Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Compliance

Survey: Merchants More Concerned Over Protecting Brand Than Fines

Recovering from a breach can be expensive, just ask Sony or any other company that has fallen victim to a cyber attack recently. Not only are the costs stemming from investigations, breach notifications and fines expensive for organizations, the damage done to a brand and loss of customer confidence can be incredibly costly.

Brand Protection over Compliance

Recovering from a breach can be expensive, just ask Sony or any other company that has fallen victim to a cyber attack recently. Not only are the costs stemming from investigations, breach notifications and fines expensive for organizations, the damage done to a brand and loss of customer confidence can be incredibly costly.

Brand Protection over Compliance

Recent findings from a survey of eCommerce merchants released today by CyberSource and Trustwave, revealed that nearly 70 percent of respondents cited the need to “protect the brand” as the primary driver for tightening controls against hackers and other payment security risks. Only 26 percent said avoiding fines resulting from non-compliance with the Payment Card Industry Data Security Standard (PCI DSS) were the key motivator. In other words, the lifetime value of customers is far more important than a one-time fine due to non-compliance.

“A breach has serious consequences for nearly every division of an eCommerce merchant’s organization,” said Dayna Ford, Senior Director, Product Management at CyberSource. “But by far the most damaging impact is to the company’s brand, affecting revenue, customer loyalty, and even stock valuation. Knowledge of this phenomenon is now widespread, so we’re not surprised at the survey finding that puts brand integrity as the most important rationale for payment security investment.”

“In the face of increasing numbers of security breaches and data theft, there’s a real urgency for organizations to deploy powerful and effective security strategies,” said James Paul, Senior Vice President of Global Compliance Services at Trustwave. “Studies like ‘The Payment Security Practices and Trends Report,’ published today, should help organizations learn best practices and likely costs to attain appropriate levels of security.”

Key survey discoveries:

• Data moving out: Over the next 24 months, an increasing proportion of organizations expect to remove payment data from their environment as a way of reducing security risks.

• Efficiency improving: Organizations that do not capture, transmit, or store data inside their own network tend to employ fewer personnel, validate PCI DSS compliance more quickly, and operate at a lower overall cost of payment security management.

• “Data out” merchants spend less on infrastructure: 75 percent of PCI DSS Level 1 merchants that have removed payment data from their environments spend less than $500,000 on their payment security infrastructure. Only 60 percent of those that keep data in-house can make that claim.

Advertisement. Scroll to continue reading.

• Risk not confined to outsiders: In one counter-intuitive finding, respondents said they felt the threat of payment data theft from inside employees was about equal to the threat from external hackers.

The payment security survey was conducted via an online questionnaire by an independent survey organization from December 6, 2010 through January 31, 2011. Respondents to the survey were required to have personal involvement in the management of their organization’s payment security practices.

Related Reading: HIPAA – Is it “Good” for Security?

Related Reading: Meeting Compliance is Overrated—Manage Risk!

Written By

For more than 15 years, Mike Lennon has been closely monitoring the threat landscape and analyzing trends in the National Security and enterprise cybersecurity space. In his role at SecurityWeek, he oversees the editorial direction of the publication and is the Director of several leading security industry conferences around the world.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Compliance

The three primary drivers for cyber regulations are voter privacy, the economy, and national security – with the complication that the first is often...

Compliance

Government agencies in the United States have made progress in the implementation of the DMARC standard in response to a Department of Homeland Security...

Application Security

Virtualization technology giant VMware on Tuesday shipped urgent updates to fix a trio of security problems in multiple software products, including a virtual machine...

Application Security

Fortinet on Monday issued an emergency patch to cover a severe vulnerability in its FortiOS SSL-VPN product, warning that hackers have already exploited the...

Compliance

Web scraping is a sensitive issue. Should a third party be allowed to visit a website and use automated tools to gather and store...

Cloud Security

Proofpoint removes a formidable competitor from the crowded email security market and adds technology to address risk from misdirected emails.

Application Security

Microsoft on Tuesday pushed a major Windows update to address a security feature bypass already exploited in global ransomware attacks.The operating system update, released...

Application Security

Password management firm LastPass says the hackers behind an August data breach stole a massive stash of customer data, including password vault data that...