Society of Payment Security Professionals - Payment Security Blog

Week in review

I like to hear comments like those from Mike Rothman about PCI:

So what’s the bottom line? Basically, there is nothing required in the PCI DSS that is overly onerous. Any organization that has been taking security seriously for the past few years should be in pretty good shape. A well-run security program will put a corporation in a strong position to be compliant with most regulations, including PCI DSS.

Thus, I don’t think the PCI DSS requirements should be loosened. Maybe the timeframes could be extended a bit, but just because it’s hard, doesn’t mean it shouldn’t be done.

Here’s a good note about Kiosk security with relation to PCI.

If you live or work in California, don’t forget bill AB 779:

Earlier this month, California bill AB 779 was passed near-unanimously in both the State Senate and State Assembly, and it now sits on the Governator’s desk, awaiting the prodigious force of his personal stamp of approval.

At the center of the bill is a requirement that would force retailers like TJX Companies to reimburse banks and credit unions for any expenses those firms are forced to endure as a result of a data breach — namely for re-issuing credit and debit cards to those customers whose accounts have been exposed. Sounds fair enough, and other states are again expected to follow suit.

There is also an article about an application for mobile phones that enables proximity payments.  I’m happy to see companies all around the world adopting the payment application security practices.