3 ms·

This is the correct answer. Unfortunately PCI dictates that you can use WAFs instead of real coding standards and testing. For anyone curious why WAFs are so u

This is the correct answer. Unfortunately PCI dictates that you can use WAFs instead of real coding standards and testing. For anyone curious why WAFs are so useless, there is a very beginner-accessible talk by Joe McCray here: https://www.youtube.com/watch?v=qBVThFwdYTc https://www.youtube.com/watch?v=qBVThFwdYTc

wil421 8y ago
The company I work at has many PCI compliant systems. I asked a security officer why they were still doing certain things the old way. He explained they very well know it’s the old way but in order to be compliant they must do it.
- clhodapp 8y ago
  It's not about old vs new, it's about strong vs weak. WAF was too weak to be your primary line of defense against SQL injection when it was first popularized and it's still too weak now.
- henvic 8y ago
  I'm curious by what do you mean 'old way' for the very reason exposed above. Would you mind to give some examples?
  - liveoneggs 8y ago
    do you have mod_security and the standard rules? Yes do you write custom rules based on your actual application? <- not a real question
  - wil421 8y ago
    A simple example would be changing passwords every 90 days. It’s been proven users will choose less secure passwords. Here is an article from the FTC and one about NIST guidelines. https://www.ftc.gov/news-events/blogs/techftc/2016/03/time-rethink-mandatory-password-changes https://www.ftc.gov/news-events/blogs/techftc/2016/03/time-r... https://qz.com/981941/the-us-standards-office-wants-to-do-away-with-periodic-password-changes/ https://qz.com/981941/the-us-standards-office-wants-to-do-aw...
- all_blue_chucks 8y ago
  Where I work Compliance and Security are completely different departments. This is great because the Security department does whatever they think is best for security, regardless of compliance requirements. The Compliance department has one job: passing audits. They never tell Security what to do; they document "compensating controls" and if that's not good enough for an Auditor the Compliance department will run whatever worthless compliance control themselves. I'm not saying security compliance itself is a joke. It forces small businesses to at least try to get their shit together. But for big tech companies with real security programs, security compliance is a worthless tax.

wil421 8y ago

The company I work at has many PCI compliant systems. I asked a security officer why they were still doing certain things the old way. He explained they very well know it’s the old way but in order to be compliant they must do it.

clhodapp 8y ago
It's not about old vs new, it's about strong vs weak. WAF was too weak to be your primary line of defense against SQL injection when it was first popularized and it's still too weak now.
henvic 8y ago
I'm curious by what do you mean 'old way' for the very reason exposed above. Would you mind to give some examples?
- liveoneggs 8y ago
  do you have mod_security and the standard rules? Yes do you write custom rules based on your actual application? <- not a real question
- wil421 8y ago
  A simple example would be changing passwords every 90 days. It’s been proven users will choose less secure passwords. Here is an article from the FTC and one about NIST guidelines. https://www.ftc.gov/news-events/blogs/techftc/2016/03/time-rethink-mandatory-password-changes https://www.ftc.gov/news-events/blogs/techftc/2016/03/time-r... https://qz.com/981941/the-us-standards-office-wants-to-do-away-with-periodic-password-changes/ https://qz.com/981941/the-us-standards-office-wants-to-do-aw...
all_blue_chucks 8y ago
Where I work Compliance and Security are completely different departments. This is great because the Security department does whatever they think is best for security, regardless of compliance requirements. The Compliance department has one job: passing audits. They never tell Security what to do; they document "compensating controls" and if that's not good enough for an Auditor the Compliance department will run whatever worthless compliance control themselves. I'm not saying security compliance itself is a joke. It forces small businesses to at least try to get their shit together. But for big tech companies with real security programs, security compliance is a worthless tax.