Mike, I completely agree with your analysis and especially “Why is the cost so high?” You hit it on the head.

As I’ve preached over and over, there are two realities of PCI: your costs of card acceptance will go up, and you will change the way your do business. It is this last part that we often forget. PCI is not about which firewall or who needs background checks. It is about re-thinking your business processes and minimizing scope (ruthlessly).

Asking the right questions and re-thinking processes can go a long way to minimizing scope. PCI can be a great opportunity to reduce risk to the organization by just asking “why are we doing this the same old way?”

I agree with your point, but I think you are overly broad in your opinion:

“If security people drive the audit they will secure the hell out of a bad business process.”

I think that comment is really directed towards primarily technical people, engineers even, who are asked to make things secure without control of the business. You could say the same thing about someone asked to protect passengers in a car that may or may not drive over a bridge.

There are in fact security people who can understand business, and vice versa, and some are even allowed to drive.

[...] Dahn has written an interesting log on the Cost of PCI compliance I think the more interesting question is, “Why is the cost of compliance so high?” The answer [...]

Mike,
I have to agree - and disagree.
You’re right about the huge variance in that industry estimate - but there is still value to be found… $2B might be a big, scary number - personally, I think that’s optimistic - but what do we see in the losses attributed to breaches, information lost & reputational damage across the industry? Given the opportunity, TJX would gladly write a check for $2B just to avoid everything they’ve been through. $2B to clean up everyone’s exposures would be an absolute bargain!

You’re dead on in your tactical approach to reducing scope - but what many miss is the business value to just that - and the resulting strategic benefit. Process review & refresh is desperately needed by many organizations - and just that exercise alone will return significant value…to what is typically an organizational blind spot. Almost an afterthought that it will save significant effort and $$ in achieving a safe, secure technology environment in which a business can flourish.

If merchants and everyone else involved were to truly understand that - and then apply that “think globally, act locally” mentality, I think the fear of the cost would be replaced by anticipation of the benefits & rewards. If people - especially those with CxO’s behind their names - start to view PCI compliance as the ‘mandatory risk education & insurance’ that it is, opinions, perspectives & horizons will change.

We’ve all heard it before - but just to keep things in perspective…
If you think education is expensive, try ignorance.

Bob, very well said. I like your idea that “the fear of the cost would be replaced by anticipation of the benefits & rewards” and “If you think education is expensive, try ignorance.”

Companies and processes rarely run as efficiently as they can in all areas. It’s just not worth it to do so. But when it comes to privacy and protecting customer and corporate data it really is more about business process improvement than security, which should be seen as the gears that make a good process work well and reliably.

You might want to also check out the US Chamber of Commerce study called the Cost of SOX 404

http://www.uschamber.com/publications/reports/0711soxsurvey.htm

Being the cynic I am, the cost of PCI is high as a high number of QSAs are promoting expensive security solutions into customers on the back of audits in order to make a quick buck on the side.
For example, one merchant I know was sold a key management system for $100,000 to manage the keys on a single instance of SQL. Why did they buy it? Because the QSA said it would solve their problems.
I think this calls for some delineation in the industry - QSAs shouldn’t be able to sell remediation solutions and also carry out the final audit - there is a complete conflict of interests.
Whilst overall security posture is increasing, there are too many consultancy companies making money on the side whilst the PCI SSC turn a blind eye!
Us QSAs are getting a bad name…

It is my understanding that if the QSA did not propose alternative solutions that would not line their pockets, then they are in breach of their QSA agreement and can, if egregious enough, be dis-qualified from being a QSA. This would take a client reporting them, and likely at least a few instances, but at some point it could happen.

When a QSA finishes an assignment, it is my understanding they are to furnish a QA response form that the merchant sends to the PCI SSC. If you don’t get that or if the QSA forgets, you can download it here: https://www.pcisecuritystandards.org/docs/qsa_feedback_form_-_client.doc

I understand the SSC is moving on a QA program for QSAs (if that’s not too many initials…). They can’t do anything unless they hear about it.