My point was to shed some light on a system that is predatory in nature, uses hidden fees and confusing requirements to often put profits above “real” security, and has encouraged an atmosphere of just trying to pass PCI instead of actually improving actual security.

I’m not attacking the PCI SSC organization directly. What I’m “attacking” is the implementation by ASVs and merchant account providers. We field so many support emails and calls about PCI issues, where the merchant is often very confused and just trying to meet all the requirements, all the while trying to make a living and accept payments from customers. Pushing the onus on the merchant to handle security is not the right answer in my opinion.

I wish I had the actual answer to this problem, but I’d have to be a lot smarter and able to leap tall buildings in a single bound. 😉

By the way, the PCI SSC is a unifying standards organization. Rather than simply complaining that the standards organization doesn’t provide unified info, your article fails to articulate exactly what “standard” you found somewhere else that is missing on PCI SSC website.

Thanks

I agree with everything you’ve said, and want to thank you for helping me navigate the PCI mess.

You ought to distribute that article to a broader forum.

Cordially,

Steve / AdCracker.com

PS: I ignore the phone calls from the telemarketing creeps.

This post was mentioned on Twitter by LexiConn_Inc: New blog post – PCI and Its Predatory Practices – What Went Wrong? http://bit.ly/6Hs0w2 #pci #ecommerce…