3 ms·
That's because it's designed to be impossible to implement. Note that: > "no compromised entity has yet been found to be in compliance with PCI DSS at the time
by melolife 6y ago
That's because it's designed to be impossible to implement. Note that:
> "no compromised entity has yet been found to be in compliance with PCI DSS at the time of a breach."
https://www.computerworld.com/article/2531828/post-breach-criticism-of-pci-security-standard-misplaced--visa-exec-says.html https://www.computerworld.com/article/2531828/post-breach-cr...
- gowld 6y agoWhat about entities that haven't been breached?
- zdragnar 6y agoThey are irrelevant. PCI compliance protects people by prohibiting unsafe storage of sensitive information in case of a breach. As a result, fewer companies store the data unsafely, but speaking strictly in terms of "entities that haven't been breached" then PCI compliance doesn't really matter one way or the other.
- tikhonj 6y agoThe easiest way to come up with rules where no compromised entity is found in compliance is to make the rules impossible (or wildly impractical) for anyone to comply with. If it were a matter of "we 100% know lots of companies that haven't had breaches fully comply with the rules", it would be a relevant data point. If we don't know that, we can just assume that the rules—much like our legal code—are written in a way where a motivated auditor can always find non-compliance. "Give me six lines written by the most honorable of men, and I will find an excuse in them to hang him." and all that...