8 ms·

Birmingham? I think I know this guy - we have a client based there and are three years into a war with their PCI auditor, who are dangerously incompetent. They

Birmingham? I think I know this guy - we have a client based there and are three years into a war with their PCI auditor, who are dangerously incompetent. They were adamant that we should be able to decrypt PANs (credit card numbers) - we still haven't complied, as we quite deliberately don't store them and just transit them. It's not a phishing scam, this is pretty much state of the art in the UK - and try being a 32 year old "kid" company director while the 55 year old "security engineer" who seems to have never used a computer and thinks a network is a maritime term plays the "seniority" card in front of a client of the same generation. The sad thing is I've seen two retailers drive themselves hard into the ground over the last eighteen months by listening to this variety of chumbly wotsit rather then someone who actually knows what the hell they're talking about. One spent about £8M on their PCI auditor over six months, then went bust, blaming us, the platform provider - who are PA-DSS and ISO certified. The auditor blamed us too, then folded up shop and moved to Spain. PCI experts are the new SEO experts.

jacquesm 10y ago
> £8M How on earth was that spent? That's more than two orders of magnitude more than any PCI audit that I'm aware of (and since the regular requirement is to do that annually the number is even more insane).
- pja 10y ago
  I would guess that the majority of it was spent on dev work making the company processes fit the insane requirements of their PCI auditor.
  - jacquesm 10y ago
    It says it was spent on the auditor, that's why I asked.
    - akshatpradhan 10y ago
      PCI doesn't say anything crazy. Its all reasonable stuff. Scroll to page 20: https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2.pdf https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2.... Networks, System Hardening, Boundary Protection, Access Control. Nothing in the PDF says anything unreasonable. The naysayers just don't want to open up the PDF and READ.
      - jacquesm 10y ago
        Yep. That's why 8M seems totally over the top unless you had a very large setup that was a total mess beforehand and even then it seems outrageous.
- madaxe_again 10y ago
  The auditor was also a solutions provider. The client was like a deer in headlamps, and had no internal counsel and went utterly paranoid - they had deep pockets, but not enough to avoid a cashflow crisis. To be fair I don't know the precise figure but inferred it from the CVA debtors sheet and some other drama I won't go into, but it's a large multimillion sum. They had an aged epos system that was replaced, new computers for everyone, etc etc.
  - jacquesm 10y ago
    Auditors should not wear more than one cap. I don't know how often I haven't been asked to either recommend something, some party, some solution or even to solve a problem myself but I'm extremely strict about this, I simply won't do it. The conflict of interest is such that I think that any auditor / company that doesn't understand this basic principle should not be in this business at all.
abritishguy 10y ago
Name and shame, this auditor is actively damaging security and should be shut down.
- RubyPinch 10y ago
  Naming and shaming is also going to paint a big target on that company's head, since, you know, they collect plaintext data n' stuff
- fdgdasfadsf 10y ago
  I suggest being careful with UK libel laws here. I am not a lawyer.
  - tankenmate 10y ago
    Indeed, truth is not always an absolute defence in the UK. Also the law varies depending in which jurisdiction you are in in the UK; e.g. England & Wales vs Scotland vs Northern Ireland.
- madaxe_again 10y ago
  I've worked with about eight or nine. Two of them are jaw drops in horror. A bunch are "err, what?", but get the job done vaguely competently if in a very procedural fashion. Quite often it's totally nontechnical people with backgrounds in finance/filing who do the assessment. Finally, there are two outfits we've worked with that we liked - one well enough to come audit us. Oh, also, the big automated platforms like SM and TW are pretty poor. The way it's set up right now, if you're lucky enough to be deemed a QSA by the PCI council, congratulations, you are now legally welcome to blackmail and extort. Zilch oversight, it's the Wild West, and snake oil salesmen abound.
  - tomblomfield 10y ago
    Who were the two you liked? We're looking at various PCI stuff at the moment.
PuffinBlue 10y ago
My bullshit detector was sitting firmly at maximum until your post, now I'm not so sure. I thought that surely and auditor couldn't be asking for plain text passwords, let alone the rest, and maybe this was just a massive troll by the OP. Perhaps not. I've dealt with Data Protection before but I'm not sure of the legality around attempting to get others to breach the law. This 'audit' sounds very much like a phishing scam so perhaps there's legislation that would put this situation outside the law? In any case, I am always extremely cautious about naming and shaming so you should think carefully about answering calls to do so, but there does come a point where whistle-blowing on a massive potential security problem this sort of audit is encouraging is in the public interest.
- madaxe_again 10y ago
  I wouldn't dare name and shame. The worst one liked to sign off phone calls with us and the cliebt with a legal threat in our direction and a horror story in the clients'. Like I said, there are good PCI QSAs out there, but there are also plenty who'll make you want to jump off a bridge. In my opinion it's made the entire standard a total joke. Bully the web provider, ignore the bricks and mortar "write the credit card number and cvv in a ring binder 'process'". Does the retailer no good either, apart from making them feel secure, as that cost so much it must have been good, right? Right?! Yes, I'm bitter.
  - mcherm 10y ago
    Publicly shaming them on Hacker News is one thing, but PCI compliance reviewers are certified; the individual can be reported to the governing agency.
    - Normal_gaussian 10y ago
      s/can/should/ I would say we have a social responsibility to do so
      - akshatpradhan 10y ago
raverbashing 10y ago
The Credit Card companies should be smarter than that but they're the idiots that invented that "VBV/3D" validation (which teaches people to fall for scams) with "partners" that don't even have a valid SSL certificate
- hrrsn 10y ago
  >which teaches people to fall for scams My New Zealand bank (.co.nz) sends you to a page on 'securesuite.co.uk' with their logo and asks for personal details, which goes against pretty much every best practice ever.
