The existing PCI DSS seeks to maintain payment card data security by mandating what parts of the process must be encrypted and what level of complexity that encryption must maintain. It also limits the amount of consumer payment data that retailers can store online.

But by its nature, the standard is slow to update, complicated to monitor and difficult to implement, Chiu said, and there is evidence hackers have found new and innovative ways to repeatedly defeat it.

Chiu pointed out the data standard is also tasked with protecting a steadily growing amount of data; reports suggest that data taken from Target, Neiman Marcus and other retailers did not pertain to payment data, but also names and addresses and other consumer data taken from other parts of the retailer's network.

“What I have been saying for some time is that we may need to change our data security approach from solely protecting the data and networks from intruders on the outside and also start focusing on protecting data from intruders we believe have managed to get inside,” Chiu said.

Too many data protection regimes are like M+M candies, he explained.

“They are hard on the outside and soft on the inside,” Chiu said. “Retail corporations, processors, anyone who is keeping consumer data need to start asking themselves 'how would I protect consumer data if I believed hackers were already able to access out network.'”

Chiu agreed more widespread movement to cards that validate transactions through embedded chips would go a long way to fight fraud at the point of sale, but added the steadily expanding range of targets for theft means protecting data networks will remain an abiding concern for some time.

“Since consumer data can be held and used for identity theft and other frauds for months and possibly years later, its value has steadily risen. Anything that valuable is going to need additional protection,” Chiu observed.