Evan Schuman's StorefrontBacktalk

Retailers fearful of having cardholder data swiped from their wireless networks won’t, unfortunately, find any new and magical cures within the new guideline published by the PCI Security Standards Council (PCI SSC) July 16. Indeed, the document’s authors concede they didn’t come up with any requirements that weren’t already included in the existing PCI standards. Then again, given an understanding between PCI and retailers, they really weren’t allowed to come up with anything new.

That understanding is that PCI won’t materially change for two years after its issued and the next update isn’t due until late next year. This way, retailers can make technology decisions based on current PCI rules without worrying about them changing every few months.

But if there’s any area where retailers would want more security standardization rules—or at least much more specific and realistic rules—it’s clearly wireless security. To be fair, that’s a very tall order and the nature of both wireless security and the PCI Council virtually make it impossible.

Many would argue that wireless security is an oxymoron, that the very nature of wireless communication makes secure transmissions unlikely. The very act of scanning for rogue networks in a crowded mall is fairly futile, for example, given the huge number of legitimate networks that are routinely added by retail neighbors.

At the same time, the nature of the PCI Council also makes such specific and practical advice difficult, given that its rules must apply to everyone from Wal-Mart to the one-location Phil’s Hoagies Shop down the street. To have rules that will apply to all forces its guidelines to be somewhat generic, leaving it up to IT management at each chain—in consultation (and sometimes knockdown-dragout fights) with their assessor—to work out the details that make sense for that chain.

Factoring that in, it’s not realistic to expect national all-chain guidelines from PCI—especially during a part of the calendar where they are not permitted to make any substantive changes—to materially address the wireless security question. But the group at least tried to consolidate all of its disparate wireless rules into one document, giving wireless managers a fighting chance of playing by the PCI rules.

“It contains no changes to the PCI standard at all and the only thing really interesting about it is that they felt the need to issue it,” said David Taylor, founder of the PCI Knowledge Base, a former Gartner analyst and PCI Columnist for StorefrontBacktalk. (See Taylor’s more detailed analysis of what’s good about the new PCI wireless document in this week’s column.) “They recognized the confusion out there.”