  - u02sgb 10y ago
    Pretty sure Nationwide in the UK used to do this too
- sangnoir 10y ago
  > they're the idiots that invented that "VBV/3D" validation No - that's not idiocy, it's actually clever when you realize it's not intended as additional security, but a mechanic to shift the risk from the Credit Card Co's/banks to the card-holder - saving them millions in the process.
dbg31415 10y ago
> PCI experts are the new SEO experts. Was with you until this end comment. A ridiculous percentage of sites have very poor SEO. And you get developers arguing that SEO is bullshit all the time, but clearly there are ways to improve SEO... not hosting identical content on multiple URLs (or using Canonical URLs), having Semantic HTML, making sure your content in the URL / Page Title / Meta Description match terms you're targeting, and getting links back from solid referring sources... all valid. To just dismiss all SEO as junk... it's flippantly short-sighted. There are plenty of sites out there that need better SEO... often as a result of developers not knowing to ask Marketing for copy, or what keywords should be, or not looking at the whole picture. "I get a 200 when I hit the URL, site is done, let's go home, Gents!" Yeah, look... we're on a team, we need to work as a team and that means having teammate's backs when there are things that impact their performance that they may not fully understand. PCI Compliance... is one of these times. Developers will say things like, "Oh, we use Stripe so we're fine... we don't need certification." Or, "Oh we build the site using PCI Best Practices..." or even incorrectly go so far as to say they can certify something as being PCI Compliant. They can't. There are a limited number of places that can certify PCI Compliance, and it's really up to your company's legal team to determine if you need it or not. If you seek insurance, you're going to need it. Occasionally, to get certification, you deal with -- as someone else said here -- someone who isn't technical and who is just trying to cross off questions on their form. The best way to deal with this situation isn't to just dismiss them outright. Without certification your site shuts down. You going to tell the COO / CMO / CEO etc. that the site you built isn't able processes payments any more? Who do you think will be the first one shown the door? So... look, you don't want to fight with bureaucrats. They are dangerously non-technical people doing work that is "technical" and you need to deal with them. When you encounter one, you need to go out of your way to empower that person with alternatives. This auditor is asking for some flat out dangerous information, offer him dates when passwords were changed and your password policy -- which more often than not isn't setup on your servers. How many servers have simple Root passwords, even at the production level? Far, far too many. Because developers / DevOps didn't go that extra mile to make sure the passwords had to be reset ever X days, had to be unique, had to be complex, etc. Sure, the guy doing the audit is dumb, but just because he's dumb doesn't mean you're perfect. Take the opportunity to learn best practices & requirements, enact true best practices, and suggest alternatives. If the alternatives don't satisfy the requirements, keep trying. It's not like PCI compliance standards are hidden, go read up on what the requirements are and come up with your own plan to satisfy them -- then work to communicate that plan with your C-team & legal tema, so they have your back, and can help you in dealing with the auditor. Auditors have bosses too. Everything can be escalated, and depending on how you play this you can have the auditor on your side or not through the escalation. Which way do you think is easier?
oliwarner 10y ago
PCI compliance sales is often much worse than SEO. The economics of selling SEO services revolve around spending money to make things better. Conversely every unsolicited interaction with a PCI auditing firm I've had has been a thinly veiled threat of how many times over we'd be personally bankrupted if an application were flawed. "Look at these people. People like you. They had a nice app and then their app accidentally leaked the names of some child users and now they're in prison on Mars. It'd be a real shame if somebody were to test your application and find a flaw like that and you hadn't hired us. A real shame."
- CiPHPerCoder 10y ago
  This is precisely why, despite being a software security consultant, I don't cold email folks. Even if they don't perceive it as a threat, it feels too much like one to even write such an email.
  - akshatpradhan 10y ago
    Hi, I tried to explain the other deeper complex situation happening with PCI below but it was flagged? Image of flagged post: http://i.imgur.com/eCZHAyJ.png http://i.imgur.com/eCZHAyJ.png This is the reddit link I was referencing in the image: https://www.reddit.com/r/sysadmin/comments/4z25cb/hipaa_breach_case_results_in_record_55m_penalty/d6t5wjd https://www.reddit.com/r/sysadmin/comments/4z25cb/hipaa_brea... If you don't like my HN comment, at least read that reddit post. We need PCI because of the crap observed from that reddit post. "Speaking of PCI, I remember having to tell the PRESIDENT of the company I used to work for that "No, I will not print out the customer database with full CC+3, including their name, address, and phone number. You could ruin the business." Took a while to really make him understand that." If you need a PCI Auditor, make sure they have a background like me: http://www.linkedin.com/in/akshatpradhan http://www.linkedin.com/in/akshatpradhan That's all I want to say. No need to flag me for it...gratuitous negativity?
    - CiPHPerCoder 10y ago
      > If you need a PCI Auditor, make sure they have a background like me Maybe you're being flagged for the blatant self-promotion? I can't say for sure, as I wasn't the one who clicked 'flag'. You may want to tone it down a bit.
chris_wot 10y ago
PCI experts who have clearly never read PCIDSS...
danpalmer 10y ago
> this is pretty much state of the art in the UK Having worked for a company that did PCI compliance in the UK (not it's core business), and therefore alongside a lot of people who had worked at other companies in the sector, I can tell you that this is definitely not the state of the art in the UK in my experience. Most of the major companies doing this in the UK seem to be doing a very good job of it, I think the problem is with the much smaller, cheaper companies. I don't know if they are the majority, I hope not.

