One for Ken Belva

I mentioned Ken Belva's thoughts in Thoughts on Virtual Trust last year. If you don't know Ken's thoughts on "virtual trust" please read that post before continuing further. I refrained from pointing a finger at Ken's Apple DRM example after Steve Jobs posted his Thoughts on Music, where DRM won't apply to Apple music (thereby depriving Ken of one of his case studies and questioning his logic).

Now I'd really like an answer to this article: Retailers Fuming Over Card Data Security Rules; Claim PCI standard shifts burden to them, could alienate customers. Here are a few excerpts:

Several retailers last week bristled at having to comply with the Payment Card Industry (PCI) Data Security Standard, complaining that they carry an unfair burden in securing credit card data.

In interviews and speeches at the annual ERIexchange conference here, retail executives also complained that implementing the PCI standard is costly and could alienate customers...

Robert Fort, director of IT at Virgin Entertainment Group Inc. in Los Angeles... contended that meeting the requirements doesn’t boost a retailer’s bottom line. “There’s no direct return on investment,” he said. “It will not help us sell CDs.”
(emphasis added)

Ken -- what do you think about that? I would respond to the vendor by saying customers who can't trust vendors won't give the vendor their business. I might also use an argument that says vendors could be held liable for negligence. Those are two thoughts.

Comments

John Ward said…
While we know about your Patrick Swayze fantasies... do you always have to plug Dirty Dancing and Road House? ;)
Anonymous said…
Richard,

I don't think customers care. Take a look at TJMax. Since their "incident" revenue went UP, not down. It's disturbing, but true.
Unknown said…
The whole TJX thing is an important milestone for us, and may not necessarily be a good one. TJX continues business and people still shop there despite the breach? What does this say about people's feelings on risk, or perhaps about how much they blame TJX? Or even have the information to know what it all means to them anyway?
Unknown said…
I'm not quite sure that TJX is the best example.Jim
Anonymous said…
Hi Richard,

Click here is my reply.
http://www.bloginfosec.com/2007/06/13/my-reply-to-bejtlich-on-drm-and-pci-requirements/

Sincerely,
Kenneth F. Belva
http://www.bloginfosec.com
Anonymous said…
It looks like there is a glitch with the a href tags.

Anyway, Richard whenever you want to come over to the VT side, we welcome you with open arms.

KB
http://www.bloginfosec.com
H. Carvey said…
TJX continues business and people still shop there despite the breach?

Why, sure...there are several reasons for this...

First, many aren't aware. Yes, I know...hard to believe...but I have talked to folks who had no idea.

Many don't care.

Another view is that now that there is significant scrutney on TJX, from here on out it's safe...right?

So...what do you do?

Harlan
H. Carvey said…
retail executives also complained that implementing the PCI standard is costly and could alienate customers..

I know what most of you are thinking...you should have been protecting our data in the first place! But consider this...many retailers have very little concern for this. They get their business started at minimal initial startup cost; when they start making money, they realize that they can do so without significant investments in security.

Take a close look at what it takes to be PCI compliant sometime. How tough is it when the POS devices (and software) themselves aren't being designed and built to be PCI compliant?

I would respond to the vendor by saying customers who can't trust vendors won't give the vendor their business.

That statement is too general, Richard, and we've already seen that it's not the case with one large retailer.
Anonymous said…
This comment has been removed by a blog administrator.
pci dss said…
I've just came across to your blog.
Helpful blog!
Cheers..:-)

Popular posts from this blog

Zeek in Action Videos

New Book! The Best of TaoSecurity Blog, Volume 4

MITRE ATT&CK Tactics Are Not Tactics