Verizon 2017 Payment Security Report (PSR) Highlights:
- Payment Card Industry Data Security Standard (PCI DSS) helps protect payment systems from breaches and theft of cardholder data
- Of ALL the payment card data breaches Verizon investigated, no organizations were found to be fully compliant at the time of breach, demonstrating lower compliance with 10 out of the 12 PCI DSS key requirements
- The total number of organizations Verizon assessed achieving PCI compliance at interim validation has increased to 55.4 percent, up from 48.4 percent in 2015, but maintaining compliance is still an issue
BASKING RIDGE N.J. – With cybercrime on the increase, payment card security is increasingly a focus for companies and consumers alike. The Payment Card Industry Data Security Standard (PCI DSS) is there to help businesses that take card payments protect their payment systems from breaches and theft of cardholder data. The findings from the Verizon 2017 Payment Security Report (2017 PSR) demonstrate a link between organizations being compliant with the standard, and their ability to defend themselves against cyberattacks.
Of all payment card data breaches Verizon investigated, no organization was fully compliant at the time of breach, and showed lower compliance with 10 out of the 12 PCI DSS key requirements.
Overall PCI compliance has increased amongst global businesses, with 55.4 percent of organizations Verizon assessed passing their interim assessment in 2016. This is an increase from 2015, when only 48.4 percent of organizations achieved full compliance during their interim validation. This means that nearly half of retailers, restaurants, hotels and other business that take card payments are still failing to maintain compliance from year to year.
“There is a clear link between PCI DSS compliance and an organization’s ability to defend itself against cyberattacks,” comments Rodolphe Simonetti, global managing director for security consulting, Verizon. “Whilst it is good to see PCI compliance increasing, the fact remains that over 40 percent of the global organizations we assessed – large and small – are still not meeting PCI DSS compliance standards. Of those that pass validation, nearly half fall out of compliance within a year — and many much sooner.”
Key insight and real-life examples into business sector compliance
According to the report IT services industry achieved the highest full compliance of all key industry groups studied. Globally, about three fifths (61.3 percent) of IT services organizations achieved full compliance during interim validation in 2016, followed by 59.1 percent of financial services organizations (which includes insurance companies), retail (50 percent) and hospitality (42.9 percent).
The 2017 PSR also flags the compliance challenges faced by specific business sectors including:
- Retail: security testing, encrypted data transmissions and authentication.
- Hospitality and travel: security hardening, protecting data in transit and physical security.
- Financial Services: security procedures, secure configurations, protecting data in transit, vulnerability management and overall risk management.
Real-life examples highlight situations where compliance controls are not followed. For example – a financial services organization seeking exemption from the Wi-Fi requirements of PCI DSS was surprised to learn that it did in fact have a wireless network operating in its building – this lack of knowledge causing it to fail. The IT admin had got tired of traipsing from the server room in the basement to the IT department on the third floor, and so had installed a router to access the servers from his desk.
Mind the ‘control gap’ – key to compliance sustainability
When looking at the PCI controls that companies would be expected to have in place (such as security testing, penetration tests etc), the report found an increased ‘control gap,’ meaning that many of these basics were absent. In 2015, companies failing their interim assessment had an average of 12.4 percent of controls absent; this has increased to 13 percent in 2016.
Simonetti continues, “It is no longer the question of ‘if’ data must be protected, but ‘how’ to achieve sustainable data protection. Many organizations still look at PCI DSS controls in isolation and don’t appreciate that they are inter-related – the concept of control lifecycle management is far too often absent. This is often the result of a shortage of skilled in-house professionals – however, in our experience, internal proficiency can be dramatically improved with lifecycle guidance from external experts.”
The 2017 PSR offers five key guidelines to assist with control lifecycle management:
- Consolidate for ease of management – Adding more security controls is not always the answer – the PCI DSS Standard already contains numerous interlinked data protection standards and regulations. Organizations should be able to use this to consolidate controls, making them easier to manage overall.
