4 ms·
Like PCI compliance? Ask people who've gone through that process how rigorous it is...
by adekok 9y ago
Like PCI compliance?
Ask people who've gone through that process how rigorous it is...
- paulddraper 9y agoIt's rigorous, but in all the wrong ways. At $DAY_JOB our security falls into two buckets (1) PCI and (2) stuff that keeps us secure. IDK if it's possible to have a widely accepted security standard that isn't checking nonsensical and out-of-date boxes.
- unscaled 9y agoWell, it could be worse: 1) Stuff that keeps you insecure (a.k.a ISO 27001 ISMS stuff) 2) Stuff that somewhat helps, but is covered by fluff (a.k.a. PCI-DSS) 3) Stuff that actually keeps you secure. PCI-DSS at least gives you a sledgehammer to convince lazy low-level managers to dump ciphers like RC4 and encrypt some of their data. It's not utopia, and it does err on the side of perpetuating banks' infatuation with 3DES too much, but I saw getting good stuff done by using it as an excuse. You still need to have a competent security team of course, but it helps them not being ignored. Well, sometimes.
- paulddraper 9y agoPCI is why we have weak passwords that we have to reinvent every 90 days.