payments - Retail Systems

RS
38 RS June - July 2012
roundtable
AJ: In the education process is that listed as one of the areas
retailers should look at?
CP: Yes, but perhaps there hasn’t been enough emphasis on it.
When you look at the guidelines for PCI on the council website
it goes through the details, but I think it’s probably one of the
details that hasn’t been brought up sufficiently. If you’re talking
to a supplier who’s perhaps doing something internationally,
their data centre in Phoenix, Arizona, is compliant, but they
may have a data centre here in the UK that hasn’t gone through
compliance. So as a merchant you need to know which data
centre your data will be going to and whether or not it has been
assessed. That’s the beauty of the attestation. If you look at
Phoenix Networks and Semafone and the detail in which they’ve
been assessed, that’s how you know they’re the right partner
for you as a merchant.
CN: It’s probably worth saying that the level one, level two
service provider – level two is only processing up to 300,000
transactions a year. So do you really want to be putting your
business in the hands of a company that’s only dealing with
300,000 transactions a year? And they are the ones who are
allowed to self assess. You want to be dealing with level one
service providers; level two is just too much of a risk because
you’re just back to ticking boxes again.
AY: Fraudsters are very clever aren’t they? They know that
level one and level two have probably got it sorted and so they’ll
go for the weakest link. Recently Alan and I spoke to various
trade bodies, the retail motoring industry, the association of
convenience stores and several others. We found that now is the
time to get that message out there to the wider audience about
outsourcing and the importance of PCI, because that’s where
the breaches are going to take place.
MG: But only if we do it using language that they will
understand.
GT: And they probably need to understand what outsourcing
is because outsourcing isn’t like, take a call centre and give it
to somebody else. It’s like using a service that ensures you can
continue to use your own contact centre except you’re not
bringing any card data into your organisation. So we even need
to be clear about what we mean by outsourcing because it could
be totally misunderstood. Merchants might think they have to
outsource all their IT to a separate business because that’s how
they use the term within their own environments.
CP: I think that’s a very key point because when you look at solu-
tions that are available, a number of them bring the card data
into the environment; therefore you’re left with the expense
and worry of having to protect all that data. Whereas there are
other solutions where the data never comes into the environment.
And that’s key because if you’re looking at the cost of
compliance, especially as you go down the food chain, you have
to be conscious of the ongoing costs because it isn’t a one off
solution. Especially in the level one group that I chair, we talk
about the importance of establishing what level everyone is at.
Of the 35 merchants in my group there are five who have been
compliant since 2010/11 but at the meeting on 6 March almost
all of the rest of the group said they would be compliant by the
end of this year.
A SB: There is a perception out there that PCI compliance is a
very hard thing to achieve.
CP: And there’s a perception that it’s simply a one off job. But
it’s not, it’s continuous. That’s why outsourcing is so important;
it means retailers only have a limited amount to do. You never
get rid of the SAQ, there’s always an SAQ of some sort which
obliges you to be secure in the important areas.
GT: It’s very interesting looking at North America now because
the merchants started this journey so much earlier than us.
Most of them have already reached compliance and now they
have seen the business as usual costs they are much more keen
on the de-scoping issue. So it’s very easy for them to justify
taking that card data and removing it from their environment.
The challenge in this market is that PCI kicks off a whole load of
other projects, it kicks off a network project, a desktop project,
a CRM project, a telephony project. And everybody gets their
budget and goe on their journey without looking at the holistic
card journey. The problem with that is all those departments
have been wanting to buy a whole series of tools forever and
then PCI comes around and they think: ‘Hey, I’ve got a budget to
buy exactly what I wanted to. We should have invested in that
years ago, that’s good information security.’ And so everybody
goes and spends their budget on that instead of questioning
whether they really want card data in their environment.
CP: One of the key things to take away from this is that you
can manage without data. My experience with the Post Office
proves that. Retailers should be limiting the scope by keeping
card data and personal data in one particular area so it can
be easily protected. This is not about abdicating responsibility.
You can’t build a business case on protecting card data but we
should all be responsible for protecting personal data for our
customers. Anyone who has data has a responsibility.