- Invest in developing expertise – Organizations should invest in their people to develop and maintain their knowledge of how to enhance, monitor and measure the effectiveness of controls in place.
- Apply a balanced approach – Companies need to maintain an internal control environment that is both robust and resilient if they want to avoid controls falling out of compliance.
- Automate everything possible – Applying data protection workflow and automation can be a huge asset in control management – but all automation also needs to be frequently audited.
- Design, operate, and manage the internal control environment – The performance of each control is inter-linked. If there is a problem at the top, this will impact the performance of the controls at the bottom. It is essential to understand this in order to achieve and maintain an effective and sustainable data protection program.
Troy Leach, chief technology officer for the PCI Security Standards Council comments: “The report highlights the challenges organizations have to consistently maintain security controls on an ongoing basis, leaving their cardholder data environments vulnerable to attack. This trend was a key driver for changes introduced in PCI Data Security Standard version 3.2., which focus on helping organizations confirm that critical data security controls remain in place throughout the year, and that they are effectively tested as part of the ongoing security monitoring process.”
The rise of AI in compliance management
By Martin Ellingham, director, product management compliance at Aptean, looks at the increasing role of AI in compliance management and just what we can expect for the future
Artificial Intelligence (or AI as it’s now more commonly known) has been around in some shape or form since the 1960s. Although now into its eighth decade, as a technology, it’s still in its relative infancy, with the nirvana of general AI still just the stuff of Hollywood. That’s not to say that AI hasn’t developed over the decades, of course it has, and it now presents itself not as a standalone technology but as a distinct and effective set of tools that, although not a panacea for all business ills, certainly brings with it a whole host of benefits for the business world.
As with all new and emerging technologies, wider understanding takes time to take hold and this is proving especially true of AI where a lack of understanding has led to a cautious, hesitant approach. Nowhere is this more evident that when it comes to compliance, particularly within the financial services sector. Very much playing catch-up with the industry it regulates, up until very recently the UK’s Financial Conduct Authority (FCA) had hunkered down with their policy of demanding maximum transparency from banks in their use of AI and machine learning algorithms, mandating that banks justify the use of all kinds of automated decision making, almost but not quite shutting down the use of AI in any kind of front-line customer interactions.
But, as regulators are learning and understanding more about the potential benefits of AI, seeing first-hand how businesses are implementing AI tools to not only increase business efficiencies but to add a further layer of customer protection to their processes, so they are gradually peeling back the tight regulations to make more room for AI. The FCA’s recent announcement of the Financial Services AI Public Private Forum (AIPPF), in conjunction with the Bank of England, is testament to this increasing acceptance of the use of AI. The AIPFF is set to explore the safe adoption of AI technologies within financial services, and while not pulling back on its demands that AI technology be applied intelligently, it signals a clear move forward in its approach to AI, recognising how financial services already are making good use of certain AI tools to tighten up compliance.
Complexity and bias
So what are the issues that are standing in the way of wider adoption of AI? Well, to start with is the inherently complex nature of AI. If firms are to deploy AI, in any guise, they need to ensure they not only have a solid understanding of the technology itself but of the governance surrounding it. The main problem here is the shortage of programmers worldwide. With the list of businesses wanting to recruit programmers no longer limited to software businesses, now including any type of organisation who recognises the potential competitive advantage to be gained by developing their own AI systems, the shortage is getting more acute. And, even if businesses are able to recruit AI programmers, if it takes an experienced programmer to understand AI, what hope does a compliance expert have?
For the moment, there is still a nervousness among regulators about how they can possibly implement robust regulation when there is still so much to learn about AI, particularly when there is currently no standard way of using AI in compliance. With time this will obviously change, as AI becomes more commonplace and general understanding increases, and instead of the digital natives that are spoken about today, businesses and regulators will be led by AI-natives, well-versed in all things AI and capable of implementing AI solutions and the accompanying regulatory frameworks.
