Corporate America has been battered by ineffective information security for a long time, with untold billions of dollars in collective losses through the years. Sites that tracked defaced Web pages stopped listing them when they become too numerous to enumerate. Similarly, data breaches are now so common that even large breaches barely make the news.

To the rescue comes PCI-DSS -- perhaps the most effective security standard created to date. PCI is a welcome and timely standard, beneficial to consumers and merchants. Yet far too many people have derided PCI rather than defending it, pointing to a few of its shortcomings instead of focusing on its many benefits. Rather than embracing PCI as a catalyst for security change, people are caught in an information security version of Stockholm syndrome and long for the good old days before standards and regulations.

Stockholm syndrome, for those who have forgotten the 1970s (or aren't Blink-182 fans), is a psychological response sometimes seen in an abducted hostage, in which the hostage shows signs of loyalty to the hostage-taker, regardless of the danger in which the hostage has been placed. Stockholm syndrome is also sometimes discussed in reference to other situations with similar dynamics, such as battered person syndrome, rape cases, child abuse cases and bride kidnapping.

People point to the Hannaford Bros. breach and say, Aha! PCI does not work. Even David Hogan, CIO of the National Retail Federation, has missed the point. In a letter to Bob Russo, president of the PCI Security Standards Council, Hogan wrote that "PCI, which has been in existence in one form or another for several years, was supposed to prevent such crimes. It is a valiant attempt to prevent large stockpiles of credit card data from getting into the wrong hands. However, it is unlikely PCI will ever be able to keep pace with the continually evolving sophistication of the professional hacker, or anticipate every possible variation of future attacks."

Hogan's mistake is in thinking that PCI could somehow prevent every data breach. PCI can't prevent every data breach, just as laws against cocaine are powerless to prevent the import of every kilo of cocaine. Even so, it does not mean that these laws should be abandoned.

For more enterprise computing news, visit Computerworld. Story copyright Computerworld, Inc.

Whitepapers

• Gene Kim's Practical Steps to Mitigate Virtualization Security Risks
• Selecting Effective Virtual Directories
• A Modern Approach to On-Demand Email and Data Security
• Best Practices for HP Servers and HP Enterprise Virtual Array in a Microsoft Exchange
• Compliance, Protection, Recovery: A Layered Approach to Laptop Security
• Endpoint Security: Data Protection for IT, Freedom for Laptop Users

View more SECURITY whitepapers

Webcasts

• Key Considerations for a Successful 802.11n Deployment
• Solutions to the Toughest IT Challenges in Remote Offices
• Lowering the Cost of Email Archives
• High Availability for SQL Server 2005 Using Array-Based Replication and Host-Based Mirroring Technologies
• Technical Overview of Exchange Server 2007 with HP Servers and Storage
• Bringing Order and Security to your Mobile Workforce: Corporate Mobility Policy and Device Management On-Demand

View more SECURITY webcasts

Special Reports

• The Evolution of Network Security
• Taking Virtualization Up a Notch
• Learn how to Keep your Mobile Workforce Connected
• The self-managed network

View more SECURITY special reports