Companies that handle credit and debit card data are increasingly complying with the payment industry’s security standards, but are less likely to maintain their security posture over time, according to a March 11 report from Verizon Enterprise Solutions.
In its 2015 PCI Compliance Report, Verizon found that companies typically met nearly 94 percent of the requirements of the Payment Card Industry’s Data Security Standard during an initial assessment conducted in 2014, up from 85 percent in 2013.
Yet, four out of five companies did not comply with all the necessary requirements to pass the initial PCI assessment. Moreover, after passing a previous assessment, more than 81 percent of companies failed their next compliance test.
“It is a mixed bag,” said Franklin Tallah, an executive consultant at Verizon Enterprise Solutions. “There are those companies that are ahead of the game, but for those in the lagging category, it should be a wake-up call.”
While the PCI Data Security Standard has often been criticized for emphasizing check boxes over security, many security professionals have recommended the standard as a starting point for any company aiming to harden their network against cyber-attacks.
Last year, driven by companies’ lack of security awareness, slow detection of attacks and threats, and the lack of consistency in assessments, the PCI Security Standards Council rolled out Version 3 of the standards.
In its report, Verizon found that, in 2014, more companies had complied with almost all 12 main PCI requirements, with the exception of the requirement to regularly conduct security scans and mitigate security issues. Only 33 percent of companies complied with those requirements in their initial assessment, down from 40 percent in 2013.
Verizon, which performs both PCI assessment as a qualified standard assessor (QSA) and post-breach investigations, has never encountered a compromised company that was compliant with PCI DSS at the time of the breach, the company stated in the report.
“The companies that we visited post-breach as a [PCI forensics investigator] were significantly less … compliant than our control group of QSA customers,” Verizon stated. “Not only were breached companies less likely to be found compliant overall, they were also less likely to be compliant with 10 out of the 12 requirements individually.”
In particular, companies suffering a compromise never met the requirements for maintaining secure development practices, identifying vulnerabilities, tracking access to networks and analyzing log files.
The benefits of the PCI standard depend on the approach that a company takes to implementing the requirements, Verizon’s Tallah said. Companies that put a great deal of emphasis on finding the systems and software that handle payment card data and securing those systems will be far more likely to remain compliant with the standards. However, it is not an easy task, he said.
“We find that many organizations underappreciate the level of effort,” Tallah said. “We are recommending that people educate themselves and understand that it is a complex project.”