Payment data security standards: Good news at last

In information security, we've been dealing with regulatory compliance for years now. Still, problems are rampant.

The regulations are vague and leave plenty of room for interpretation for IT, security professionals and auditors. Vendors tend to take advantage of the confusion by marketing all types of products as compliance solutions.

What's more, many of the regulations have no enforcement teeth. With slap-on-the-wrist penalties and infrequent audits, what motivation does the local community hospital have for compliance with the HIPAA (Health Insurance Portability and Accountability Act)? Many decide to live with risk.

One exception to this rule is the Payment Card Industry (PCI) Data Security standard. It's not perfect, but I believe it is clearly pointing in the right direction.

First off, PCI is now a standard for all five leading payment card brands: American Express, Discover Financial Services, JCB International Credit Card, MasterCard Worldwide and Visa International. No need for merchants to deal with multiple overlapping regulations and processes anymore. Any chief information security officer will tell you that this is a very good thing for both IT operations and security protection. The PCI gang is also actually doing something to ease confusion in its specification. The September release of the PCI 1.1 specification directly addressed this by editing the text in areas like data privacy protection and compensating controls.

Aside from official changes, ESG is especially bullish about the creation of the PCI Security Standards Council.

Most people involved with PCI either don't know about this organization or have no idea what it does. That's a shame. The PCI Security Standards Council is a user-focused organization funded and formed by the five payment card brands. Its objectives are simple: to spread adoption and awareness.

To be sure, PCI isn't perfect. Adoption rates are still lower than the industry would like. PCI also is governed by too much stick and not enough carrot. But on balance, PCI constitutes progress.