The Severe Ripple Effects of Non-Compliance

I came across an interesting article recently that highlights to me not only the potential financial impact of non-compliance, but the complex way in which this non-compliance can impact other parties in the value chain.

I came across an interesting article recently that highlights to me not only the potential financial impact of non-compliance, but the complex way in which this non-compliance can impact other parties in the value chain.

A brief summary.  A POS (point of sale…..although another interpretation might also be appropriate) terminal was sold to a number of restaurants in the South.  After using the system for several weeks, these restaurants started observing strange behavior (eg, the mouse moved at random and could not be controlled), and reports of credit card thefts started to come in from Visa and Mastercard.  It turns out after much forensic analysis that there was a major breach by a Romanian hacker, who stole info from hundreds of credit cards.  The hacker was able to do this because of two factors:

  1. The POS system stored ALL the info that was on the credit card magnetic strip after the transaction was complete – a clear violation of PCI standards.

  2. The technicians from the company that sold and maintained the systems used absurdly poor security when installing the software, such as the same default name and password across all systems.

So, what was the impact on each restaurant?  The original system cost $20K, but some restaurants had to later pay for forensic analysis ($19K), a fine from Visa ($5K), a fine from Mastercard ($100K….later rescinded), and partial restitution for the fraudulent transactions ($20K).  So, the original $20K investment on a “state of the art” system turned into an unmitigated disaster.  The vendor of the POS system denies all responsibility – hopefully, they have a good lawyer who can argue that with a straight face.

I’m not sure there are any universally applicable lessons here, but a few observations struck me.

First, it’s remarkable that such poor security practices would occur, especially in a technology product in which security is essential.

Second, compliance is serious business.  Some regulations are enforced more strictly than others, but in many cases (particularly PCI), the penalty for non-compliance can be debilitating.

Third, the days of compliance impacts being limited to your own enterprise are over, particularly for providers of technology solutions.  Compliance is often a multi-faceted network or value chain, and any non-compliance by one participant can have significant (and often hidden) impacts on the other participants.  In this case, the impact was very painful, and potentially disastrous.

I’m pulling for the restaurants.

Written by

Sumner Blount

Sumner is a director in the security business unit at CA. Previously, he managed the…

Published in

View this topic
  • James Holland

    This is great. Hooray for Disney’s imagineers!


    become a new brand in the share market research with its accurate research. Proven
    itself always right whether market is bull or bear. Last week all paid clients
    booked handsome profit in NIFTY, BANKINIFTY & STOCKS. Now for the coming
    week we expect more correction can come in NIFTY as the IRAQ issue is getting
    more tense, If it happens more then you will see a sharp fall in all world marketNSE BSE, STOCK TIPSbecause as we know all world run on
    crude & most of the crude comes from IRAQ. So be ready for a sharp fall so
    sell will be the best strategy for next week also. Traders can make a sell
    position in NIFTY around 7600-7650 with stoploss 7750 for the target of
    7300-7200.One can also make a sell call NIFTY 50 stocks as per NIFTY levels. You
    can also take our two days free trial to check our accuracy. For further updates
    you can visit our website.



  • king lear

    testing comment functionality, please do not publish this

  • Rachel Macik

    Love the personal pic :)

    • CAHighlight

      Thank you!

  • Plutora Inc

    This is a good case study. 2.3 sec’s off a login transaction is big.

  • Michele Hudnall

    While the analysts were hyping DevOps, I posted the oversight of not including security as part of that discussion as you are highlighting here. Instead of just talking DevOps, it should be DOS (what’s old is new again :-) – DevOpsSec. As a previous AppDev person, it’s the app, who’s using it, why and where rather than the device and having the service available.

    As you rightly point, out Security should be baked into the solution.

    Nice Post and Timely!


    • CAHighlight

      Thank you for your feedback Michele. Agreed – security cannot be overlooked. Appreciate your input!

  • Mitesh

    I would love a printed copy

  • Lars Johansson

    I love the idea of BYOID! This makes me choose if I am almost anonymous (with my Hotmail Nicname) or official with identity from an official organisation. My Identity Provider will attach identity with right level of LoA according to the need of the Service provider.

    • CAHighlight

      Thank you for your comment. BYOID has tangible benefits for end users and relying parties but it also has to be weighed in the balance with potential risks and liability concerns. It will be interesting to see how BYOID plays out in the enterprise.