One for Ken Belva
I mentioned Ken Belva's thoughts in Thoughts on Virtual Trust last year. If you don't know Ken's thoughts on "virtual trust" please read that post before continuing further. I refrained from pointing a finger at Ken's Apple DRM example after Steve Jobs posted his Thoughts on Music, where DRM won't apply to Apple music (thereby depriving Ken of one of his case studies and questioning his logic).
Now I'd really like an answer to this article: Retailers Fuming Over Card Data Security Rules; Claim PCI standard shifts burden to them, could alienate customers. Here are a few excerpts:
Several retailers last week bristled at having to comply with the Payment Card Industry (PCI) Data Security Standard, complaining that they carry an unfair burden in securing credit card data.
In interviews and speeches at the annual ERIexchange conference here, retail executives also complained that implementing the PCI standard is costly and could alienate customers...
Robert Fort, director of IT at Virgin Entertainment Group Inc. in Los Angeles... contended that meeting the requirements doesn’t boost a retailer’s bottom line. “There’s no direct return on investment,” he said. “It will not help us sell CDs.” (emphasis added)
Ken -- what do you think about that? I would respond to the vendor by saying customers who can't trust vendors won't give the vendor their business. I might also use an argument that says vendors could be held liable for negligence. Those are two thoughts.
Now I'd really like an answer to this article: Retailers Fuming Over Card Data Security Rules; Claim PCI standard shifts burden to them, could alienate customers. Here are a few excerpts:
Several retailers last week bristled at having to comply with the Payment Card Industry (PCI) Data Security Standard, complaining that they carry an unfair burden in securing credit card data.
In interviews and speeches at the annual ERIexchange conference here, retail executives also complained that implementing the PCI standard is costly and could alienate customers...
Robert Fort, director of IT at Virgin Entertainment Group Inc. in Los Angeles... contended that meeting the requirements doesn’t boost a retailer’s bottom line. “There’s no direct return on investment,” he said. “It will not help us sell CDs.” (emphasis added)
Ken -- what do you think about that? I would respond to the vendor by saying customers who can't trust vendors won't give the vendor their business. I might also use an argument that says vendors could be held liable for negligence. Those are two thoughts.
Comments
I don't think customers care. Take a look at TJMax. Since their "incident" revenue went UP, not down. It's disturbing, but true.
Click here is my reply.
http://www.bloginfosec.com/2007/06/13/my-reply-to-bejtlich-on-drm-and-pci-requirements/
Sincerely,
Kenneth F. Belva
http://www.bloginfosec.com
Anyway, Richard whenever you want to come over to the VT side, we welcome you with open arms.
KB
http://www.bloginfosec.com
Why, sure...there are several reasons for this...
First, many aren't aware. Yes, I know...hard to believe...but I have talked to folks who had no idea.
Many don't care.
Another view is that now that there is significant scrutney on TJX, from here on out it's safe...right?
So...what do you do?
Harlan
I know what most of you are thinking...you should have been protecting our data in the first place! But consider this...many retailers have very little concern for this. They get their business started at minimal initial startup cost; when they start making money, they realize that they can do so without significant investments in security.
Take a close look at what it takes to be PCI compliant sometime. How tough is it when the POS devices (and software) themselves aren't being designed and built to be PCI compliant?
I would respond to the vendor by saying customers who can't trust vendors won't give the vendor their business.
That statement is too general, Richard, and we've already seen that it's not the case with one large retailer.
Helpful blog!
Cheers..:-)