I completely agree that many that Merchants are at risk due to their processors not properly educating them. I believe they are afraid of losing customer base if they “enforce” the PCI-DSS. Also, in another PCI related blog I read a report by Forrester Reasearch that indicated a “high end” breach cost of $305.00 total per record. I think these costs are vastly understated and here’s why:

The Business side always seems to be covered in calculations, but what I seldom if ever see in the research is the personal suffering, anguish and humiliation the employees and their families who will most likely be laid off or downsized post- breach. In many cases the loss of reputation, consumer confidence and ultimately loss of business in today’s tough economy is more than enough to be viewed as a lethal injection for that organization.

Although, there are many QSA Qualified Security Assessor organizations out there in the world some have been mentioned, In North America Datassurant Inc. is ideally suited and is a really good choice for this type of work because and keep highly trained security professionals (many of which are certified White Hat hackers) on staff. In South America Modulo would be an excellent choice.

What’s even more interesting, based on those numbers $100.00 vs. $90.00 it appears that Company A credit card records “street value” are more valuable to hackers then they are to Company A itself. This doesn’t seem to add up in my mind.

What keeps me up at night? I wonder how many more breaches consumers will need to endure and how many lives will be ruined, how much post-breach triage we will need to perform before the Government hears the people and steps in, much in the same way as SOX?

I think you raise a good point that merchants must be aware of what is expected of them, how they need to provide validation, and the necessity of a cognitive effort in assessing the business benefits/risks of accepting and processing credit cards. I strongly agree and encourage all businesses to evaluate they business processes and determine if outsourcing, insourcing, or finding a balance is ideal for their business.

I question, however, the (beyond moral and ethical conflicts) idea of shopping for institutions that do not enforce the standards. To clarify – if a business processes credit cards they need to be compliant – the SAQ, ASV, QSA, etc… are only means of validation. Regardless of the imperative and reasons to respond to these completely, there is a stronger concern – fraud (for the business and the liable consumers).

Other thoughts… counterpoints… areas where I may be misinterpreting?

James

Thanks!
http://www.surveymonkey.com/s.aspx?sm=o7Ht7e8ijWSuxAlqT2oJig_3d_3d