4 ms·

Question for experts: Is a PCI DSS certification supposed to take care of aspects like plain text passwords or credit card info & such vulnerabilities as well?

Question for experts: Is a PCI DSS certification supposed to take care of aspects like plain text passwords or credit card info & such vulnerabilities as well? Gist of what I find in wikipedia is this: PCI DSS Requirements: Build and Maintain a Secure Network 1. Install and maintain a firewall configuration to protect cardholder data 2. Do not use vendor-supplied defaults for system passwords and other security parameters Protect Cardholder Data 3. Protect stored cardholder data 4. Encrypt transmission of cardholder data across open, public networks Maintain a Vulnerability Management Program 5. Use and regularly update anti-virus software on all systems commonly affected by malware 6. Develop and maintain secure systems and applications Implement Strong Access Control Measures 7. Restrict access to cardholder data by business need-to-know 8. Assign a unique ID to each person with computer access 9. Restrict physical access to cardholder data Regularly Monitor and Test Networks 10. Track and monitor all access to network resources and cardholder data 11. Regularly test security systems and processes Maintain an Information Security Policy 12. Maintain a policy that addresses information security

drtse4 15y ago
I've just read the wikipedia entry (http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Secu...), sadly it smells like CMMI.
- kamaal 15y ago
  How does that justify not using one's brain? Well the problem is simple. Some things break or get messed up. Now a root cause analysis is done and its found if a particular thing had been taken care of, the problem would have been avoided. So now what is the step taken? The solution to the root cause analysis is put as a 'checklist' and now applied to everything or when something is done. And this is put in as a process. Do this, do that... every time you deploy or code something. Now here comes the problem, the people who write the checklist understand that its only a guidance rather than a compliance document. People who come later or those who don't think take the both the process and checklist as some sort of document which if you adhere to, your job is done. And anything and everything else can be done without proper testing or thinking. This goes on until something breaks again, root cause is now found and it goes into that checklist. Its this sort of approach to technology and programming that is creating all the problems in software today. No certification can fix this problem.

drtse4 15y ago

I've just read the wikipedia entry (http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Secu...), sadly it smells like CMMI.

kamaal 15y ago
How does that justify not using one's brain? Well the problem is simple. Some things break or get messed up. Now a root cause analysis is done and its found if a particular thing had been taken care of, the problem would have been avoided. So now what is the step taken? The solution to the root cause analysis is put as a 'checklist' and now applied to everything or when something is done. And this is put in as a process. Do this, do that... every time you deploy or code something. Now here comes the problem, the people who write the checklist understand that its only a guidance rather than a compliance document. People who come later or those who don't think take the both the process and checklist as some sort of document which if you adhere to, your job is done. And anything and everything else can be done without proper testing or thinking. This goes on until something breaks again, root cause is now found and it goes into that checklist. Its this sort of approach to technology and programming that is creating all the problems in software today. No certification can fix this problem.