Ariel,
I agree with most of your comments. In fact, I have one suggestion of my own. The PCI DSS recommends the use of an anti-virus for protecting systems from malware. Unfortunately, even the best anti-virus will not distinguish a well written data siphon program from a legitimate payment processing app. Under these conditions, is it acceptable to just implement an anti-virus or should organizations look into complementary or alternative technologies to prevent such data leaks?

Many vendors like Solidcore, Third Brigade and CoreTrace are pushing a whitelisting technology which is highly effective in stopping unauthorized applications. It will be great if PCI DSS enhances the language of section 5 to approve the use of these emerging technologies. I know many organizations that are doing so, but only after fighting to get the approval from their auditors. It is ironic that most auditors prefer ineffective anti-viruses over a technology that has been proven to offer better security.

My $0.02

While I applaud and agree with many of your comments, there will never be a true debate or review of PCI standards. The PCI Standards Organization is a FOR PROFIT private organization whose controlling partners are Visa, MasterCard, American Express, Discover and JCB. Not only is the PCI Standards Organization not a recognized standards writing organization, but comments and reviews done by its membership on the standards are feedback only and may or may not be incorporated into the standards themselves which is dictated by the controlling partners.

PCI Standards Organization generates its income by through the certification and licensing of its assessors (note I said assessors not auditors, because there is no accountability for either them or PCI Standards Org.) and now payment software. However, they have no liability for faulty or inadequate reviews. In fact, most recent compromises were for organizations that had been "certified" compliant. Of course per the payment card associations, because they had a compromise they were "obviously not compliant".