Insight-Driven Retailing Blog

David Taylor

By David Dorf on October 29, 2009 9:40 AM

I was very saddened to hear that David Taylor, founder of the PCI Knowledge Base, unexpectedly died of a heart-attack yesterday. Apparently his website will live on. Evan Shuman's note says it better than I could....

Comments (0)

Which is Worse: H1N1 or SQL Injection?

By David Dorf on September 2, 2009 2:23 PM

Today Michael Barnett, one of the engineers at Oracle Retail that worked on our PA-DSS (PCI) certification, sent an email to R&D that said: SQL Injection has regained the lead as the most popular of Web attacks, including Heartland, Hannaford...

Comments (0)

Has Tokenization Come of Age?

By David Dorf on July 16, 2009 4:54 PM

When I first heard about credit card number tokenization, I couldn't believe I missed such a simple solution. I was so focused on complex encryption that I didn't "think out of the box." Since then I know of several retailers...

Comments (2)

OEM for Retail

By David Dorf on February 13, 2009 9:00 AM

It costs a lot to maintain all the different systems necessary to run a retail business. To complicate matters, the systems are distributed so in addition to all the computers at headquarters, there are servers located in the stores, distributions...

Comments (0)

PCI Security Standards Are Not Good Enough

By David Dorf on January 28, 2009 7:41 PM

I logged into my bank account this evening and saw a message about reissuing certain cards that may have been breached. It turns out that Heartland Payment Systems, a payment processor, discovered a sniffer hidden in an unallocated disk partition....

Comments (1)

Back from NRF 2009

By David Dorf on January 15, 2009 9:30 AM

Now that I'm back from NRF, retail's "big show" in NYC, here are my impressions of the event. 1. The only gadget that caught my attention was Microsoft's Tag. Its basically a barcode created to work well with mobile phones,...

Comments (1)

Stealing Your Credit Card Number

By David Dorf on November 24, 2008 1:21 PM

I guess its possible that credit card theft has been happening all along but just wasn't widely reported in the press. But it seems to me that large scale attacks are just as prevalent now as they were four years...

Comments (1)

Whitelists are Better than Blacklists

By David Dorf on October 31, 2008 2:07 PM

As any retailer knows, there are 12 requirements in the Payment Card Industry (PCI) regulations. Requirement 5 is "use and regularly update anti-virus software." The problem with running anti-virus on registers is that they take precious resources, both CPU cycles...

Comments (2)

Securing the Retail Enterprise

By David Dorf on October 20, 2008 8:30 AM

Every retailer is well aware of the Payment Card Industry (PCI) and its Data Security Standard. Breaches exposing credit card data at several prominent retailers have been publicized ad nausea. On the one hand I'm pleased to get increased questions...

Comments (0)