Experts call for regulation of PCI assessors

Payment card industry (PCI) assessors must be regulated if the system is to work, according to a panel of industry experts.

Bob Walder, chief scientist at NSS Labs, claimed that the PCI Data Security Standard (PDF) which sets out PCI compliance, could be ambiguous in certain areas, and that compliance assessors need to be well trained.

"These are the guys who charge quite a lot of money to look at a company's infrastructure and determine whether or not it is compliant with the DSS," he said during a panel discussion at NetEvents in Malta.

Walder warned that the wide range of choices meant that it could be "lucky" when a company uses an assessor who has a deep knowledge of network security and how it applies to PCI.

"If you are unlucky, the assessor is going to be doing little more than going through a checklist and saying 'OK you don't have a firewall, but I don't really have any further advice for you there' or 'You have this particular firewall but I'm not familiar with it, so I still can't tell you whether you're compliant or not,'" he said.

Alex Raistrick, director for Northern Europe at ConSentry Networks, believes that one way round the problem is to vet assessors to ensure that they are up to the job.

"If there is going to be a standard for PCI products, there needs to be a standard for assessors to show that the assessor is known to be successful and will get you compliant," he said.

Neil Hartsell, vice president of product marketing at Tipping Point, highlighted one of the problems that assessors face.

DSS tells companies what information they need to encrypt and that they need firewalls and antivirus, but it stops short of naming compliant products.

"It cannot go so far as to say 'This is the model of the product from vendor A that meets all those criteria' so there has to be some agency which makes that clear," Hartsell said.

"If you do not solve this problem, the assessor will never be anything more than a consultant."

See also:

Barracuda sinks teeth into NetContinuum

More consolidation in the security sphere  19 Sep 2007

PCI SSC takes on Pin Entry Device security

Council takes over from credit card companies  13 Sep 2007

UK business not meeting data protection deadlines

Board only paying lip service to IT staff  09 Aug 2007

Card industry deals out security standards

PCI SSC begins discussions  11 May 2007

Qualys and RSA tout card payment security

Firms hook up on Payment Card Industry Data Security Standard  24 Apr 2007

Credit card heist hits 45 million users

UK customers of TK Maxx told to check credit and debit card statements  30 Mar 2007

Like this story? Spread the news by clicking below:

 del.icio.us     Digg this     reddit!