Report: Merchants Secure Data to Protect Brand

July 25, 2011

Nearly 70 percent of respondents cited the need to “protect the brand” as the primary driver for tightening controls against hackers and other payment security risks, according to e-commerce processor CyberSource and security firm Trustwave. Only 26 percent said avoiding fines resulting from non-compliance with the Payment Card Industry Data Security Standard (PCI DSS) were the key motivator. “A breach has serious consequences for nearly every division of an e-commerce merchant’s organization,” said Dayna Ford, senior director of product management at CyberSource. “But by far the most damaging impact is to the company’s brand, affecting revenue, customer loyalty, and even stock valuation. Knowledge of this phenomenon is now widespread, so we’re not surprised at the survey finding that puts brand integrity as the most important rationale for payment security investment.” The Payment Security Practices and Trends Report found that 75 percent of PCI DSS Level 1 merchants that have removed payment data from their environments spend less than $500,000 on their payment security infrastructure. Only 60 percent of those that keep data in-house can make that claim. Respondents also said they felt the threat of payment data theft from inside employees was about equal to the threat from external hackers.