This is an article from March of this year that was published in RIS news. I realize it’s a little old, but I just stumbled across it…

PCI May Never Stop Hackers: Time to Rethink Security | News | RIS News: Business/Technology Insights for Retail, Supermarket Executives.

This article, in my opinion is both good and bad - first of all, it points out that PCI is not the end-all-be-all for security.

That’s good - it’s important for retailers to understand that PCI is just a ’snap-shot in time’ check on credit-card relevant security. It isn’t a ‘complete’ security certification and doesn’t cover absolutely everything that a retail organization needs to worry about regarding its environment.

This is really important - just because you are were PCI-compliant at the time of your last scan, doesn’t mean that you are compliant now and it doesn’t mean that your environment isn’t vulnerable in some manner outside the scope of PCI.

The way that this article is not so good (at least in my opinion) - the quote from the NRF exec - ‘Hannaford was PCI compliant at the time of the data breach. The bottom line is that this retailer did all it could to protect its customers.’

Since the breach, Hannaford is investing in what is termed ‘military grade’ security. That means that it hadn’t done ‘all it could do to protect its customers.’ I’m not blaming Hannaford for not investing in a level of technology that was seemingly uncalled for, I’m just saying that the NRF executive positioning a PCI-compliant stamp as the final word in security isn’t really accurate.

I realize that its NRF’s job to support and position for retailers and the real message of this article is the idea of ‘misplaced’ liability and exposure - if Hannaford was PCI-compliant and they were breached, how can VISA and MC and the courts hold Hannaford responsible for the situation?

Truthfully, I don’t know what to think about that part of it - they did what was asked of them and it didn’t work, so who should hold the bag? I really need to dig into this more deeply and also the entire Hannaford situation - I’ve spoken to Bill Homa a few times over the years and he’s a very, very intelligent CIO. I want to understand better what constituted ‘PCI-compliance’ and how that was scanned/determined - and how it was presented to Hannaford - was it presented as a complete security scan or what…