Stores Magazine - October 2007 - (Page 34) EXECUTIVE SUITE / COVER STORY TAKING A BITE OUT OF PCI COMPLIANCE I t was the fourth quarter of 2005 when Sean Smith got the call. A bank representative told him that by the following August, Steak n’ Shake would surpass the six million-transaction threshold, bumping the Indianapolis-based chain to Level 1 merchant status and requiring the company to become PCI DSS compliant — quick. The news caught Smith, director of strategic technology services at Steak n’ Shake, a bit off-guard. The company had only begun accepting credit cards a few years earlier; reaching Level 1 status so quickly just wasn’t on the radar screen. Still, he and his team promptly sunk their teeth into the project. As a publicly-traded company, Steak n’ Shake was already knee deep in Sarbanes-Oxley projects, and Smith saw an opportunity to leverage what they learned in the corporate environment and roll it out to the stores. With a fiscal year that begins in October, Smith was able to plan remediation into the company’s fiscal budget: then he began the task of identifying gaps in processes and technology. Steak n’ Shake implemented the QualysGuard PCI suite for the required quarterly vulnerability assessments. Altiris Total Management Suite was implemented to provide a means for patch management, centralized remote control, asset management and equipment lifecycle management. A McAfee total protection suite was put in place for end point security (anti-virus, anti-spyware, host intrusion protection and firewall services) and WebSense was already in place to minimize the possibilities of phishing and spyware getting into the company’s environment. “We pulled all of our web servers off the perimeter so the only functionality on the perimeter today is security devices,” Smith says. “By doing that, we assure that we minimize our exposure to Internet-borne threats. All of our business reporting systems require our users to be authenticated through a virtual private network prior to assessing any of their content — basically maintaining a layer of security around the organization.” There were various obstacles to overcome on the path to compliance, yet Smith insists that the technology piece was easy compared to juggling the changes it prompted among people and processes. “Processes work if people follow them, so your No. 1 gap associated with security today is keeping people educated as to what their roles and responsibilities are. For some, it’s really difficult to understand why they had access to data one day and the next we say it’s off limits. Getting people to understand that the changes are in the best interest of the company takes time and patience.” following the rules may keep you from getting fined, but expanding your company’s security beyond PCI is critical. PCI is really just an important first step.” How often does RBA revisit the security measures put in place as a result of PCI? “Unoffically, every day,” Gaggion says. “Officially, every quarter.” RBA is required to send its bank a scan report that checks system vulnerabilities. If vulnerability is “high” the retailer must fix the issue and perform a re-scan. The company is required to complete a self-assessment questionnaire at the end of each calendar year. Data disconnect ne of the concerns retailers have as they look ahead is the disconnect that exists between locking down data and applying more stringent controls related to data management, and a business trend that calls for using customer data to create more value. Merchants and IT professionals will need to walk a fine line between trying to cater to the shoppers’ desire for more personalized service – the very thing that differentiates one retailer from the next – and leaving any O Microsoft is encouraging retailers to view PCI as a business application that will yield business value doors to customer data open that could somehow be abused. Geoff Thomas, general manager of Microsoft’s U.S. Retail and Hospitality Group, insists it can be done and says that’s a perfect example of why Microsoft is encouraging retailers to view PCI as a business application that will yield business value. “Companies really need to take a long-term view,” Thomas says. “There is business benefit along the way. It’s an opportunity to get systems and infrastructure in place that will set them up to deploy some services and capabilities that they’re not able to do today. It will help with business agility, and it can help them to lower total cost of ownership.” Microsoft and others – including a cadre of software, hardware, security and service providers – have their work cut out for them. Retailers believe data security standards are important and they want to protect customer data, but it looks as if they may need more time to get there, and more support from the card associations and banks when it comes to determining who will be the keeper of critical card data – and who will bear the risk and liability. December 31, when all Level 1 and Level 2 merchants must be compliant, marks the next deadline. StORES WWW.STORES.ORG 34 STORES / OCTOBER 2007 http://WWW.STORES.ORG
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.