One in ten retailers ignore antivirus software finds survey

**Glaswegian** · 09-25-2009, 01:55 PM

Organisations that take customer credit card details are confused about the security measures they are required to take and are putting customer data at risk, according to a new survey.

Consumers face a greater risk of losing control of their data when doing business with smaller retailers, as many haven't made investments to comply with the Payment Card Industry's Data Security Standard (PCI DSS), the research found.

The survey, which covered 560 organisations from round the world, asked respondents a variety of questions about their investments and deployment of technology to comply with PCI DSS, which was introduced in 2005. PCI DSS is an industry standard created by major credit card companies that's designed to protect customer payment data.

The survey found that 55 percent of organisations only secured credit card information but not other data such as Social Security and driver's license numbers or bank account details. Also, only 28 percent of smaller companies between 501 to 1,000 employees comply with PCI DSS. That compares with more than 70 percent of large merchants with 75,000 or more employees that claimed they're compliant.

"If you go the larger organisations to do business, you are more likely to be secure today," said Amichai Shulman, CTO for Imperva, which makes security software for businesses to comply with PCI DSS. Imperva commissioned the survey from Ponemon Institute, a company that conducts research into privacy and information security policy.

The prime reason that companies don't comply with PCI DSS is cost, Shulman said. "They don't go to the effort to be compliant because it's all or nothing, so they currently do nothing," Shulman said.

Larger companies find it somewhat easier to handle the costs, he said. On average, companies spend about 35 percent of their IT security budgets on PCI DSS compliance.

Payment card companies mandate compliance, and most merchants are supposed to be compliant by now, according to information on the PCI Security Standards Council's Web site.

http://news.techworld.com/security/3...urvey/?olo=rss

09-25-2009, 01:55 PM	#1 (permalink)
Glaswegian Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic Join Date: Sep 2005 Location: Glasgow Posts: 25,377 OS: Win XP Pro SP3 / Win 7 Pro My System Blog Entries: 10	One in ten retailers ignore antivirus software finds survey Organisations that take customer credit card details are confused about the security measures they are required to take and are putting customer data at risk, according to a new survey. Consumers face a greater risk of losing control of their data when doing business with smaller retailers, as many haven't made investments to comply with the Payment Card Industry's Data Security Standard (PCI DSS), the research found. The survey, which covered 560 organisations from round the world, asked respondents a variety of questions about their investments and deployment of technology to comply with PCI DSS, which was introduced in 2005. PCI DSS is an industry standard created by major credit card companies that's designed to protect customer payment data. The survey found that 55 percent of organisations only secured credit card information but not other data such as Social Security and driver's license numbers or bank account details. Also, only 28 percent of smaller companies between 501 to 1,000 employees comply with PCI DSS. That compares with more than 70 percent of large merchants with 75,000 or more employees that claimed they're compliant. "If you go the larger organisations to do business, you are more likely to be secure today," said Amichai Shulman, CTO for Imperva, which makes security software for businesses to comply with PCI DSS. Imperva commissioned the survey from Ponemon Institute, a company that conducts research into privacy and information security policy. The prime reason that companies don't comply with PCI DSS is cost, Shulman said. "They don't go to the effort to be compliant because it's all or nothing, so they currently do nothing," Shulman said. Larger companies find it somewhat easier to handle the costs, he said. On average, companies spend about 35 percent of their IT security budgets on PCI DSS compliance. Payment card companies mandate compliance, and most merchants are supposed to be compliant by now, according to information on the PCI Security Standards Council's Web site. http://news.techworld.com/security/3...urvey/?olo=rss __________________ Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. PC Safety & Security::PC running a bit slow?::Donate::Photographers Corner