{"id":1826,"date":"2012-03-08T00:00:00","date_gmt":"2012-03-08T00:00:00","guid":{"rendered":"http:\/\/otava.test\/pci-compliance-status-data-breaches\/"},"modified":"2012-03-08T00:00:00","modified_gmt":"2012-03-08T00:00:00","slug":"pci-compliance-status-data-breaches","status":"publish","type":"post","link":"https:\/\/www.otava.com\/blog\/pci-compliance-status-data-breaches\/","title":{"rendered":"PCI Compliance Status & Data Breaches"},"content":{"rendered":"

Only 21 percent of organizations were found to be fully PCI compliant <\/a>during their first assessment of attestation in the Verizon 2011 Payment Card Industry Compliance Report, showing only a 1 percent increase since their 2010 report (statistics based on QSA assessments). Translating to a 79 percent fail percentage, the organizations, on average, only met 78 percent of the test procedures defined in the DSS (Data Security Standards).<\/p>\n

\"PCI<\/a>
PCI Compliance Status Breaches<\/figcaption><\/figure>\n

Challenges to Meeting Compliance<\/strong>
\nThe report lists a number challenges that serve as barriers to meeting full PCI compliance and the full set of requirements. Those challenges include:<\/p>\n\n\n\n\n\n
Trained Personnel<\/strong><\/td>\nFully staffed and expert IT departments can be difficult to find and maintain for ongoing compliance.<\/td>\n<\/tr>\n
Corporate Will<\/strong><\/td>\nThis refers to the inability of management or directors to recognize the importance of compliance – compliance is \u201cconsidered to be a drag on the economy by most businesses rather than an assumed part of the risk of doing business.\u201dWith this type of attitude, resources are often not allocated to meet compliance by implementing proper controls, policies and procedures.<\/td>\n<\/tr>\n
Complexity<\/strong><\/td>\nPCI requirements<\/a> are specific and lengthy – the Verizon report claims PCI has well over 200 requirements (while the 12 requirements are notorious, each one has multiple listed sub-requirements).The time and resources needed to address each requirement can be extensive.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

What were the most difficult requirements to achieve?<\/strong><\/p>\n

Only 37 percent of organizations met the PCI requirement #11 – regularly test security systems and processes, and 39 percent were able to maintain a policy that addresses information security, requirement #12.<\/p>\n

The most challenging sub-requirement, according to the report, was under #10 \u2013 tracking and monitoring. #10.5.5 requires organizations to use file-integrity monitoring<\/a> (FIM) or change detection software on logs to ensure that existing log data cannot be changed without generating alerts.<\/p>\n

The two requirements that were achieved by most organizations were #7 \u2013 restrict access to data by business need-to-know and #4 \u2013 encrypt<\/a> transmission of cardholder<\/a> data and sensitive information across public networks.<\/p>\n

Another approach to meeting PCI compliance includes reducing scope by meeting certain milestones and thus reducing potential risk to cardholder data. Eighty-eight of organizations met goal #1 \u2013 remove sensitive authentication data and limit data retention. Stored sensitive data can be a liability to any organization and decrease their ability to meet compliance requirements.<\/p>\n

What are the top causes of a PCI breach?<\/strong><\/p>\n

The report also details the top \u201cthreat actions,\u201d meaning the cause or action that contributed to PCI breach incidents. The top five are as follows:<\/p>\n