Jaikumar Vijayan reports:
[…]
The [Heartland] intrusion led to the “stark realization that passing a PCI security audit does not make a company secure,” said Avivah Litan, an analyst at research firm Gartner Inc. “This was known well before the breach, but Heartland served as a big pail of ice water thrown on the face of companies complying with PCI,” she said.
The intrusion highlighted “very clearly and with no uncertain doubt” that companies needed to worry about securing their systems first rather than complying with PCI standards, Litan said. The Heartland breach showed that it was worth it for companies to go beyond the requirements of the PCI standard by implementing technologies such as end-to-end encryption for protecting cardholder data, she added.
The Heartland incident showed that compliance with standards such as PCI is meaningless unless there is a way of monitoring that compliance on a continuous basis, said Philip Lieberman, CEO of Lieberman Software Corp., a Los Angeles-based vendor of identity management products.
“There is nothing wrong with PCI. It is a good standard,” Lieberman said. “But it also has a fundamental flaw.” PCI compliance, he said, is a “point-in-time” certification of a company’s readiness to handle security threats. However, there is no continuous process for monitoring compliance built into the PCI standard, he said. As a result, there is no way of knowing if a company that was certified as being compliant one day is still maintaining that compliance the next day.
Read more on Computerworld.