4 ms·
It seems that the auditor wanted a fancier designation and decided upon "security auditor". It is also possible that the auditor in question worked in a (physi
by 0xmohit 10y ago
It seems that the auditor wanted a fancier designation and decided upon "security auditor".
It is also possible that the auditor in question worked in a (physical) security agency in past life and failed to understand that computer security is not quite the same.
That seems to be the only plausible explanation for demanding actual plain-text passwords (past/present/whatever) and so on.
- madaxe_again 10y agoOh, that old chestnut. Actually have exactly that at a client, guy used to run physical security at their stores and is now head of infosec but he's a lovely bloke and knows he's out of his depth, and has chosen good expert outside advice - we actually met the QSA we like through them. Thing is in some regards PCI is quite analogous to physical security, as a lot of it is about documented process and auditability. Hell, a chunk of it is physical security. So that progression isn't so bad, and as usual, you just get people who are willing to acknowledge their own shortcomings and work with others to resolve or mitigate against them, and those who don't.