4 ms·
> I would guess that, contrary to your implication, they are not an approved scanning vendor. If this is the case then it really does not speak to the character
by monadic2 7y ago
> I would guess that, contrary to your implication, they are not an approved scanning vendor. If this is the case then it really does not speak to the characteristics of PCI-DSS and your comment just seems wrong.
Actually this makes a pretty good case for this regulation being a joke. They clearly aren’t up to the responsibility of being a payment processor and are leaning on the law to sustain their business rather than simply demonstrating aptitude directly.
- moftz 7y agoWhy does the regulatory body get to approve who and what can scan implementations of their security scheme? It seems like the ideal auditor and scanning software, in PCI DSS's eyes, would be the one that just barely checks the boxes for minimum security requirements. Poking too hard at their security scheme would reveal how lackluster it is but they still need someone to poke at it to prove compliance. Being able to ignore anyone or anything that isn't on the approved list seems like willful negligence.
- michaelt 7y ago> Why does the regulatory body get to approve who and what can scan implementations of their security scheme? Because it's a scanner for PCI-DSS compliance, not a scan for security issues. They do not fear that unapproved scanners will be more strict than approved scanners, they fear they will be less strict.
- tedunangst 7y agoBecause when you make the rules you get to make the rules?
- marcus_holmes 7y agoIt works better this way around than the other way around - which would be that PayPal gets to pick who audits them with no oversight. You can imagine how thorough that audit would be, and how many times it would find any problems.
- shkkmo 7y ago> Actually this makes a pretty good case for this regulation being a joke. PCI-DSS is not government regulation, but an industry created and enforced standard. Compliance is not mandated by federal law and only a couple of states have laws that reference it. For example, Nevada requires compliance while Washington doesn't require compliance but does remove liability for breaches for compliant businesses.
- monadic2 7y agoI meant it in a looser sense (like “constraint” I guess), but it just reinforces the reputation that PCI-DSS is a checklist you can buy, not meaningful itself.
- whatsmyusername 7y agoIt's not a regulation. It's a contractual obligation between the merchant and the PCI counsel (which is made up by VISA/Mastercard/the backing banks/etc). It was put in place to avoid regulation.
- Mirioron 7y agoThen perhaps regulation is necessary if this is their level of scrutiny?
- deleted 7y ago[deleted]
- smolder 7y agoYeah, but in this political climate, we probably can't get regulation passed that isn't written by the companies it regulates.
- whatsmyusername 7y agoThat will never happen under any circumstance.
- vel0city 7y agoregulation: noun. a rule or directive made and maintained by an authority. Regulations can be self-imposed on an industry, it does not have to be something the government imposes. Calling PCI-DSS a regulation is still accurate despite many people conflating the term "regulation" solely with government action. In this case, the authority creating the regulations is the PCI Security Standards Council who have their power because the big players in the industry give it to them.
- piinthesky 7y agoPCI-DSS is a joke, just look at all the zero days that have gone on before today, Comodo the CA hacked, DigiNotar to name a few, the recent zero day in Windows hilighted by none other than the NSA back in Jan. The public have ADHD attention spans, so who cares as long as the money keeps rolling in hey? Do you think your politicians, law enforcement, big businesses or Banksters give a toss? Criminals rule the world and its been going on for thousands of years with people believing in things like Religion and Royalty!
- tptacek 7y agoThey "clearly aren't up to the responsibility"? Paypal has one of the larger application security teams in SFBA. You've decided they're not qualified because someone reported a self-XSS and Paypal didn't freak out? Did you read downthread about the actual "2FA" feature this team "bypassed"?
- rasengan 7y ago> Paypal has one of the larger application security teams in SFBA. It's not the size that matters, but how you use it that counts.
- pnutjam 7y agoSorry, technically correct is best correct. Don't look behind the curtain.