PCI Compliance: What is it and why should I care?

PCI Compliance can be an intimidating topic for most business owners. I have found from my personal and professional experience that it really isn’t all that bad if you have the right tools, the right information and the right attitude.

With no shortage of widely publicized data breaches such as Target, TJ Maxx, Monster.com, Sony’s PlayStation Network, and even VeriSign (just to name a few), business owners must realize that they cannot afford to sit back and hope they never have a problem.

What is PCI?

The Payment Card Industry Data Security Standard (PCI DSS) is a set of requirements designed to ensure that ALL companies that process, store or transmit credit card information maintain a secure environment; essentially any merchant that has a Merchant ID (MID).

The Payment Card Industry Security Standards Council (PCI SSC) was launched in 2006 to manage the ongoing evolution of the Payment Card Industry (PCI) security standards with focus on improving payment account security throughout the transaction process.[1]  The PCI DSS is administered and managed by the PCI SSC (www.pcisecuritystandards.org), an independent body that was created by the major payment card brands (Visa, MasterCard, American Express, Discover and JCB). 
It is important to note, the payment brands and acquirers are responsible for enforcing compliance, not the PCI council.

PCI Compliance can be difficult, but it is worth it

Why should I care?

In an era of near exponential growth in technology, data security is an increasing concern for consumers. Compliance with PCI standards is a requirement, not a suggestion. Failure to comply with the standards can result in non-compliance fees, increased risk for variety of data breaches, and could potentially lead to the termination of a merchant account, preventing the merchant from accepting credit card payments from customers.

There are many options and levels required for validating compliance. Most acquiring banks have internal or partnered programs to assist merchants with this process and provide security consulting services for proactive and reactive measures.  Approved scanning vendors (ASV's) such as Trustwave, SecurityMetrics, and ControlScan (amongst hundreds of other providers) can provide approved services for validation for a fee. A complete list of ASV's can be found on the PCI SSC website.

The PCI SSC has released PCI DSS 3.0, which includes the latest rounds of security requirement updates will compel merchants to invest more money into security and play a larger role in helping ensure credit card information is processed securely. What should merchants do to prepare? Here are some helpful tips:

• Perform a risk assessment to understand the risk posed to your systems and data
• Verify you have the appropriate security controls in place to help secure your systems
• Install security controls that monitor your systems and alert you about any suspect activity
• Train your developers in the Open Web Application Security Project's (OWASP) secure coding principles
• Perform a penetration test on your website to identify vulnerabilities that may lead to a compromise
• Work with a Qualified Security Assessor (QSA) to understand what you need to do to become PCI compliant[2]

In the end, PCI compliance is about protecting both the consumer and the merchant from unauthorized access to private information. A small investment and a little work can go a long way to ensure that we provide a safe and secure shopping experience for all.

[1] https://www.pcisecuritystandards.org/organization_info/index.php

[2] http://www.ecommercebytes.com/cab/abn/y13/m11/i08/s04

Drowning in Big Data?

As the tools to monitor and measure every conceivable customer interaction, grow and grow at an exponential rate, the opportunities to actually utilize this data, by creating business intelligence from it, are met with an array of obstacles and challenges.  Big data poses numerous challenges and many firms are drowning in them...along with all their data.  

So what are the major issues with big data?  Storage, management, and analysis. “Big Data results in three basic challenges: storing, processing and managing it efficiently. Scale-out architectures have been developed to store large amounts of data and purpose-built appliances have improved the processing capability. The next frontier is learning how to manage Big Data throughout its entire lifecycle.” 1

The first problem is storage.  With such large volumes, companies are looking for alternatives to store all the data they collect.  Off-site data warehouses and scale-out architectures have been used and advanced to accommodate greater storage capability.  However, many firms jump past the first step of reducing redundant data.  As multiple departments use, process, and add to data, redundancies occur at an alarming rate.  The first step to managing large data is to reduce it down to its unique set, for easier storage.  “Data redundancy is costly to address as it requires additional storage, synchronization between databases, and design work to align the information represented by different presentation of the same data.”2

Next to better manage this unique set of data, firms should explore virtualization technology and applications.  Virtualization will allow multiple users and interfaces to access and reuse the same data, which is stored on one independent device.  What exactly is virtualization? “Virtualization, in computing, is the creation of a virtual (rather than actual) version of something, such as a hardware platform, operating system (OS), storage device, or network resources” 3.  Virtualization allows for multiple users and devices to add to or modify one existing database, thus minimizing the challenges and costs created by unnecessary data redundancy. This will result it better management going forward, to ensure the unique data set stays at a manageable, and useful size.

If you're interested in virtualization and virtualization software/systems, there are a lot of great sources and companies our there.  One of the leaders right now is VMware.  Check out their site, its well worth your time. http://www.vmware.com

Once data has been reduced to a unique set and measures have been taken to insure that large sets of redundant data don’t evolve and persist, productive analysis can be executed which can lead to real business intelligence. Web analytics opportunities can truly be wasted if these first steps are not taken. 

