Network Solutions Breach Revives PCI Debate
If Firms are PCI Compliant, Why are They Getting Breached?
August 10, 2009 - Linda McGlasson, Managing Editor
The recent data breach at Internet domain administrator and host Network Solutions compromised more than 573,000 credit and debit cardholders and begs the question: What more can be done to secure such systems? The incident also raises new questions about the Payment Card Industry Data Security Standard (PCI).
At the time of the breach, discovered in June, Network Solutions says it was PCI compliant. The breach was the result of hackers planting rogue code on the company's web servers, intercepting financial transactions between the sites and their customers, which are mostly small online stores.
So, if Network Solutions was PCI compliant, how could it be breached? Paul Kocher, chief research scientist at Cryptography Research Institute, says the fundamental limitation with PCI is that it attempts to distill security down into a static set of requirements, while adversaries aren't restricted to a rigidly-defined set of methods. "As a result, clever attackers will always find holes," he says. "PCI does provide some value by forcing merchants to put some effort into addressing the most common attacks, but the objective is to reduce total risk -- not stop all attacks."
Continue Reading at Bank Info Security
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_sSCs8wpKmAsBG291oP_3OzFCPc4QfFZP-5zTTuZu7prdRDdWy6hWlelcs_hazBrYayTTbV9I2O5dhW3Gwhp_OUhaUYgUX2A-pzi3DF_wKsxyHtKEUpGpmtDneQXIxxIUOMmMowYuutCFz92ltNcHUU=s0-d)
