“A breach has serious consequences for nearly every division of an eCommerce merchant’s organization,” said Dayna Ford, Senior Director, Product Management at CyberSource. “But by far the most damaging impact is to the company’s brand, affecting revenue, customer loyalty, and even stock valuation. Knowledge of this phenomenon is now widespread, so we’re not surprised at the survey finding that puts brand integrity as the most important rationale for payment security investment.”
“In the face of increasing numbers of security breaches and data theft, there’s a real urgency for organizations to deploy powerful and effective security strategies,” said James Paul, Senior Vice President of Global Compliance Services at Trustwave. “Studies like ‘The Payment Security Practices and Trends Report,’ published today, should help organizations learn best practices and likely costs to attain appropriate levels of security.”
Selected survey findings
–Data moving out: Over the next 24 months, an increasing proportion of organizations expect to remove payment data from their environment as a way of reducing security risks.–Efficiency improving: Organizations that do not capture, transmit, or store data inside their own network tend to employ fewer personnel, validate PCI DSS compliance more quickly, and operate at a lower overall cost of payment security management.
–“Data out” merchants spend less on infrastructure: 75 percent of PCI DSS Level 1 merchants(1) that have removed payment data from their environments spend less than $500,000 on their payment security infrastructure. Only 60 percent of those that keep data in-house can make that claim.
–Risk not confined to outsiders: In one counter-intuitive finding, respondents said they felt the threat of payment data theft from inside employees was about equal to the threat from external hackers.
The Payment Security Practices and Trends Report also covers topics regarding PCI DSS compliance, extended validation secure socket layer certificates, payment security ownership, staffing, and the cost of managing payment security.
Study Says Merchant PCI Decisions are Driven by Brand Risk
We Need You Concept
A new study by collaborators CyberSource and Trustwave indicates that nearly 70 percent of the e-commerce merchants surveyed were primarily motivated by brand protection necessities when implementing payment card security measures. In contrast, only 26 percent of respondents were driven by the threat of fines for PCI DSS non-compliance.