jacquesm 10y ago

> £8M How on earth was that spent? That's more than two orders of magnitude more than any PCI audit that I'm aware of (and since the regular requirement is to do that annually the number is even more insane).

pja 10y ago
I would guess that the majority of it was spent on dev work making the company processes fit the insane requirements of their PCI auditor.
- jacquesm 10y ago
  It says it was spent on the auditor, that's why I asked.
  - akshatpradhan 10y ago
    PCI doesn't say anything crazy. Its all reasonable stuff. Scroll to page 20: https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2.pdf https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2.... Networks, System Hardening, Boundary Protection, Access Control. Nothing in the PDF says anything unreasonable. The naysayers just don't want to open up the PDF and READ.
    - jacquesm 10y ago
      Yep. That's why 8M seems totally over the top unless you had a very large setup that was a total mess beforehand and even then it seems outrageous.
madaxe_again 10y ago
The auditor was also a solutions provider. The client was like a deer in headlamps, and had no internal counsel and went utterly paranoid - they had deep pockets, but not enough to avoid a cashflow crisis. To be fair I don't know the precise figure but inferred it from the CVA debtors sheet and some other drama I won't go into, but it's a large multimillion sum. They had an aged epos system that was replaced, new computers for everyone, etc etc.
- jacquesm 10y ago
  Auditors should not wear more than one cap. I don't know how often I haven't been asked to either recommend something, some party, some solution or even to solve a problem myself but I'm extremely strict about this, I simply won't do it. The conflict of interest is such that I think that any auditor / company that doesn't understand this basic principle should not be in this business at all.

abritishguy 10y ago

Name and shame, this auditor is actively damaging security and should be shut down.

