4 ms·

> PCI experts are the new SEO experts. Was with you until this end comment. A ridiculous percentage of sites have very poor SEO. And you get developers argui

> PCI experts are the new SEO experts. Was with you until this end comment. A ridiculous percentage of sites have very poor SEO. And you get developers arguing that SEO is bullshit all the time, but clearly there are ways to improve SEO... not hosting identical content on multiple URLs (or using Canonical URLs), having Semantic HTML, making sure your content in the URL / Page Title / Meta Description match terms you're targeting, and getting links back from solid referring sources... all valid. To just dismiss all SEO as junk... it's flippantly short-sighted. There are plenty of sites out there that need better SEO... often as a result of developers not knowing to ask Marketing for copy, or what keywords should be, or not looking at the whole picture. "I get a 200 when I hit the URL, site is done, let's go home, Gents!" Yeah, look... we're on a team, we need to work as a team and that means having teammate's backs when there are things that impact their performance that they may not fully understand. PCI Compliance... is one of these times. Developers will say things like, "Oh, we use Stripe so we're fine... we don't need certification." Or, "Oh we build the site using PCI Best Practices..." or even incorrectly go so far as to say they can certify something as being PCI Compliant. They can't. There are a limited number of places that can certify PCI Compliance, and it's really up to your company's legal team to determine if you need it or not. If you seek insurance, you're going to need it. Occasionally, to get certification, you deal with -- as someone else said here -- someone who isn't technical and who is just trying to cross off questions on their form. The best way to deal with this situation isn't to just dismiss them outright. Without certification your site shuts down. You going to tell the COO / CMO / CEO etc. that the site you built isn't able processes payments any more? Who do you think will be the first one shown the door? So... look, you don't want to fight with bureaucrats. They are dangerously non-technical people doing work that is "technical" and you need to deal with them. When you encounter one, you need to go out of your way to empower that person with alternatives. This auditor is asking for some flat out dangerous information, offer him dates when passwords were changed and your password policy -- which more often than not isn't setup on your servers. How many servers have simple Root passwords, even at the production level? Far, far too many. Because developers / DevOps didn't go that extra mile to make sure the passwords had to be reset ever X days, had to be unique, had to be complex, etc. Sure, the guy doing the audit is dumb, but just because he's dumb doesn't mean you're perfect. Take the opportunity to learn best practices & requirements, enact true best practices, and suggest alternatives. If the alternatives don't satisfy the requirements, keep trying. It's not like PCI compliance standards are hidden, go read up on what the requirements are and come up with your own plan to satisfy them -- then work to communicate that plan with your C-team & legal tema, so they have your back, and can help you in dealing with the auditor. Auditors have bosses too. Everything can be escalated, and depending on how you play this you can have the auditor on your side or not through the escalation. Which way do you think is easier?

thesehands 10y ago
I think emphasis in that was meant on 'experts', pointing out that self proclaimed experts may not necessarily be considered experts by their peers.
shedside 10y ago
In what way are you not fine if you're using Stripe? Do you contend that you still need PCI Certification even if you're only using Stripe?
- kalleboo 10y ago
  You don't need an audit, but you still fall under the scope of PCI-DSS and need to fill out the Self-Assessment Questionnaire "SAQ A"
  - GordonS 10y ago
    stripe actually automatically does this for you
- ajdlinux 10y ago
  https://stripe.com/docs/security https://stripe.com/docs/security
- dbg31415 10y ago
  > Do you contend that you still need PCI Certification even if you're only using Stripe? Yes, if you have BOP or other form of liability insurance, one of the questions is frequently, "Are you PCI DSS Compliant?" If your legal team feels comfortable with your self-assessment for certification... sure, go with that. When it comes to your business, I think 3rd Party Audits can be quite helpful. Here's an example question I pulled from an RFP just yesterday: http://i.imgur.com/R2WCOvY.png http://i.imgur.com/R2WCOvY.png Here's an example I pulled from another client's liability insurance questionnaire: http://i.imgur.com/1s7zBkd.png http://i.imgur.com/1s7zBkd.png What do you think sounds better, A or B? A) "Yes, we are compliant, and verified through self-assessment..." B) "Yes, we are compliant and verified annually with XYZ Certification Company..." But look, my main point was that with all of this there are non-technical considerations that play in. One team doesn't have all the answers, it takes a variety of disciplines working together to make a company run. Dismissing people who say PCI compliance is not just a technical issue shouldn't be the automatic response. EDIT: Let me follow up with another example... let's say you're the developer of an eCommerce system. You set it up to use Stripe and you've done everything correctly in terms of selecting a PCI Compliant hosting partner, etc. What happens when customer support decides to, after processing a refund, help the customer re-order something? They take the customer's credit card over the phone, and create a new order for the user using the admin tools of the site... they're being helpful and accelerating the re-order process. But... presto you are no longer just a shop that just uses Stripe. How do we ensure that data is being handled correctly, that our staff haven't written down CCs or haven't stored them somewhere? 3rd Party audits can help a company uncover issues like this. And you, as the developer, don't want the liability of saying, "Yes we filled out the self-assessment and everything was great!" because you don't have visibility into how the tools you built get used after you hand them over to the client. It's worth reading the actual guidelines for self-assessment if you have time, then you know for yourself if something is BS or not. Note that if you don't fall nicely into one of these categories, you don't qualify for self-assessment. (Check out A-EP for stores that exclusively use Stripe.) * https://www.pcisecuritystandards.org/documents/SAQ_InstrGuidelines_v3-1.pdf https://www.pcisecuritystandards.org/documents/SAQ_InstrGuid...

