2019 Payment Security Report Executive Insights

Verizon has published the Payment Security Report (PSR) since 2010. At the time, it was the first-ever study on the value and performance of the Payment Card Industry Data Security Standard (PCI DSS). Fast-forward nine years, and the PSR continues to offer a unique view on the long-term impact of the PCI DSS, measuring a decade of actual PCI assessments conducted across the globe.

The PSR reveals groundbreaking insights that help payment card professionals better understand their world. The PSR continues to be a highly anticipated report in the industry among key players, including the PCI Security Standards Council (SSC), that addresses the challenges of payment data protection and meeting compliance requirements.

 

Twenty years ago, in 1999, the major card brands initiated their cardholder data protection programs and in 2004, the programs were combined into a single data security standard. The PCI DSS celebrates its 15th birthday this year (v1.0 was released in 2004). An effective and sustainable control environment remains as relevant as ever, yet for many organizations, this remains a challenge.

Going through a check-box routine or merely throwing money into data protection does not solve organizations’ compliance challenges. Often, these tactics lead to a false sense of security. Too many organizations are stuck in a reactive “wash, rinse, repeat” pattern, focusing only on meeting baseline compliance requirements.

To keep up with threats, data protection compliance programs (DPCPs) must continue to evolve and mature. Organizations must develop visibility, control and predictability in compliance performance. They must become proactive instead of reactive.

What the industry seems to need most is guidance on how to develop and how to measure the effectiveness and maturity of their DPCPs. That is what this edition of the Payment Security Report is about.

Verizon’s cumulative experience gained from 25 years of measuring, analyzing and building mature, effective compliance and security programs has helped us position the 2019 PSR as the ideal navigational guide—not only for charting one’s course through uncertain and changing waters, but for staying ahead in the race. This year, we build on the insights and recommendations from past years to introduce the practical, integrative Verizon 9-5-4 Compliance Program Performance Evaluation Framework as a navigational tool to improve DPCPs.

Data protection should be approached like a chess game, with a sound strategy that includes assessing risks and planning several steps ahead. Each move should be evaluated and executed strategically, taking the pieces on the board into thoughtful consideration.

All too often, CISOs focus on keeping only baseline control activities in place instead of growing data protection competency and maturity. They need a clear and easy-to-understand navigational guide to help them deliver measurable results and predictable outcomes.

In the 2018 PSR, we outlined the key factors that affect control effectiveness and sustainability. The response was overwhelmingly positive, with numerous requests for practical recommendations on how to implement the 9 Factors of Control Effectiveness and Sustainability Framework to strengthen and improve DPCPs. That is what the Verizon 9-5-4 Compliance Program Performance Evaluation Framework is all about.
 

This year’s PSR has exciting aspects in its findings. For the first time, the PSR contains assessment data compiled from additional qualified security assessor (QSA) companies. This expands the view and perspective provided in past PSRs.

The 2019 PSR includes data from 302 engagements around the world. We expect this number to increase as QSA companies globally continue to collaborate and share their insights to provide a holistic view of PCI DSS compliance. This data takes on a new level of importance as the entire payment card industry moves to the new standard, PCI DSS v4.0, in 2021.

The 2018 PSR reported that full compliance with the PCI DSS decreased, and this year we see the same negative trend globally. Assessments from other QSA companies also show lower full compliance.

Organizations are required not only to achieve 100% compliance with the PCI DSS but also to maintain it. This means having all applicable security controls continuously in place and functioning as intended. Verizon measured organizations during interim assessments to determine the percentage that achieved full compliance for each PCI DSS key requirement in 2018.

An interim assessment—or initial report on compliance (iRoC)—provides a valuable opportunity for organizations to validate the effectiveness of PCI DSS control management. For some time, these interim assessments found full compliance with PCI DSS to be increasing. But in 2017, that upward trend reversed when full compliance declined by 2.9 percentage points.

Compared to the previous years, global compliance fell a further 15.8% in 2018 to 36.7%, and is following the decreasing trend in sustainability seen across the past three years (2016-2018), according to the 2017 and 2018 editions of the Verizon PSR.

This is a significant drop in compliance rates. There are many potential factors for the decrease. For example, changes in personnel and mergers can throw a proverbial wrench into the works of DPCPs. Changes in the operating environment can also leave the ship adrift without guidance.
 

While overall compliance has fallen, the control gap representing how far organizations were from full compliance remained consistent with the previous year at 7.2% for the total population of organizations in the data set, according to the most recent Verizon PCI Security Practice data.

Requirements 5 and 7 of the standards continue to be the most consistently maintained, as we have seen across the past three years.

The largest compliance drop was seen against Requirement 6, as organizations struggle to maintain effective vulnerability management, software development and change processes.

