assess the best application security fit for their organizations without being blinded one way or another by the mania over the latest deadline.

In the final analysis, much of what's required under PCI DSS is common sense in an age where more and more businesses rely on e-commerce and tend to rush online shopping portals into circulation with security holes easily identified and exploited by the bad guys.

Though skeptics are right to point out that data breaches and identity fraud continue to rage despite the standard (Hannaford's supermarkets suffered a major breach despite all the investments it made in PCI compliance), it's foolish to argue that we'd be better off without it.

Without the pressure of PCI DSS, far fewer merchants would even be making an attempt to better protect customer data. Retailers don't like to make investments in anything that cuts into the bottom line, and, unfortunately, it often takes government regulations and industry standards to force private enterprise to do what's right. Without the compliance pressure, one could argue the rate of data breaches would be even worse than it is right now.

That said, companies should be looking at PCI DSS as a roadmap to better security and not as another compliance deadline to heed. Rushing to meet a deadline like this can push a company into making bad decisions over which security vendors to go to. It can also blind merchants to the fact that security is an ongoing process, not something that is achieved once a compliance deadline is met.

Don't be pressured into bad investments by vendors who try to scare you with the deadline talk.

If your company is not going to be in compliance by Monday, the world won't end. As long as you're clear with the PCI auditors on where the shortcomings are and what your plan is for addressing them, things will turn out fine.

Copyright © 2008 IDG Communications, Inc.

7 hot cybersecurity trends (and 2 going cold)