thesehands 10y ago

I think emphasis in that was meant on 'experts', pointing out that self proclaimed experts may not necessarily be considered experts by their peers.

shedside 10y ago

In what way are you not fine if you're using Stripe? Do you contend that you still need PCI Certification even if you're only using Stripe?

kalleboo 10y ago
You don't need an audit, but you still fall under the scope of PCI-DSS and need to fill out the Self-Assessment Questionnaire "SAQ A"
- GordonS 10y ago
  stripe actually automatically does this for you
ajdlinux 10y ago
https://stripe.com/docs/security https://stripe.com/docs/security
dbg31415 10y ago
> Do you contend that you still need PCI Certification even if you're only using Stripe? Yes, if you have BOP or other form of liability insurance, one of the questions is frequently, "Are you PCI DSS Compliant?" If your legal team feels comfortable with your self-assessment for certification... sure, go with that. When it comes to your business, I think 3rd Party Audits can be quite helpful. Here's an example question I pulled from an RFP just yesterday: http://i.imgur.com/R2WCOvY.png http://i.imgur.com/R2WCOvY.png Here's an example I pulled from another client's liability insurance questionnaire: http://i.imgur.com/1s7zBkd.png http://i.imgur.com/1s7zBkd.png What do you think sounds better, A or B? A) "Yes, we are compliant, and verified through self-assessment..." B) "Yes, we are compliant and verified annually with XYZ Certification Company..." But look, my main point was that with all of this there are non-technical considerations that play in. One team doesn't have all the answers, it takes a variety of disciplines working together to make a company run. Dismissing people who say PCI compliance is not just a technical issue shouldn't be the automatic response. EDIT: Let me follow up with another example... let's say you're the developer of an eCommerce system. You set it up to use Stripe and you've done everything correctly in terms of selecting a PCI Compliant hosting partner, etc. What happens when customer support decides to, after processing a refund, help the customer re-order something? They take the customer's credit card over the phone, and create a new order for the user using the admin tools of the site... they're being helpful and accelerating the re-order process. But... presto you are no longer just a shop that just uses Stripe. How do we ensure that data is being handled correctly, that our staff haven't written down CCs or haven't stored them somewhere? 3rd Party audits can help a company uncover issues like this. And you, as the developer, don't want the liability of saying, "Yes we filled out the self-assessment and everything was great!" because you don't have visibility into how the tools you built get used after you hand them over to the client. It's worth reading the actual guidelines for self-assessment if you have time, then you know for yourself if something is BS or not. Note that if you don't fall nicely into one of these categories, you don't qualify for self-assessment. (Check out A-EP for stores that exclusively use Stripe.) * https://www.pcisecuritystandards.org/documents/SAQ_InstrGuidelines_v3-1.pdf https://www.pcisecuritystandards.org/documents/SAQ_InstrGuid...