straxd on Group Psychology, IT Security and PCI…..

February 20th, 2008 Drazen Drazic Posted in Bad Stuff, Industry Specialists Talk, PCI, PCI DSS, Risk Management, cyber crime |

From straxd - an unassuming dark horse

I have always had a bit of a fascination with the concept of group psychology. It’s at the same time the most evil and the most successful marketing tactic that a company can launch.

Take De Beers’ creation of the diamond industry as an example. By giving the right general impression the entire psyche of society can change (and the diamond cartel made billions as a result). Coke has converted a version of caffeinated carbonated sugar water into a drink pretty much everyone has every day. The records and movie industries have converted copyright infringement into theft, and created the previously alien idea that artists would stop creating new art if they weren’t millionaires.

Not that group psychology is always a bad thing. The cigarette industry used media and advertising to ingrain smoking into culture, and now the Australian Government is using the same tools to try and associate smoking with disease and suffering.

The security industry uses the same tools for similar results. Microsoft created the public acceptance of viruses being inevitable. Verisign’s SSL logo makes people believe that the site’s secure. People now actually believe that the “Hacker Safe” logo actually means that their data will be safe even though it is just a vulnerability scan which isn’t even that thorough.

What surprises me is that the credit card companies don’t get into the same game with PCI. I would like advertisements saying “Don’t give your credit card information to any company that’s not PCI compliant”. I would like an official logo that companies can put on their sites that will actually imply some level of security.

I believe that companies won’t and don’t respond to threats of fines if they get hacked at some time. They just assume that they won’t get hacked because…well it won’t happen to them. For them, security is a cost, not a profit, and it gets in the way of doing business. Remember, of course, that it’s not the companies’ data that they are risking, it’s just their customers. It’s so much easier to gamble when it’s not your money that you’re betting.

Now don’t get me wrong, PCI isn’t everything. It’s just better than what most companies have now. What non-compliant companies will understand is the alienation from their customers which could happen if the customers realise the benefits of PCI compliance. When my mother can look at a site, know that it’s PCI compliant and have a general idea of what it means, that is when PCI compliance will take off.