Do SMB’s (or others even) want to move beyond the checkbox?

There has been much discussion lately about the fact that being PCI compliant does not necessarily make you secure.  The simple answer is of course it doesn't. It does make you compliant perhaps, but not truly secure. The regulations were meant as a minimum, not as the be all, end all.  But with that being the case, what makes you think that most businesses, especially SMB’s give a hoot.  For most of these people being compliant is where its at.  They have not budget or will to move beyond that whether it be SaaS, MSSP or anything else.

So it was with a chuckle I read Steve Smith’s Alert Logic blog post on how and why SMB’s should be moving beyond checkbox compliance. Steve what makes you think they want to? In fact the evidence is overwhelmingly that they don’t.  Once you get past Steve’s somewhat annoying incessant Alert Logic selling (hint: Steve be a little less “sales-y” in your blog posts), Steve reverts to a FUD argument.  Citing the Pokemon (spelling mistake intentional on my part) Institute, Steve talks about how expensive a data breach can be.  But my experience is that most SMBs and even larger companies don’t believe it will happen to them. Getting them to spend money based upon the fact they could suffer an incident is a tough sell in the current economic environment. It is the herd mentality. They know someone is going to get burned, but there are so many, what are the odds of it happening to them.  It is only after the fact that they believe it can happen to them.

Here is the bottom line: The best customer for a security vendor – product, SaaS or MSSP (and Steve MSSPs give customers control over their security too, if they want it, which is a whole other story) is one who has already had a security breach.  They get religion real quick after an incident.  But trying to convert one who has not had an incident is better left to missionaries.  In other words, companies are told they have to meet PCI guidelines to do business. That is the bar they are going to aim for.  Asking to them go beyond that is pushing rope up the hill I am afraid.

Related articles by Zemanta

• PCI security rules may require reinforcements (computerworld.com)
• PCI DSS Misconceptions and Facts (deurainfosec.com)
• More Investment Needed to Secure Credit Cards (pindebit.blogspot.com)