3 ms·
Why does the regulatory body get to approve who and what can scan implementations of their security scheme? It seems like the ideal auditor and scanning softwar
by moftz 7y ago
Why does the regulatory body get to approve who and what can scan implementations of their security scheme? It seems like the ideal auditor and scanning software, in PCI DSS's eyes, would be the one that just barely checks the boxes for minimum security requirements. Poking too hard at their security scheme would reveal how lackluster it is but they still need someone to poke at it to prove compliance. Being able to ignore anyone or anything that isn't on the approved list seems like willful negligence.
- michaelt 7y ago> Why does the regulatory body get to approve who and what can scan implementations of their security scheme? Because it's a scanner for PCI-DSS compliance, not a scan for security issues. They do not fear that unapproved scanners will be more strict than approved scanners, they fear they will be less strict.
- tedunangst 7y agoBecause when you make the rules you get to make the rules?
- marcus_holmes 7y agoIt works better this way around than the other way around - which would be that PayPal gets to pick who audits them with no oversight. You can imagine how thorough that audit would be, and how many times it would find any problems.