4 ms·

If credit card data is going to pass through the device, anti-virus software is mandated by PCI-DSS.

by andrewf 16y ago

Raphael_Amiard 16y ago
It's still wrong. Anti virus software in general are not very far from virii themselves in what they do to your computer. This whole macafee story just proves the point, but it's not the first time such a thing happens. AVG had that happen to them too a year back.
noonespecial 16y ago
Hmmm interestingly, the "unix exemption" seems to have been dropped from 1.1 to 1.2 of DSS document. Part 5.1 used to include this note: Note: Systems commonly affected by viruses typically do not include UNIX based operating systems or mainframes. Consumer grade MacAfee that auto updates is still probably a very poor choice for this application as they should have a test bed in the lab that they beta all changes on before they roll out to thousands of machines that likely need a truck roll if something goes wrong.
- count 16y ago
  You can run McAfee on linux now as well (mostly for scanning email and CIFS shared files, I assume?). PCI DSS and DoD IA controls require it. Enterprise grade McAfee still sucks, it's just a more manageable suck. Despite that, it still blew up with the bad DAT file - those are the same between product lines.
dalore 16y ago
The WTF here is that anti-virus software is mandated by PCI-DSS and not procedures that stop virii in the first place.
Luyt 16y ago
> If credit card data is going to pass through the device, anti-virus software is mandated by PCI-DSS. Even when the POS is not running Windows? Or does the PCI-DSS assume all computers are running Windows?
- noonespecial 16y ago
  Its a perfect example of the classic "if it can then it must" brainless rule application. I once had a car that had a bad bulb socket in the "cyclops" brake light so it wouldn't pass inspection. Did I fix the socket to get past? Hell no. I removed the whole light. If it wasn't there, it didn't have to work. Those were the rules.

If credit card data is going to pass through the device, anti-virus software is mandated by PCI-DSS.

by andrewf 16y ago

If credit card data is going to pass through the device, anti-virus software is mandated by PCI-DSS.

It's still wrong. Anti virus software in general are not very far from virii themselves in what they do to your computer. This whole macafee story just proves the point, but it's not the first time such a thing happens. AVG had that happen to them too a year back.

noonespecial 16y ago

Hmmm interestingly, the "unix exemption" seems to have been dropped from 1.1 to 1.2 of DSS document. Part 5.1 used to include this note: Note: Systems commonly affected by viruses typically do not include UNIX based operating systems or mainframes. Consumer grade MacAfee that auto updates is still probably a very poor choice for this application as they should have a test bed in the lab that they beta all changes on before they roll out to thousands of machines that likely need a truck roll if something goes wrong.

count 16y ago
You can run McAfee on linux now as well (mostly for scanning email and CIFS shared files, I assume?). PCI DSS and DoD IA controls require it. Enterprise grade McAfee still sucks, it's just a more manageable suck. Despite that, it still blew up with the bad DAT file - those are the same between product lines.

dalore 16y ago

The WTF here is that anti-virus software is mandated by PCI-DSS and not procedures that stop virii in the first place.

Luyt 16y ago

> If credit card data is going to pass through the device, anti-virus software is mandated by PCI-DSS. Even when the POS is not running Windows? Or does the PCI-DSS assume all computers are running Windows?

noonespecial 16y ago
Its a perfect example of the classic "if it can then it must" brainless rule application. I once had a car that had a bad bulb socket in the "cyclops" brake light so it wouldn't pass inspection. Did I fix the socket to get past? Hell no. I removed the whole light. If it wasn't there, it didn't have to work. Those were the rules.