VISA PCI Incentives

A new VISA incentive program for payment providers (i.e. “acquiring financial institutions”) caught my interest. You can read an article about it here. The essential detail is that for every merchant out of compliance with the PCI DSS a fine of between US$5000 and US$25000 will be levied onto the acquirer. Conversely, incentives will be paid out for validation of PCI compliance.

I’m all for PCI compliance – it’s really a good set of common sense basic security measures that we should all be implementing in the best interests of protecting customer critical data. And while I’m critical of the way that some of the guidance and standards are put together, the threat of financial penalties can sometimes be a good kick up the rear-end in motivation to put new programs in place.

However, I’m not enthusiastic about an incentive payment scheme – I believe that such schemes have the potential to undermine the standard by turning it into an exercise in achieving the pass mark rather than a serious effort to protect data. For instance, item 1.1.8 of the standard is for a “quarterly review of firewall and router rulesets.” The associated audit procedures directs auditors to “verify that the rule sets are reviewed each quarter.” Such a review of rulesets is certainly an important process to have in place and some might argue that quarterly is not often enough however, how should an auditor verify this? A signature in a log book would probably suffice as evidence but it does not prove that a process is being followed. There are other areas too that concern me, particularly in section 6 on software development and the means of verifying that systems are not vulnerable to various mentioned vulnerabilities such as cross-site scripting and unvalidated input. Now, I have personally seen examples of systems that have been tested by authorised PCI auditors using application scanning tools and been given a clean bill of health only for it later to be found that they contained discoverable flaws that could have resulted in exactly the sort of incident the PCI standard is supposed to be preventing. And even if an auditor does successfully and accurately give an application a clean bill of health then the very next change request could undermine all the efforts.

Security should be adding value for customers – they come back because they know that their data and payment information is secure with you. VISA have their hearts in the right place so instead of incentives on the acquirers, how about a “VISA certified payment provider” stamp on products and some truely verifiable audit procedures? Just a thought!

Join the conversation

7 comments

Send me notifications when other members comment.

Please create a username to comment.