As well as a lack of understanding, there is also the issue of bias. While businesses have checks and balances in place to prevent human bias coming into play for lending decisions for example, they might be mistaken in thinking that implementing AI technologies will eradicate any risk of bias emerging. AI technologies are programmed by humans and are therefore fallible, with unintended bias a well-documented outcome of many AI trials leading certain academics to argue that bias-free machine learning doesn’t exist. This presents a double quandary for regulators. Should they be encouraging the use of a technology where bias is seemingly inherent and if they do pave the way for the wider use of AI, do they understand enough about the technology to pinpoint where any bias has occurred, should the need arise? With questions such as this, it’s not difficult to see why regulators are taking their time to understand how AI fits with compliance.
So, bearing all this in mind, where are we seeing real benefits from AI with regards to compliance, if not right now but in the near future? AI is very good at dealing with tasks on a large scale and in super-quick time. It’s not that AI is more intelligent than the human brain, it’s just that it can work at much faster speeds and on a much bigger scale, making it the perfect fit for the data-heavy world in which we all live and work. For compliance purposes, this makes it an ideal solution for double-checking work and an accurate detector of systemic faults, one of the major challenges that regulators in the financial sector in particular have faced in recent years.
In this respect, rather than a replacement for humans in the compliance arena, AI is adding another layer of protection for businesses and consumers alike. When it comes to double-checking work, AI can pinpoint patterns or trends in employee activity and customer interactions much quicker than any human, enabling remedial action to be taken to ensure adherence to regulations. Similarly, by analysing the data from case management solutions across multiple users, departments and locations, AI can readily identify systemic issues before they take hold, enabling the business to take the necessary steps to rectify practices to guarantee compliance before they adversely affect customers and before the business itself contravenes regulatory compliance.
Similarly, when it comes to complaint management for example, AI can play a vital role in determining the nature of an initial phone call, directing the call to the right team or department without the need for any human intervention and fast-tracking more urgent cases quickly and effectively. Again, it’s not a case of replacing humans but complementing existing processes and procedures to not only improve outcomes for customers, but to increase compliance, too.
At its most basic level, AI can minimise the time taken to complete tasks and reduce errors, which, in theory, makes it the ideal solution for businesses of all shapes, sizes and sectors. For highly regulated industries, where compliance is mandatory, it’s not so clear cut. While there are clearly benefits to be had from implementing AI solutions, for the moment, they should be regarded as complementary technologies, protecting both consumers and businesses by adding an extra guarantee of compliant processes. While knowledge and understanding of the intricacies of AI are still growing, it would be a mistake to implement AI technologies across the board, particularly when a well-considered human response to the nuances of customer behaviours and reactions play such an important role in staying compliant. That’s not to say that we should be frightened of AI, and nor should the regulators. As the technology develops, so will our wider understanding. It’s up to businesses and regulators alike to do better, being totally transparent about the uses of AI and putting in place a robust, reliable framework to monitor the ongoing behaviour of their AI systems.
Simplifying the Sector: How low code can aid digital transformation in financial services
By Nick Ford Chief Technology Evangelist, Mendix
From online banking to contactless payments and Apple Pay, it has been well demonstrated that the financial services industry is significantly ahead of many others when it comes to technology.
Traders, as well as customers, are now armed with the latest advances in technology and able to operate at super speed with more information at their fingertips than ever before.
However, the sector has not been immune from challenges created by COVID-19. The most significant challenge is maintaining the level of innovation they have been historically known for, with constrained budgets and smaller teams.
The pressure is on
The financial services sector is certainly quite complicated. There are many different regulatory bodies that monitor corporate conduct, which can make innovation a slow and arduous task. It also means that every time a new law is implemented, the sector needs to adjust to it, and that can mean anything from revising security protocols to radically changing the way information is processed, transmitted or audited.
