Last weekend was a typical one, nothing out of the ordinary: errands, science fairs, softball practice with the kids. However, I found myself hesitating a number of times, thinking twice, before I handed my credit card to the cashier at the mall for to purchase a pair of shoes and again as I typed in my credit card number and security code online to purchase some items for a school fund raiser. In the past, I hadn’t given this much thought, but with yet another data breach in the news, it seems that the breaches are continuing to occur – and as consumers, we will continue getting those ‘Dear John’ letters informing us we were one of the unlucky ones…
With news of another data breach of up to 1.5 million credit and debit cards compromised last month as well as high-profile data attacks against the International Monetary Fund, National Public Radio, Google and Sony’s PlayStation Network, data security should be top of mind to all of us. So, how are these breaches continuing despite all of the efforts to secure customer data? In a series of blog entries to follow, we’ll outline the anatomy of a data breach, steps you can take to reduce your risk, and how Cisco can help keep your organization from being the topic of the next breach headline.
Anatomy of a Data Breach:
It used to be that hackers were in the business of hacking for fame or infamy… mostly individuals or groups of friends were doing small-time breaches, leaving digital graffiti on well-known websites. Although these breaches demonstrated security gaps among those affected, there was little financial impact compared to today. It should come as no surprise in a world of big data, that it is harder than ever for organizations to protect their confidential information. Complex, heterogeneous IT environments make data protection and threat response very difficult.
For retailers and merchants, January 1st, 2012 is the deadline after which all audits for PCI compliance need to be at the Data Security Standards 2.0. At Cisco we have invested in education content as well as architecture designs for PCI 2.0 to help retailers address compliance and secure credit card data.
Need to learn about the basics of PCI 2.0? Check out the following Fundamentals of PCI YouTube Video
For a little more deeper education about PCI including navigating the ins and outs of compliance, dig into design and implementation, and tips for a successful audit, check out the following Cisco Techwise TV episode titled “Everything You Wanted to Know About PCI But Were Afraid to Ask”
Many have argued that the PCI DSS, Payment Card Industry Data Security Standard is too complex to be realistic in a real-world environment. Cisco takes the opposite stance maintaining that the principles and security standards contained within the documentation should actually be considered a minimum. The true challenge being not in the implementation but in the ongoing management -- the maintenance if you will.
This show promises to layout a simplified view of the standard with real-world, practical advice where anyone can find exactly how they would apply their unique situation. We have pulled out all the stops with our story-telling and top notch guests as we have members of the standards board, networking experts and certifies QSA auditors joining us.
PCI. It’s not just for Breakfast
It’s amazing how many networks fall into the “compliance required” category. For PCI it only takes one credit card transaction to be at risk…but rather than focus on the negativity of the required audit – this topic and the maturity of the standard is actually good for ANYONE interested in protecting their data. You may have the typically binary response as to whether this show applies to you…but I think you need to give it a go. You may be surprised….the show and the Shownotes are after the jump.
Recently there has been a series of news items as enterprises announce they have been breached and their sensitive customer and financial records compromised. According to Verizon 2011 Breach report 92% of the attacks were external and 76% of all data breached came from servers. The PCI Security Standards Council is an open global forum formed in 2006 that is responsible for the PCI Data Security Standard (PCI DSS), a standard that is designed to protect cardholder data.
I sat down with Lindsay Parker, Cisco global retail industry director about Cisco’s current investments and efforts to help retailers and merchants secure customer credit card data and maintain compliance with PCI DSS.
Maybe it’s because I grew up in the Midwest. But I just don’t like writing checks to lawyers.
I’ve lots of friends in the legal profession, and all are lovely people (well, most of them, anyway).
But as the pragmatic sort, it pains me to spend money to resolve something that might have been settled at a lesser price well before.
Which leads me to the topic of PCI.
Just reviewed a 2010 study from the data security experts at The Ponemon Institute that looked at the post-incident cost of data breaches. Forget, for a moment, the brand humiliation, the CEO news conferences, the critical whiplash in the blogosphere and throughout Facebook. Ignore, for a moment, that research suggests that 30% of consumers who were victimized by retailer data breaches promise never to patronize the offending brand again.
The Ponemon research found that 42% of all data breach incidents led to the involvement of a third party (there to provide additional, independent investigation, resolve disputes, and soak up consulting fees.)
The average cost of that third party involvement in the United States was $1.52 million, with final resolution costs ranging from $750,000 to upwards of $31 million. That’s on top of lost business estimated at $4.47M per incident.
Total: $6M. Perhaps not fatal to a billion-dollar business, but not a check I’d like to request.
Yes, I know that active, careful PCI compliance is no guarantee. And that active, careful PCI compliance doesn’t put revenue on the top line. And that there’s ongoing confusion about PCI for mobile. And everyone thinks it’s all too expensive. And on and on and on.
But I also know this: active, careful compliance reduces risk. Significantly.
And that the price of risk is not just a bruised brand.
