Is PCI to Blame for TJX? - Twenty-Four Seven Security

« Will IBM Transform Security? | Main | Podcast with IBM on Their End-to-End Security Solution »

November 05, 2007
Is PCI to Blame for TJX?

As more and more companies scramble to comply with PCI, I think a good question to ask right now is, exactly how compliant was TJX before their massive data breach? Or, to put it another way, What's the point of struggling to get PCI compliant if it's simply going to result in another data breach like TJX?

According to Search Security, some recent disclosures from TJX court documents actually show that the retail giant FAILED 9 out of the 12 PCI DSS requirements covering encryption, access controls, and firewalls. Penalties for failing to comply can add up to as much as $500,000 and also include increased auditing requirements along with losing the ability to process credit cards altogether.

So should PCI be weakened in order to make it easier for companies to comply? "Looking at the 12 requirements [of PCI DSS], I have to wonder how could you make them any more lax than they are," said Keith Gosselin, IT officer for Biddeford Savings Bank in Maine. "These are the simplest of best practices. As a CIO, CEO or CFO, why would you not want your company to meet these requirements?"

Some companies have actually started pushing back, saying that PCI is simply too strict. "Companies have gotten over the scare from Enron and WorldCom and are starting to push back on these regulations and say 'hey, this is costing us too much money,'" he said. "You look at PCI DSS and there is nothing illogical about what's required. But if a company can get the rules lessened, that's what they're going to try and do."

The question is, though, once TJX was found to be in violation of 9 of the PCI rules, how come those problems weren't immediatly fixed? Very simply because of lax auditing. Apparently, TJX passed a PCI DSS check-up, but some key problems were either missed or totally overlooked. "They had no network monitoring and no logs, and they had unencrypted data," an auditor who asked not to be identified said. "But this wasn't picked up by the auditor. They passed the Level 1 inspection and shouldn't have."

It also bears mentioning that TJX's problems go much deeper than simple PCI compliance, as TJX should also be used as a textbook case study in how not use wireless networks.

So what's to be learned: Ignoring PCI and accepted best practices for protecting credit card data is like ignoring the dentist for a bad tooth...it only gets worse.