This makes the job difficult for IT managers in the sector. Many of the systems they’re dealing with are old fashioned, dating back many decades and therefore not up to standard when it comes to performance and security. With lockdown restrictions meaning most sector staff are working remotely, this adds an extra pressure to IT teams that now have to ensure systems, data and work devices are functioning and always accessible. Digital transformation can help with this and a recent Mendix study found that 76% of IT managers in the sector believe it can improve operational efficiency.
Tech as a necessity
The sector now must be alert due to a new emerging challenge – the tech savvy customer. The modern age means customers are demanding much more from the services they are offered, with two things being highly desired; speed and transparency. As a result, many banks, hedge funds, and investment firms are investing in the appropriate technology to help meet these demands. The data that comes with upgrading ultimately allows financial institutions to better understand their customers and tailor their services more accurately to the changing trends influencing customer behaviour, Being able to have such knowledge is becoming more vital, as the pandemic continues to significantly affect the behaviour patterns of consumers and the preferences driving them.
Investing in technology can also increase efficiency within the sector at a time where teams and budgets are stretched, which can obviously have massive benefits. Digital transformation also leads to faster, better performing systems provides teams with the right tools they need to effectively get their job done. Tech is no longer a fintech privilege – it’s a currency. So much so that nine out of 10 IT leaders in financial services believe their firm will need to invest in digital projects over the next two years, just to survive in a rapidly changing market.
Powering digital transformation with low-code
To manage these different priorities, IT teams need to look beyond themselves and collaborate with different departments to create revenue-generating services that truly answer the clients’ needs – and it needs to empower all developers with the right tools to do so. This improved collaboration between IT and customer-facing staff means that services are designed to suit the needs of the customer-base, whilst reducing the pressure of an already-stretched IT team.
Low-code is one way to foster this collaboration. It requires little coding knowledge or expertise, meaning software development or the creation of business applications can include staff with non-technical backgrounds. Instead of having a back and forth between tech teams and other departments – of which miscommunication is always a risk – the development of apps can be inclusive involving a variety of teams, bringing together those that understand the business problems with those that understand the IT landscape, core systems and services to contribute to the vision of a product. IT stays in control with governance and guardrails built in to ensure compliance to the various standards required.
Digital transformation is an ongoing process in every industry. With low-code programming some of the current complexities and challenges facing the financial services sector can be tackled, allowing it to fully step into the digital age and continue being a hub of technological innovation.
Leading from the front – why decision makers must embrace automation
By Jeppe Rindom, Co-founder & CEO, Pleo
Ask any decision maker at a business about admin and you’re likely to be met with a familiar response – it’s a necessary evil that swallows time, but also helps inform strategic choices. Informed decisions are always better than uninformed ones, but many businesses still rely on outdated legacy processes to gather the data they need to make critical choices… and we’ve all seen the perils of a poorly maintained Excel spreadsheet in the news recently.
At director level, these administrative tasks can consist of signing off expenses or monitoring company spending to inform upcoming budgets. Although crucial to running a business well, these can be time-consuming and frustrating when you don’t have the right tools to make sense of it all. The solution? A simple change of approach.
A logical solution
This is where automation comes in. Over the last decade, we’ve seen how technologies including chat-bots and artificial intelligence have impacted everyday business, from customer-services and marketing to data analytics and time-management. More than ever, this is allowing employees to free up time to work more efficiently and focus on business-critical tasks. But this isn’t a quick fix. At a decision making is required. Ironically, a lot of these tasks relate to how a business can improve efficiency and productivity.
Add in the fact that many of these senior staff members have tight schedules, and can’t afford to spend several hours trawling through spreadsheets, and it’s little wonder high level admin is still an issue. In a recent customer survey, we found that 75% of senior managers spend over an hour a week on expense reports, with 14% losing nearly a whole working day (five hours or more) a week to managing them – time that could be better spent growing their business. The same study found that our platform saves people an average of 11.5 hours a month on managing company expenses. If you consider this could mean an extra day for a CFO or Finance Director to spend on more essential tasks, such as business forecasting or growth planning, the reward for investing in well designed automation at this level is clear.
