CardSystems breach renews focus on data security

The massive scope of the security breach at CardSystems Solutions is sure to result in an increased focus on upcoming data-protection requirements being pushed by MasterCard International and Visa U.S.A., analysts said Monday.

The standard is called the Payment Card Industry Data Security Standard, or PCI, and it goes into effect on June 30.

It lists 12 items that all retailers, online merchants, data processors and other businesses that handle credit card data will have to meet, and it sets technology mandates, including requirements that data encryption, end-user access control and activity monitoring and logging systems be used. PCI also includes procedural mandates, such as one requiring the implementation of formal security policies and vulnerability management programs.

Late Friday, MasterCard announced that a hacker was able to access as many as 40 million credit card numbers by infiltrating CardSystems Solutions' network. The company processes payment data for MasterCard and other companies. MasterCard said it had notified banks that issue its credit cards about the breach. Those banks will be responsible for notifying customers..

The size of the breach is bound to result in a tougher enforcement of the new rules, said Michael Petitti, a senior vice president at Ambiron Trustwave, a Chicago-based provider of security services for the credit card industry. "The PCI standard is germane to every entity that handles cardholder information, regardless of where they are in the value chain," Petitti said.

Achieving and maintaining compliance with the rules -- which are already in effect for large companies -- will become an absolute must, Petitti said.

"The card associations are very serious about this and have been very good about communicating their requirements," he said. "You are sure to see more attention because of incidents like these."

"This is likely to be a seminal event," said Ted Julian, vice president of product management at Application Security Inc. in New York. "With PCI, I think we will see an emphasis that goes beyond fines," he said. "Over time, we will start to see credit card associations get more tough about how they implement these things."

Avivah Litan, an analyst at Gartner, said the high publicity given to recent data breaches has been spurred in part by California's disclosure law. That law mandates the reporting of data breaches so customers can better protect and defend themselves against their personal information being stolen.

"I think the thing that's going on is the credit card industry has been asleep at the wheel here and is not enforcing their own standards," Litan said. PCI includes strong requirements for network intrusion detection, regularly scheduled testing, file integrity monitoring systems and more, she said.

Dan Keldsen, a security analyst at Delphi Group, said the latest incident could finally force a shift in corporate attitudes and bring about real changes in data security methods.

"There's an awful lot of pantless corporations out there" after a recent string of data breach incidents involving Bank of America, ChoicePoint, the University of California at Berkeley and others, Keldsen said. "I guess it's going to get worse before it gets better, because there's really no hiding it anymore."

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Todd R. Weiss

Show Comments

Brand Post

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?