RubyPinch 10y ago
Naming and shaming is also going to paint a big target on that company's head, since, you know, they collect plaintext data n' stuff
fdgdasfadsf 10y ago
I suggest being careful with UK libel laws here. I am not a lawyer.
- tankenmate 10y ago
  Indeed, truth is not always an absolute defence in the UK. Also the law varies depending in which jurisdiction you are in in the UK; e.g. England & Wales vs Scotland vs Northern Ireland.
madaxe_again 10y ago
I've worked with about eight or nine. Two of them are jaw drops in horror. A bunch are "err, what?", but get the job done vaguely competently if in a very procedural fashion. Quite often it's totally nontechnical people with backgrounds in finance/filing who do the assessment. Finally, there are two outfits we've worked with that we liked - one well enough to come audit us. Oh, also, the big automated platforms like SM and TW are pretty poor. The way it's set up right now, if you're lucky enough to be deemed a QSA by the PCI council, congratulations, you are now legally welcome to blackmail and extort. Zilch oversight, it's the Wild West, and snake oil salesmen abound.
- tomblomfield 10y ago
  Who were the two you liked? We're looking at various PCI stuff at the moment.

PuffinBlue 10y ago

My bullshit detector was sitting firmly at maximum until your post, now I'm not so sure. I thought that surely and auditor couldn't be asking for plain text passwords, let alone the rest, and maybe this was just a massive troll by the OP. Perhaps not. I've dealt with Data Protection before but I'm not sure of the legality around attempting to get others to breach the law. This 'audit' sounds very much like a phishing scam so perhaps there's legislation that would put this situation outside the law? In any case, I am always extremely cautious about naming and shaming so you should think carefully about answering calls to do so, but there does come a point where whistle-blowing on a massive potential security problem this sort of audit is encouraging is in the public interest.

madaxe_again 10y ago
I wouldn't dare name and shame. The worst one liked to sign off phone calls with us and the cliebt with a legal threat in our direction and a horror story in the clients'. Like I said, there are good PCI QSAs out there, but there are also plenty who'll make you want to jump off a bridge. In my opinion it's made the entire standard a total joke. Bully the web provider, ignore the bricks and mortar "write the credit card number and cvv in a ring binder 'process'". Does the retailer no good either, apart from making them feel secure, as that cost so much it must have been good, right? Right?! Yes, I'm bitter.
- mcherm 10y ago
  Publicly shaming them on Hacker News is one thing, but PCI compliance reviewers are certified; the individual can be reported to the governing agency.
  - Normal_gaussian 10y ago
    s/can/should/ I would say we have a social responsibility to do so
    - akshatpradhan 10y ago

raverbashing 10y ago

The Credit Card companies should be smarter than that but they're the idiots that invented that "VBV/3D" validation (which teaches people to fall for scams) with "partners" that don't even have a valid SSL certificate

hrrsn 10y ago
>which teaches people to fall for scams My New Zealand bank (.co.nz) sends you to a page on 'securesuite.co.uk' with their logo and asks for personal details, which goes against pretty much every best practice ever.
- u02sgb 10y ago
  Pretty sure Nationwide in the UK used to do this too
sangnoir 10y ago
> they're the idiots that invented that "VBV/3D" validation No - that's not idiocy, it's actually clever when you realize it's not intended as additional security, but a mechanic to shift the risk from the Credit Card Co's/banks to the card-holder - saving them millions in the process.