crazy frog ringtones [url=http://jzsooj.007sites.com/?]crazy frog ringtones[/url] crazy frog ringtones [url=http://jzsooj.007sites.com/?]crazy frog ringtones[/url] chart ringtones [url=http://ijjfix.hostaim.com/?]chart ringtones[/url] chart ringtones [url=http://ijjfix.hostaim.com/?]chart ringtones[/url] Download Mobile Ringtones [url=http://vkavwe.hostaim.com/?]Download Mobile Ringtones[/url] Download Mobile Ringtones [url=http://vkavwe.hostaim.com/?]Download Mobile Ringtones[/url] mp3 to ringtone gold 3.16 [url=http://cceqeb.977mb.com/?]mp3 to ringtone gold 3.16[/url] mp3 to ringtone gold 3.16 [url=http://cceqeb.977mb.com/?]mp3 to ringtone gold 3.16[/url] mp3 ringtones [url=http://svhotw.007sites.com/?]mp3 ringtones[/url] Gift Ringtones [url=http://voswah.007sites.com/?]Gift Ringtones[/url]
Cancel
cell ringtones [url=http://ooubud.007sites.com/?]cell ringtones[/url] motorola ringtones [url=http://ufbwrs.hostevo.com/?]motorola ringtones[/url] verizon mp3 real ringtones [url=http://xoyeae.hostaim.com/?]verizon mp3 real ringtones[/url] polyphonic ringtone [url=http://dhnrvt.hostevo.com/?]polyphonic ringtone[/url] cheap ringtones [url=http://tfcwew.007sites.com/?]cheap ringtones[/url] Ringback Tones [url=http://caarvk.hostevo.com/?]Ringback Tones[/url] lil wayne ringtones [url=http://cqtkzh.977mb.com/?]lil wayne ringtones[/url] ringtones.com [url=http://xsdyme.hostbot.com/?]ringtones.com[/url] cheap mp3 real ringtones [url=http://rsbdsq.hostevo.com/?]cheap mp3 real ringtones[/url] polyphonic ringtones [url=http://tqjknb.hostbot.com/?]polyphonic ringtones[/url]
Cancel
free nokia mp3 tones [url=http://frukbf.hostbot.com/?]free nokia mp3 tones[/url] make your own ringtones free [url=http://hkmbhu.justfree.com/?]make your own ringtones free[/url] britney spears ringtones [url=http://xfhzcd.007sites.com/?]britney spears ringtones[/url] polyphonic ring tone [url=http://zyehyl.hostaim.com/?]polyphonic ring tone[/url] polyphonic tones [url=http://jcsjwo.977mb.com/?]polyphonic tones[/url] mp3 real tones ringtones [url=http://dtygth.007sites.com/?]mp3 real tones ringtones[/url] ringtone maker [url=http://gxhuui.hostevo.com/?]ringtone maker[/url] cellular phone ringtones [url=http://xrpnym.977mb.com/?]cellular phone ringtones[/url] polyphonic ringtones download [url=http://imftni.hostaim.com/?]polyphonic ringtones download[/url] free mp3 tones [url=http://logqlo.hostbot.com/?]free mp3 tones[/url]
Cancel
free nokia mp3 tones [url=http://frukbf.hostbot.com/?]free nokia mp3 tones[/url] make your own ringtones free [url=http://hkmbhu.justfree.com/?]make your own ringtones free[/url] britney spears ringtones [url=http://xfhzcd.007sites.com/?]britney spears ringtones[/url] polyphonic ring tone [url=http://zyehyl.hostaim.com/?]polyphonic ring tone[/url] polyphonic tones [url=http://jcsjwo.977mb.com/?]polyphonic tones[/url] mp3 real tones ringtones [url=http://dtygth.007sites.com/?]mp3 real tones ringtones[/url] ringtone maker [url=http://gxhuui.hostevo.com/?]ringtone maker[/url] cellular phone ringtones [url=http://xrpnym.977mb.com/?]cellular phone ringtones[/url] polyphonic ringtones download [url=http://imftni.hostaim.com/?]polyphonic ringtones download[/url] free mp3 tones [url=http://logqlo.hostbot.com/?]free mp3 tones[/url]
Cancel
free nokia mp3 tones [url=http://frukbf.hostbot.com/?]free nokia mp3 tones[/url] make your own ringtones free [url=http://hkmbhu.justfree.com/?]make your own ringtones free[/url] britney spears ringtones [url=http://xfhzcd.007sites.com/?]britney spears ringtones[/url] polyphonic ring tone [url=http://zyehyl.hostaim.com/?]polyphonic ring tone[/url] polyphonic tones [url=http://jcsjwo.977mb.com/?]polyphonic tones[/url] mp3 real tones ringtones [url=http://dtygth.007sites.com/?]mp3 real tones ringtones[/url] ringtone maker [url=http://gxhuui.hostevo.com/?]ringtone maker[/url] cellular phone ringtones [url=http://xrpnym.977mb.com/?]cellular phone ringtones[/url] polyphonic ringtones download [url=http://imftni.hostaim.com/?]polyphonic ringtones download[/url] free mp3 tones [url=http://logqlo.hostbot.com/?]free mp3 tones[/url]
Cancel
polyphonic ringtones free [url=http://qtkekt.justfree.com/?]polyphonic ringtones free[/url] radio ringtones [url=http://azeett.justfree.com/?]radio ringtones[/url] ringtones for nokia [url=http://dlaprk.007sites.com/?]ringtones for nokia[/url] download ringtones to mobile [url=http://usxqmh.007sites.com/?]download ringtones to mobile[/url] MP3"s Songs [url=http://fcxghv.justfree.com/?]MP3"s Songs[/url] ringtones free verizon [url=http://rmevpp.hostaim.com/?]ringtones free verizon[/url] Top Ringtones [url=http://akuhrn.hostevo.com/?]Top Ringtones[/url] ringtones for phone [url=http://veayjh.hostbot.com/?]ringtones for phone[/url] sms ringtones [url=http://vkcjuv.977mb.com/?]sms ringtones[/url] hindi mp3 tones [url=http://wzbnpk.hostevo.com/?]hindi mp3 tones[/url]
Cancel
MP3 Real Ringtones [url=http://infgqw.hostaim.com/?]MP3 Real Ringtones[/url] Mobile Ringtones [url=http://tzwbnf.hostbot.com/?]Mobile Ringtones[/url] free polyphonic ringtones download [url=http://pssghz.hostevo.com/?]free polyphonic ringtones download[/url] ringtones for cell phone [url=http://qmzoeu.justfree.com/?]ringtones for cell phone[/url] mp3 ringtones free [url=http://xiubwr.977mb.com/?]mp3 ringtones free[/url] samsung polyphonic ringtones [url=http://vjunse.007sites.com/?]samsung polyphonic ringtones[/url] free wav mp3 tones philippines [url=http://snllpr.hostaim.com/?]free wav mp3 tones philippines[/url] polyphonic ringtones christmas [url=http://wddejj.justfree.com/?]polyphonic ringtones christmas[/url] hot ringtones [url=http://klqseh.hostaim.com/?]hot ringtones[/url] ringtones free mp3 download [url=http://dwakjs.977mb.com/?]ringtones free mp3 download[/url]
Cancel

SearchCIO

SearchSecurity

SearchNetworking

SearchDataCenter

SearchDataManagement

Close