It’s important not to confuse purposeful redundancy and wasteful redundancy.  “Some IT redundancy is a good thing. For example, during a power outage when one of your data centers is not operational, you need a backup. The discussion here focuses on needless IT redundancy, or IT redundancy that only exists because of insufficient management of the IT systems.”4 It is encouraged to back up and protect your data in case of  a catastrophic failure somewhere in your information infrastructure.  However, wasteful redundancy can simply multiply data needlessly, increase costs, and skew analytical results, thus decreasing the value of the business intelligence generated.

1: Savits, Eric. “Best Practices for Managing Big Data”. Forbes July, 5, 2012

http://www.forbes.com/sites/ciocentral/2012/07/05/best-practices-for-managing-big-data/

2: Redundant Data. www.learn.geekinterview.com published December 9, 2009

http://www.learn.geekinterview.com/data-warehouse/data-types/redundant-data.html

3. http://en.wikipedia.org/wiki/Virtualization

4. Managing Meta Data for the Business. http://www.eiminstitute.org/library/eimi-archives/volume-1-issue-10-december-2007-edition/managing-meta-data-for-the-business-reducing-it-redundancy-part-2-of-5. published  December 2010

Data Visualization and Web Analytics, a Comparison

What is data visualization and what does it have to do with web analytics? According to Matthew Ward of the Worcester Polytechnic Institute, data visualization is “the graphical presentation of information, with the goal of providing the viewer with a qualitative understanding of the information contents.”[1] In other words, data visualization is infographic design. [2] For those of you who don’t know what that is, it is a special form of graphic design that is focused on the visual representation of information. I bring this up, because one of the most important things about digital analytics is understanding, or analyzing, the data. For that reason, these two topics have a lot in common.

Good infographics depict information in a quick and organized way. A lot of the time, a designer is dealing with a lot of information and is faced with the dilemma of how to show that data in a single page or in a single design. The infographic poster to the left depicts the average data consumption in the U.S. in one day. [3] That is a topic that definitely has a large amount of data connected to it. Somehow, the designer sifted through it, organized it and came up with the poster you see now.

Web analytics is similar. Web analytics is defined by Evan LaPointe, author of the blog Atlanta Analytics, as “the measurement, collection, analysis and reporting of internet data for purposes of understanding and optimizing web usage.” [4] The key words here are “understanding” and “optimizing.” If all you have is data, it isn’t going to be much use to your business. It is the understanding and optimization of that data that companies look for. It is how that data can be used rather than just ­collected. You and your client must be able to see the data. In a way, it is much like seeing the data in the data usage poster as discussed above.

            The objectives of data visualization and web analytics differ. In the first, the idea is to help others visualize data in such a way as to inform the viewer. In the latter, the goal is to take a large amount of data and understand it in order to make strategic decisions for a company. Regardless, they are both ways of informing others. Thomson Dawson of Pull Brand Innovation states that, “Marketers (and those who cling to big data) are prone to view brand design more narrowly than they should.”[5] The point Dawson makes in his article is that those who are in charge of business strategies often get stuck on a piece of data or an idea, and sometimes it takes someone from the outside with a new and broader view on the subject to make the changes needed to thrive. There will come a time when one of your clients, or the business you work for, will put you in a similar situation. When that happens, just remember, there is always a way to show that person or persons why the data lead you to that decision. It is just a matter of visualizing the data and presenting it in such a way as to persuade.

           

Footnotes

[1] Matthew Ward, “Overview of Data Visualization.” URL: http://web.cs.wpi.edu/~matt/courses/cs563/talks/datavis.html accessed: Jan. 30, 2013.

[2] Amy Balliett, “The Do’s And Don’s Of Infographic Design.” Last modified: Oct. 14, 2011. URL: http://www.smashingmagazine.com/2011/10/14/the-dos-and-donts-of-infographic-design/ Accessed: Jan. 30,2013.

[3] Bima Arafah, “Huge Infographics Design Resources: Overview, Principles, Tips and Examples.” Last modified: May 12, 2010. URL: http://www.onextrapixel.com/2010/05/21/huge-infographics-design-resources-overview-principles-tips-and-examples/. Accessed: Jan. 30, 2013.

[4] Evan LaPointe, “A Better Definition of Web Analytics.” Last modified: April 22, 2010. URL: http://www.atlantaanalytics.com/practicing-web-analytics/a-better-definition-of-web-analytics/ Accessed: Jan 30, 2013.

[5] Thomson Dawson, “Why Designers Make the Best Brand Strategies.” URL: http://www.pullinc.com/why-designers-make-the-best-brand-strategists/ Accessed: Jan. 30, 2013.­­­­