dbg31415 10y ago

> PCI experts are the new SEO experts. Was with you until this end comment. A ridiculous percentage of sites have very poor SEO. And you get developers arguing that SEO is bullshit all the time, but clearly there are ways to improve SEO... not hosting identical content on multiple URLs (or using Canonical URLs), having Semantic HTML, making sure your content in the URL / Page Title / Meta Description match terms you're targeting, and getting links back from solid referring sources... all valid. To just dismiss all SEO as junk... it's flippantly short-sighted. There are plenty of sites out there that need better SEO... often as a result of developers not knowing to ask Marketing for copy, or what keywords should be, or not looking at the whole picture. "I get a 200 when I hit the URL, site is done, let's go home, Gents!" Yeah, look... we're on a team, we need to work as a team and that means having teammate's backs when there are things that impact their performance that they may not fully understand. PCI Compliance... is one of these times. Developers will say things like, "Oh, we use Stripe so we're fine... we don't need certification." Or, "Oh we build the site using PCI Best Practices..." or even incorrectly go so far as to say they can certify something as being PCI Compliant. They can't. There are a limited number of places that can certify PCI Compliance, and it's really up to your company's legal team to determine if you need it or not. If you seek insurance, you're going to need it. Occasionally, to get certification, you deal with -- as someone else said here -- someone who isn't technical and who is just trying to cross off questions on their form. The best way to deal with this situation isn't to just dismiss them outright. Without certification your site shuts down. You going to tell the COO / CMO / CEO etc. that the site you built isn't able processes payments any more? Who do you think will be the first one shown the door? So... look, you don't want to fight with bureaucrats. They are dangerously non-technical people doing work that is "technical" and you need to deal with them. When you encounter one, you need to go out of your way to empower that person with alternatives. This auditor is asking for some flat out dangerous information, offer him dates when passwords were changed and your password policy -- which more often than not isn't setup on your servers. How many servers have simple Root passwords, even at the production level? Far, far too many. Because developers / DevOps didn't go that extra mile to make sure the passwords had to be reset ever X days, had to be unique, had to be complex, etc. Sure, the guy doing the audit is dumb, but just because he's dumb doesn't mean you're perfect. Take the opportunity to learn best practices & requirements, enact true best practices, and suggest alternatives. If the alternatives don't satisfy the requirements, keep trying. It's not like PCI compliance standards are hidden, go read up on what the requirements are and come up with your own plan to satisfy them -- then work to communicate that plan with your C-team & legal tema, so they have your back, and can help you in dealing with the auditor. Auditors have bosses too. Everything can be escalated, and depending on how you play this you can have the auditor on your side or not through the escalation. Which way do you think is easier?

oliwarner 10y ago

PCI compliance sales is often much worse than SEO. The economics of selling SEO services revolve around spending money to make things better. Conversely every unsolicited interaction with a PCI auditing firm I've had has been a thinly veiled threat of how many times over we'd be personally bankrupted if an application were flawed. "Look at these people. People like you. They had a nice app and then their app accidentally leaked the names of some child users and now they're in prison on Mars. It'd be a real shame if somebody were to test your application and find a flaw like that and you hadn't hired us. A real shame."

CiPHPerCoder 10y ago
This is precisely why, despite being a software security consultant, I don't cold email folks. Even if they don't perceive it as a threat, it feels too much like one to even write such an email.
- akshatpradhan 10y ago
  Hi, I tried to explain the other deeper complex situation happening with PCI below but it was flagged? Image of flagged post: http://i.imgur.com/eCZHAyJ.png http://i.imgur.com/eCZHAyJ.png This is the reddit link I was referencing in the image: https://www.reddit.com/r/sysadmin/comments/4z25cb/hipaa_breach_case_results_in_record_55m_penalty/d6t5wjd https://www.reddit.com/r/sysadmin/comments/4z25cb/hipaa_brea... If you don't like my HN comment, at least read that reddit post. We need PCI because of the crap observed from that reddit post. "Speaking of PCI, I remember having to tell the PRESIDENT of the company I used to work for that "No, I will not print out the customer database with full CC+3, including their name, address, and phone number. You could ruin the business." Took a while to really make him understand that." If you need a PCI Auditor, make sure they have a background like me: http://www.linkedin.com/in/akshatpradhan http://www.linkedin.com/in/akshatpradhan That's all I want to say. No need to flag me for it...gratuitous negativity?
  - CiPHPerCoder 10y ago
    > If you need a PCI Auditor, make sure they have a background like me Maybe you're being flagged for the blatant self-promotion? I can't say for sure, as I wasn't the one who clicked 'flag'. You may want to tone it down a bit.

chris_wot 10y ago

PCI experts who have clearly never read PCIDSS...

danpalmer 10y ago

> this is pretty much state of the art in the UK Having worked for a company that did PCI compliance in the UK (not it's core business), and therefore alongside a lot of people who had worked at other companies in the sector, I can tell you that this is definitely not the state of the art in the UK in my experience. Most of the major companies doing this in the UK seem to be doing a very good job of it, I think the problem is with the much smaller, cheaper companies. I don't know if they are the majority, I hope not.