Might as well bring this hot topic to here!
For those not in the know: https://www.pcisecuritystandards.org/
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
A good question, but perhaps you should phrase it "Does PCI harm security".
To answer both questions, I would differentiate very roughly between two types of organizations (even though most fall in between these two extremes):
For the second group, PCI absolutely helps, a lot, in the following ways:
Basically it forces them to acknowledge security, and hopefully some additional good will come out of it.
For the first group, there are two (two and a half) main consequences:
In this case, PCI is doing more harm than good, since getting them to build in security is not an issue for these orgs.
However, one benefit of PCI compliance that is shared across the board:
PCI compliance reduces the risk of the penalties of non-compliance.
The first thing you need to be aware of is that PCI DSS is NOT intended to protect your organization. It is intended to protect the payment networks and the payment ecosystem. This may sound odd to many, but just ask Visa and Mastercard.
I agree with AviD's comments. "PCI Compliance" reduces some specific risks and probably makes those organizations (that aren't doing anything) more secure. But PCI compliance should not be any organizations ultimate goal.
Another thing to make clear is that there is a BIG difference between "PCI Compliance" and actually exercising all of the requirements of PCI DSS in a manner that is commensurate with the risk. Many organizations are "Compliant" (or think they are) today because of someones poor interpretation of PCI DSS or because they didn't do a full gap assessment.
As experience, i did work for a credit card processor, PCI helped us to
1) Get attention from the high-level managers (security became important when they heard that we could loose the rights to work with VISA and Mastercard).
2) Security got the chance to become part of the development lifecycle in the whole company, and the developers started to think 2 times before to give a solution like "save the security number in this txt and let it there, laying around, in a desktop used by 30 people"
3) Security got budget to handle the legacy, put it compliance, rethink old solutions and find new solutions for old hacks
So in my opinion, be PCI compliance don't make your company more secure, yes, it has the main focus to protect VISA and Mastercard, but it will open some doors to security, it will give you more budget and it can help you to review your legacy and be more diligent with your software development lifecycle in general.
PCI DSS helps the PCI SSC (PCI Council) make money, and lots of it.
It also helps the PCI SSC partners make money, and lots of it.
It does not "help" security, or the security community in any particular way. I can cite numerous examples of how it hurts the information security posture of organizations and hinders their ability to perform adequate information security management and risk management. However, the best example is that it takes money away from good projects and delivers it into the hands of the PCI SSC and their partners (see above), which always seem to fund bad projects. This is also how SANS works.
Saying that PCI DSS compliance reduces risk and improves security is like saying that Jenny Craig (or Weight Watchers) reduces fat and improves happiness.
I'd say there are quite a few things in the PCI-DSS that make sense for a lot of companies to be doing (even when not processing creditcards), and that yes, when implemented properly this can make an organisation more secure. Beyond that, it all depends on the mentality (regarding PCI-DSS) of the organisation trying to achieve PCI-DSS compliance.