Critical.
Authoritative.
Strategic.
Subscribe to CIO Magazine »

Former CIO urges enterprises towards PCI compliance

Australian organisations still struggling, says IP Payments' Mark Lewis

Australian banks may have been working through their own Payment Card Industry Data Security Standard (PCI DSS) compliance issues, but that won’t stop them from fining business merchants from failing to meet the terms of the security initiative, according to an industry specialist.

PCI DSS was created by Visa, MasterCard and other major credit card brands and is administered by the PCI Security Standards Council.

All companies that accept payment cards are required to implement the 12 high-level security controls prescribed by the standard in order to help mitigate credit card fraud. Larger companies face significantly tougher compliance requirements than smaller firms.

Level 1 merchants — companies that process more than six million credit card transactions a year — must engage a qualified security assessor.

Mark Lewis, the Australia New Zealand director for payment solutions company, IP Payments, said some local banks were still working towards the standard.

"One of the key reasons is that some of the banks will send out credit card numbers in full on statements to card holders and that in itself does not comply with one of the controls set out by the PCI Security Council," he said.

According to Lewis, a few banks have struggled with legacy applications and platforms, although he admitted he did not know how far the affected banks were from compliance.

On the enterprise front, he said recent data breaches in Australia had resulted in greater awareness of PCI standards. In February 2011, cosmetics company Lush was forced to shut down its website following attacks by hackers. At the time, the company advised customers to cancel their credit cards. Lewis, a former chief information officer at UK-based card payments company, Cosmos, said local CIOs and CFOs were not completely up to speed with compliance.

"It's a big challenge because some CIOs need to become familiar with the meaning of PCI, the ongoing costs and the ramifications of acquiring those skills inhouse versus bringing in an external provider to run compliance as a managed service," he said.

Many organisations Lewis works with are in the process of analysing their internal environments to understand where credit card data is kept and how it could be properly secured.

"The banks are becoming much more diligent in enforcing the standards and announcing that the deadlines for compliance have passed," he said.

"Therefore, any fines that are the result of a breach will be handed down to these organisations."

The compliance deadline passed more than 12 months ago.

"I don't know of fines that have been issued but the banks have outlined that it will happen," Lewis said.

Look to smartphones in the future

In future banks and merchants will need to look at near field communications (NFC) technology where consumers will use smartphones pay for goods and services.

Similar wireless communications were trialled locally between ANZ and Visa during March.

"I believe the iPhone 5 will contain a chip which will allow the phone to be swiped at point of sale terminals. Once the customer base has that device in its hands, I think it will be adopted very quickly," he said.

"At the end of the day it appears to be a very convenient mechanism to pay."

Follow Hamish Barwick on Twitter: @HamishBarwick

Follow CIO Australia on Twitter: @CIO_Australia

Related Articles

  1. PCI compliance services in Australia

  2. What is PCI compliance?

  3. CMO interview: Becoming a change agent

    CMO

Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.

More about: ANZ, NFC, Visa
References show all
Comments are now closed.
Related Coverage
Related Whitepapers
Latest Stories
Community Comments
Tags: PCI compliance regulation, PCI compliance, Mark Lewis, enterprise, IP Payments, banks
Latest Blog Posts
Whitepapers
  • Android Malware Exposed
    Take an in-depth look at the evolution of android malware. The world of malware targeting the Android OS is similar yet very different from malware affecting Windows. Explore the rapidly evolving world of android malware and shed light on the various techniques used to exploit devices using this OS.
    Learn more »
  • Maximising productivity without sacrificing security
    Advances in mobility and client computing technology combined with the ubiquity of the Internet and social media are creating a culture and desire for constant connectivity and anywhere access to information. As these trends extend from the home into the work place, IT managers should consider seriously the opportunities for increased productivity and communication with customers and constituents, as well as understand the increased security risks posed by online, anytime access to private networks and data. Read more.
    Learn more »
  • Russian Underground 101
    This research paper intends to provide a brief summary of the cybercriminal underground and shed light on the basic types of hacker activity in Russia. It discusses fundamental concepts that Russian hackers follow and the information they share with their peers. It also examines prices charged for various types of services, along with how prevalent the given services are in advertisements. The primary features of each type of activity and examples of associated service offerings are discussed as well. Read this paper.
    Learn more »
All whitepapers
rhs_login_lockGet exclusive access to Invitation only events CIO, reports & analysis.
Recent comments