FTC to Audit PCI Industry March 9, 2016Posted by Chris Mark in Uncategorized.
Tags: American Express, Chris Mark, credit cards, Discover, DSS, Federal Trade Commission, FTC, JCB, mastercard, Order, payment cards, PCI, visa
(UPDATED) I have been in the PCI “industry” since before it was an industry. I was fortunate to have worked with Visa in 2001 on a team that helped design the CISP requirements for Service providers and subsequently worked at MasterCard a major processor and numerous QSA firms. I can claim (along with 2 or 3 other people) to be the FIRST assessor even before we were QDSPs then QSAs. I was the PCI SSC’s global QSA trainer and Visa’s CISP trainer. There probably only 10 people in the industry that have been doing “PCI” type work as long as I have. Unfortunately, we lost two of those fine folks in the last several years. One of the most frustrating aspects of being in the PCI assessment business has been competing with the “pay and stamp” assessors. PCI is complex and conducting a solid PCI assessment is complex and not trivial. There have always been the “bottom feeders” that will guarantee a compliant finding for a nominal fixed price fee. For those companies that do solid work (while I compete with them I am also friends with many and can respect their work as much as my own employers) we often find ourselves on the losing end of a bid when someone agrees to assess a Fortune 100 company for a Fixed fee of $40K. Well..the Federal Trade Commission has taken notice!
The FTC has issued an order to 9 QSA firms to assess (pun intended) how they assess companies against the PCI DSS and how their business is structured. The 9 companies listed are:
Foresite MSP, LLC; Freed Maxick CPAs, P.C.; GuidePoint Security, LLC; Mandiant; NDB LLP; PricewaterhouseCoopers LLP; SecurityMetrics; Sword and Shield Enterprise Security, Inc.; and Verizon Enterprise Solutions (also known as CyberTrust).
Here is my beef with that list. The one company (to remain un-named for fear of a lawsuit..but we all know who it is)..that has had 7 or so of the largest credit card breaches in history as it’s clients is not listed. 3 of the companies are ‘newbys’ and 3 are very well known and respected companies. They should have asked for “Chris’ list” 😉
After reading the order it is clear the FTC has done their homework and knows the answers they expect to get. This is not simply smoke and mirrors. They are asking questions related to:
- The bidding process for QSA work
- Cost structure of PCI assessment work
- Time associated with the average assessment
- number of companies found ‘non compliant’
- Whether a company is found ‘compliant’ BEFORE completing all work.
- Sampling methodology (this is a gotcha because the required methodology is outlined in the training)
They are then asking for a sample ROC to be provided. I cannot applaud the FTC enough for taking this step. It is well past time that we get the “pay and stamp” providers out of the industry! Read the Order Here!
EMV- CHIP & Choice..not Chip & PIN…Start Moving! March 23, 2015Posted by Chris Mark in Uncategorized.
Tags: Chip & PIN, Chris Mark, data breach, EMV, EMVCO, fraud, Liability Shift, mastercard, PCI, visa
add a comment
After deviating from my ‘security’ theme, I am back to talk about InfoSec. Last week I had the opportunity to attend Visa Accredited EMV Consultant Training at Visa’s Headquarters in Foster City, CA. As always, Visa put on a top tier program with numerous experts in Payment Card ‘chip’ technology. Since the topic was EMV most of the experts were from Across the Pond. Thanks to Mark, Chris and the others for great training!
For those who are new, EMV or “Europay, MasterCard, Visa” is a technology where a microprocessor ‘chip’ is embedded in a payment card (credit card, debit card, etc.). It is often erroneously referred too as “Chip & PIN” but EMV really only applies to the Chip technology. If a region or issuer wants to prefer PIN, they are able. Visa has a “Chip and Choice” model where they allow Chip with signature, no signature, or PIN depending upon the issuer, the risk and type of transaction (ie. Debit for Cash or ATM require a PIN). There was too much information over 2 days to talk about in this post but there was one point I learned and wanted to pass on..
In October 2015, Visa is offering a ‘liability shift’ for merchants who adopt EMV. My belief (it was wrong) until I attended the training was that the EMV liability shift only affected those merchants who 1) accepted a ‘chip’ card and on ‘chip’ transactions. These are known as ‘chip on chip’. It is critical that Merchants understand that the liability shift occurs for merchants who accept transacitons over a dual interface terminal (Chip and NFC) who accept transactions of ANY form. As an example, if you accept 99% mag stripe transactions but you have dual interface terminals…the fraudulent transacion due to counterfeit have liability shifted to the issuer! It does NOT have to be a Chip on Chip transaction.
The Second important point to remember is that Visa is offering a Technology Incentive Program (TIP) that states if a Level 1 Merchant accepts 75% of transactions over a Dual Interface terminal, they do not have to validate compliance with an onsite assessment. There are some caveats to this so make sure you read the rules!
To get ready for implementation, ensure you download the Visa Merchant Readiness Acceptance Guide here.
Chris Mark in May 2014 TransactionWorld Magazine May 4, 2014Posted by Chris Mark in Uncategorized.
Tags: AT&T, Breach, Chris Mark, Data, data compromise, information, mastercard, PCI, Practice Director, QSA, security, visa
add a comment
You can Chris Mark’s (my) latest article in May, 2014’s edition of TransactionWorld Magazine. Titled “5 Common Security Practices that Put You At Risk” This particular article is about how common errors companies make in security and compliance and how to reduce the risk of compromise. By now we all recognize that 100% security can never be achieved. By following well established security practices you can can minimize the risk to which your organization is exposed.
Chris Mark in Jan 2013 TransactionWorld: “Only Certainies are Death, Taxes, and PCI DSS.” January 2, 2013Posted by Chris Mark in Uncategorized.
Tags: Chris Mark, data breach, Heather Mark, InfoSec, mastercard, PCI DSS, security, transactionworld, TSYS, visa
add a comment
Chris Mark (this guy with two thumbs) is in the January 2013 edition of TransactionWorld Magazine. You can read my article titled: “In 2013 the only certainties are Death, Taxes, and the PCI DSS” in which I opine about the need for PCI DSS and other security standards as we enter 2013. The bio on the article is not accurate and still references an old position I had at ProPay. That being said, ProPay is a great company for which I was fortunate and proud to have worked, a company at which my illustrious wife, Dr. Heather Mark still works, and a company who deserve a big Congrats for being acquired by TSYS!..all in all…no harm, no foul.
Chris in October 2012 Issue of PenTest Magazine October 30, 2012Posted by Chris Mark in Uncategorized.
Tags: Chris Mark, credit card, mark consulting group, mastercard, PCI, PCI DSS, penetration testing, pentest, security, visa
add a comment
Check out the October 2012 issue of PenTest Magazine for tons of valuable information on the PCI DSS and how Pen Testing can be used to support compliance and validation. I have an article in the magazine titled: “Introduction to PCI DSS for the PenTester” You need to register as a user or subscribe to access the articles.