Boxer Jack Dempsey once said: The best defense is a good offense. Heartland CEO Bob Carr deserves a lot of credit for his efforts to turn the image of his company from "that payment processor that got breached" to "the only payment company that's offering end-to-end encryption to protect credit card data." And he did this all without bothering to stop and be contrite and apologetic for the breach.
Heartland's strategy—detailed here in a series of StorefrontBacktalk podcasts with Carr—is the most aggressive since TJX announced they were going to hold a special "we've been breached" sale for all of the public. But what are the implications of this bold strategy for retailers and the rest of the market? Here's a few of the things I am hearing as I talk to merchants, processors and other PCI market players:
Card processors have been competing on a transaction pricing model for years. The recent breaches at Heartland and RBS WorldPay will serve as a "make or break" inflection point for many of them. An example is Electronic Payment Exchange (EPX), a processor which has been offering its Buyer Wall tokenization system for two years. It's using the fact two of its competitors were breached to make bold moves of its own, focusing on removing card data from the retailer, beginning at the POS all the way through to the processor.
We've talked with two very large processors who also see the breaches of their competitors as a time for aggressive changes to their product offerings and strategies. We expect to see at least two major announcements from processors that leverage "beyond PCI" issues and competitive differentiators, as part of efforts to take business from other processors that still compete primarily on price. The point here is that retailers need to be talking strategy, not price, with their card processors. Any retailer that doesn't consider the security of transactions from the POS (or the website or call center) to the processor is making a major error.
Since the early days of EDI and electronic commerce, the use of proprietary technology to link enterprises has served to not only reduce costs for the linked businesses, but also as a tool to lock in the relationship, by raising the cost of switching providers. After all, if you're going to use security technology to take your competitor's business, why not use that same technology to keep it?
(Related Column: Is Heartland's End-to-End Move The First Shot In A Processor Lock-In War?)
Retailers need to carefully examine any new "beyond PCI" technical approaches being offered by their processors, as well as other service providers. They need to think about what will be required of them to take advantage of such "end-to-end" security and whether the investment in technology and labor will be transferrable, should they decide to switch to a competitor.
The best examples of this are encryption key management and tokenization. There are virtually no standards for how either type of system should work, and interoperability is almost non-existent in either case.This doesn't mean retailers should avoid such systems. Far from it. If you wait for emerging security technologies to be standardized, you'll be the least secure company on the block.
Rather, I'm simply suggesting that retailers do their homework and develop detailed requirements for any technologies that link them to their processor or service provider.
Those requirements should ensure that the retailer can minimize the cost of any provider-specific investment (e.g., POS systems that only work with one processor) and ask lots of questions along the lines of "What other companies support this technology?" The more merchants ask questions like this, the less likely they are to be locked into an unsatisfactory long term relationship. (I've been married 3 times. I know what I'm talking about here.)
Beyond focusing on avoiding "Beyond PCI Lock-in," retailers also need to focus on ensuring that these new security efforts don't break their existing applications. Some of the tokenization and end-to-end encryption approaches currently (or soon to be) on the market don't always play nice with existing ERP, CRM and other enterprise applications.
Retailers can wind up spending hundreds of thousands of dollars adapting their applications to work with particular security packages. Not only does this investment drive "lock-in," but it also requires major concessions from in-house and third party developers, which can substantially delay the project.
Developing data management requirements by working together with the applications team (whether internal or external) is critical to ensuring the success of any Beyond PCI security project.
For example, when Heartland's CEO described their end-to-end encryption offering, he used the term "Format-preserving encryption," which is a term trademarked by Voltage Security. (Editor's Note: Voltage said that it couldn't confirm nor deny its involvement with Heartland, but Heartland's Carr just confirmed that they are indeed working with Voltage. Heartland also said that it is working with multiple software companies on its proprietary package, which will include multiple sets of licensed packages plus a healthy dose of code that Heartland salaried programmers will create.)
In addition, tokenization vendors (such as MerchantLink and Paymetric) also proclaim that their tokenization approaches integrate well with enterprise applications. For merchants, it's critical to be able to fully cost-out the impact of these more strategic packages on existing processor relationships and applications infrastructure. These are not bleeding edge products, but they are still very different from each other and require a thorough business process and technology understanding in order to evaluate them properly.
The land "beyond PCI" is all about strategy. It's about admitting that PCI compliance will not prevent breaches and is well short of enterprise data security. The best way to approach the problem is to use the PCI mandates to justify the basics, and then use breaches to justify the rest. Essentially, "beyond PCI" is a layer of strategy on top of a layer of compliance. If you find this stuff interesting, you can see the research that drove our conclusions by visiting, the joining (for free) the PCI Knowledge Base so you can search our research database. In addition, if you want to discuss this topic, send an E-Mail to [email protected].