IT Professionals Confused by Credit Card Data Security Requirements (News Release)   - 1,408 Views,

Despite the emphasis these regulations place on data security, 41% of respondents said their companies are spending 10% or less of IT security budgets on data and database security. Not surprisingly, 87% of respondents believed that internal misuse of sensitive data was the biggest threat to their companies, based on current security solutions in place.

“This data demonstrates why we’re seeing headlines about data thefts,” said Gordon Rapkin, CEO of Protegrity. “Many companies are confused about the requirements themselves. Others are overwhelmed by the prospect of putting together a cohesive strategy that encompasses the entire enterprise. And a few are still thinking ‘it will never happen to us.’ But to consumers and shareholders, no excuse is good enough when it comes to data security.” Rapkin pointed out that despite the publicized data thefts occurring during the spring and early summer, the level of investment in securing sensitive data remains very low. In a poll conducted by Protegrity in March 2005, only 7% of respondents said their companies had actually made investments in data and database security.

The 12 requirements of the PCI Standard, adopted by Visa and MasterCard, as well as other major credit card companies, range from encrypting transmission of cardholder data and sensitive information across public networks to restricting physical access to cardholder data to maintaining a security policy that addresses data security. By not complying with these requirements, companies risk hefty fines as well as the revocation of rights to handle credit card transactions. Additionally, state laws such as California’s SB1386 require companies to report to consumers any breach in data security when sensitive data is not encrypted.

“Public companies disclosing data thefts report revenue losses in the millions and even bigger losses in market capitalization,” said Rapkin. “It’s unconscionable that these incidents continue to happen. Data must be secured at every step - from the moment the credit card is swiped until all records of the transaction have been deleted. Any organization in this chain is obligated to protect the credit card number and other private data. Consumers should never have to worry about the security of their personal data.”

For a copy of Protegrity’s most recent data security survey, send an email request to info@protegrity.com..