Requirement 11 remains the poorest performing in both overall compliance and control gap, as organizations cannot sustain compliance with security testing requirements year-on-year.

Organizations in the Asia-Pacific (APAC) region show stronger ability to maintain full compliance: 69.6% maintained conformance to the security standard. Fewer than one-quarter of all organizations in the Americas maintained full compliance, at 20.4%.

This is 49.1% fewer than the APAC average. If you are an organization in the Americas, there is more than a 75% chance that you need support to get your security and compliance programs on track.

The finance industry has done a tremendous job with raising the bar on full compliance in comparison to peer industries, but it is only 2.4% above the global average. As with other industries, we saw a significant decrease in the ability to maintain full compliance. Hospitality would strongly benefit from the advice provided in the Verizon PSR to build a sustainable security program.

Interesting notes about the control gap

Because PSR research has found that many organizations do not maintain compliance, it is important to understand how well they protect sensitive payment card data. Organizations that are fully compliant have a control gap of zero. For others, the control gap decreased to 10.2%, which is 6.2% better than what was documented in the 2018 PSR. This translates to just under 90% compliance for most organizations. If 90% is an “A,” then the average control gap would result in a “B.”

If we look at the controls organizations sustain least, we see 7 of 12 requirements have controls in the bottom 20 list. Requirement 11 has consistently ranked last, with seven of its controls in the bottom 20 list.

These controls are fundamental steps to establishing a compliance program to protect data. If you haven’t implemented these controls, Verizon Threat Research Advisory Center (VTRAC) data indicates there is a more than 95% probability that your organization has not truly committed to a sustainable DPCP.

While a smaller control gap means businesses are moving in the right direction, the controls with the most substantial gap to full compliance are 16 to 33 percentage points away from the lowest possible compliance—indicating potentially serious security risks.
 

In this year’s report, we’ve included more detailed data breach investigation correlations. These are based on data breach metrics from PCI Forensic Investigations (PFIs) performed by VTRAC from 2016-2018.

It is not always possible to pinpoint the specific cause that resulted in the data breach or the contributory factors that helped propagate it. In 28.7% of investigations, identifying a specific requirement as causing a breach was not possible. In 27.4% of investigations, the extent to which a requirement could be identified as contributing to a data breach is unknown.

This is mainly due to the lack of evidence available to investigators because of poor log management practices, weak incident response (IR) procedures, and limited capabilities within organizations to preserve evidence in the wake of a cybersecurity incident.

Incident preparedness summary

12 requirements

No organization suffering a data breach was compliant across all 12 requirements across the 2016-2018 dataset.

0%

No organizations—at the time of breach—were compliant with Requirements 3, 8, 10, 11 and 12.
 

75%

Requirement 9 had the highest compliance rates of all PCI DSS requirements among breached entities, but failures were still observed in 75% of organizations.
 

10.2

Most organizations had difficulty meeting Requirement 10.2, the ability to reconstruct events by implementing proper audit trails. Retail organizations experienced the lowest level of compliance with PCI DSS incident preparedness requirements, followed by the financial services industry. IT services do much better, with only 1% of organizations failing to meet Requirement 10.2. ¹

For years, we’ve heard the claim by industry experts that “no truly PCI DSS-compliant merchant has ever been breached.” We don’t have access to investigative data from every breach of a payment card processing environment since the first plastic card with a magnetic stripe was processed and compromised. Nor do we have direct access to every adversary who decided to electronically evade an organization’s security controls. But here’s what we do know:

The State of Compliance section of the 2019 PSR includes more detailed breach correlation data than ever before. Alongside, we also present real-world, first-hand observations from our field investigators, who have conducted PCI data breach investigations.

When we revisit payment card security breaches investigated by VTRAC, we can definitively state we have never reviewed an environment or investigated a PCI data breach involving an affected entity that was truly PCI DSS compliant—even if it had a signed Attestation of Compliance (AOC).
 

Verizon 2019 Payment Security Report—Executive insights
Published September 17, 2019

Editorial team
Lead author:
Ciske van Oosten

Co-authors and editors:
Anne Turner, Clarence Hill, Cynthia B. Hanson, Dyana Pearson, John Grim, Neal Maguire

Data analysts:
Anne Turner, Noel Richards, Saravanan Thangam, Sundeep Paderu, Ron Tosto

Security assurance practice

Managing director:
Rodolphe Simonetti

PCI and Payment Security consulting practice

Global lead:
Ron Tosto

Americas region:
Franklin Tallah

APAC region:
Sebastien Mazas

EMEA region:
Gabriel Leperlier

Business intelligence:
Ciske van Oosten