The PCI Prescription: Too Much Or Not Enough Bob Walder Chief Scientist NSS Labs, Inc'

1
The PCI PrescriptionToo Much Or Not Enough?Bob
WalderChief ScientistNSS Labs, Inc.
Network Security Testing Certification

• September 27th, 2007

2
PCI Background

• Established by card brands and brought under the
  umbrella of the SSC.

• Has been proven to decrease risk, and increase
  security for merchants and SPs.

• Addresses all entities in the path of
  transactions.

3
Too Much or Not Enough?

• Card brands / SSC view requirements as easy
  hurdles
• Large merchants (L1-2) view requirements as
  challenging and vague.
• Smaller merchants (L3-4) dont always understand
  requirements.

4
Cost of a Breach

• Electronic security breaches typically cost
  between 20 and 100 per record in actuals.
• Unrealized costs and remediation can total 1500
  per compromised record.
• Between 50-60 of cardholding organizations are
  found to be non-compliant on first assessment.

5
PCI Ecosystem
DSS
?