1. Improving Technology Decision Making for the Multichannel Retailer

2. Complicated, Expensive and Time-Consuming – But PCI DSS isn’t Going Away Mark Kedgley, Chief Technical Officer NNT

3. Improving Technology Decision Making for the Multichannel Retailer NNT is a leading light in PCI DSS & general Data Protection software solutions Focused on helping organisations protect their sensitive/credit card data in an effective, affordable and pragmatic manner

4. Improving Technology Decision Making for the Multichannel Retailer Agenda Attitudes and Opinions from Multi Channel retailers in the UK Some Statistics and Figures Strategies available – what is working and what are others getting away with? Common Sense or Technology? Are the goalposts moving (or going to move) Summary

5. Improving Technology Decision Making for the Multichannel Retailer Attitudes & Opinions from Retailers #1 Duck it! “The future is too unclear to make any investment….”

6. Improving Technology Decision Making for the Multichannel Retailer Attitudes & Opinions from Retailers #2 Paralysis! “We don’t want to make mistakes like xyz….”

7. Improving Technology Decision Making for the Multichannel Retailer Ignore it! “We don’t need to bother – we’ve been OK so far and we view the risks as low…” Attitudes & Opinions from Retailers #3

8. Improving Technology Decision Making for the Multichannel Retailer Attitudes & Opinions from Retailers #4 Go Slow! “We have kept some updated procedural stuff back and if we drip-feed this to the Bank over the next two quarters then we are covered for the next few months…”

9. Improving Technology Decision Making for the Multichannel Retailer How hard can it be? Just 12 Requirements ……230 sub requirements …and some estimates of 650 detail points

10. Improving Technology Decision Making for the Multichannel Retailer Logical – from one perspective… Requirements focus on 12 main security initiatives comprising technological measures and ‘best practice’ procedures

11. Improving Technology Decision Making for the Multichannel Retailer Processes & Technology Needed What is our Change Management Process? Is it documented? How often do we verify configuration standards? What is our process for this? Where is that network diagram? ! Do we need to buy a firewall for each site? Do we need an automated diagramming tool?

12. Improving Technology Decision Making for the Multichannel Retailer Cost? – Be careful who you Ask! Vendor Speak “Silver Bullet…” “….Easy Steps” Cost of Procrastination and Sandbagging?

13. Improving Technology Decision Making for the Multichannel Retailer Upside? Plenty… Avoid Fines and Corporate Shame ‘Off the Shelf’ Security Policy Data Protection? ISO 27000? Advanced Warning System

14. Improving Technology Decision Making for the Multichannel Retailer The Future of the PCI DSS Stable and Mature P2P Encryption and Tokenization help but aren’t ‘Magic Bullets’ (or Silver Bullets) Likely that the PCI DSS will take P2P Encryption in as an additional measure Expect more, not fewer measures

15. Improving Technology Decision Making for the Multichannel Retailer Want some advice? PCI DSS on a fag packet Take Control – understand the objectives of the PCI DSS Your environment is unique – you understand your exposure best Don’t ask your QSA for guidance, just confirmation

16. Improving Technology Decision Making for the Multichannel Retailer Summary Don’t resist – Embrace the PCI DSS! Thank you for your attention.