But, automation isn’t just a case of saving time; it also fosters trust. Our study found that over half (51%) of users agreed that automating the laborious parts of their expenses like receipt capture, categorisation and expense reports also helped them build trust within their organisation. Automation helped them to excel at the things they’re most interested in, and were actually hired to do. I’m a huge advocate of empowering people with the tools they need to succeed. And through the empowerment automation brings, it’s only natural that employees begin to feel their worth in the business and that they are trusted.
A business-wide approach
Yet for automation to work, a company-wide understanding of its potential is vital. Adoption by senior staff should not be seen as simply a fringe benefit, as automation relies on understanding and endorsement from all levels of a business to work efficiently. A report titled ‘Automation and the future of work,’ published by the British Government in September 2019 noted that the successful implementation of automation “relies on managers and business leaders themselves being able to understand the potential of automation and the impact of technological change.” In this respect, managers will be your biggest ally when embracing automation. Any manager worth their salt understands the benefits of leading through example, and by creating automation ‘advocates’, businesses can ensure teams are comfortable with the impending change. While many busy managers often resist new processes (especially those to do with unfamiliar technology), they usually find that investing a short amount of time getting to grips with an automation platform pays off in the long term.
One of the most frequent pieces of feedback we receive is that an effectively automated platform allows staff to focus on strategy, culture and creativity, with the knock-on effect of automating mundane tasks being felt throughout an entire organisation, not just one relieved individual.
Having a smart, automated platform can also massively reduce the chance of human error at an early stage. This can be disastrous when data is relied upon to make important decisions at a later date. In this respect, having access to accurate information can be a game-changing benefit for decision-makers, particularly those working under increased pressure.
At a time when businesses are facing rapid and unpredictable changes, ensuring your business is equipped with the right tools for success is crucial. And while automation may seem an intimidating change, the huge benefits it can bring to both processes and culture will outweigh any initial concerns. By giving senior staff and their team members alike the ability to embrace smart automation, efficiency will speak for itself, and your business’ success will flourish.
Research exposes the £68.8 billion opportunity for UK retailers
Modelling shows increasing the proportion of online sales by 5 percentage points would have significantly boosted retailers’ revenues during the...
Want to serve your customers better? An effective online strategy is what financial institutions need
By Anna Willems, Marketing Director, Mention A strong online presence matters. Having a strong online presence, that involves social media...
The rise of AI in compliance management
By Martin Ellingham, director, product management compliance at Aptean, looks at the increasing role of AI in compliance management and just...
Simplifying the Sector: How low code can aid digital transformation in financial services
By Nick Ford Chief Technology Evangelist, Mendix From online banking to contactless payments and Apple Pay, it has been well...
Why the Boom is Long Overdue (and Here to Stay)
By Roger James Hamilton, CEO, Genius Group Virtually every aspect of our lives has been taken over by tech, so...
5 Sustainability Lessons That Are Crucial For Business Success
By Michael Stausholm, founder of Sprout World (sproutworld.com) Sprout World is the eco-company behind the world’s only plantable pencil, with...
Why financial brands need to understand consumer vitality
By Carolyn Corda, CMO at data consortium ADARA Our day to day lives have been turned upside down. Office workers have...
Why and how a modern marketing strategy should put customer experience first
By Jim Preston, VP EMEA, Showpad In 2004, the Leading Edge Forum coined the term ‘consumerisation of IT’, defining a...
Leading from the front – why decision makers must embrace automation
By Jeppe Rindom, Co-founder & CEO, Pleo Ask any decision maker at a business about admin and you’re likely to...
Business first, not compliance only is the future for accountants
By Peter Bracey, MD at Bracey’s Accountants. The past few months have underlined the need for better business insight to reduce...