On Thu, Jan 16, 2014 at 09:44:07AM PST, Valdis.Kletnieks@xxxxxx spake thusly: > Consider that of all the credit-card breaches we've seen so far this century, > something outrageous like 97% of the victim companies had current audits that > listed them as being 100% PCI compliant at the time of the incident. You have a cite for this? I'm pretty sure I've seen stats saying exactly the opposite although I don't have them at hand. Nobody says PCI is perfect or will prevent you from being compromised. Like any security control, it just makes it less likely. PCI compliance is point-in-time. What often happens is that they have an audit (one a year so it is "current" even 6 months later) where they are found to be compliant and then over time things slide and then they are breached. PCI is a standard which provides actuall security for card data making it worth doing yet doesn't bankrupt the industry. Nobody says it is perfect. No standard ever will be. Arguing against a standard on that basis is not reasonable. > So how do you do it so it actually adds security, rather than just being a > huge government-mandate money transfer to the auditing/certification groups > involved? Someone has to audit otherwise there is no way to ensure appropriate security is in place. Your assertion that auditing/certification cannot be involved in any security mandate is a non-starter. -- Tracy Reed
Attachment:
pgpDIYv6igLKn.pgp
Description: PGP signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/