Gordon Rapkin, CEO of security solutions provider Protegrity, notes that “PCI DSS is truly a sensible approach to data security. It’s not an arcane set of rules established by some remote authority; it’s a set of industry best practices that help retailers secure their networks and protect their customers’ privacy. Compliance with the standard brings real benefits; it’s far less costly to prevent attacks than it is to clean up after a breach.”

The Backlash
Given what PCI is trying to accomplish, one would expect it to be welcomed with open arms by the industry. To a degree, it has. But surprisingly, there seems to be a cabal that has made it its duty to attack PCI rather than embrace it. There is nothing complex or mysterious about PCI, yet that appears to be lost on some very smart people.

One recent example: Michael Mathews, chief operating and technology officer at security-services company CynergisTek, wrote an article called PCI Has Lost Its Way, Growing Overly Complex and Costly, for the June 2007 issue of Information Security. Mathews repeatedly stresses the complexity of PCI. But where is it? Each of the 12 main requirements and corresponding specifics are extremely pragmatic and can be classified as information security 101. Mathews writes that because of these and other “complications,” many merchants remain noncompliant to many facets of PCI DSS.

The issue really is that these merchants have created their networks with little to no thought to security and privacy. They have placed minimal controls on their users, given no direction to their application developers, nor documented required procedures for their administrators on how the network should be managed. Merchants are not noncompliant due to PCI DSS; they are noncompliant because they never developed their security programs in the first place.

Mathews also states that unwarranted complexities in the standard are raising the cost of compliance, but does not name any of these complexities. No matter how many times the author uses the word complex, it can’t change the reality that the PCI DSS is practical, not complex.

An additional complaint is that answering the PCI DSS self-assessment questionnaire requires small merchants to hire teams of experts to help them interpret the intent of the questions. The 9-page PCI self-assessment questionnaire is straightforward and requires minimal interpretation. As to teams of experts, that is clearly overkill. Answering the questionnaire can be done by a single consultant in collaboration with the client, for the vast majority of merchants.