3 ms·
> If such an option is allowed by PCI, what is even the point of making it a requirement? The point of all those certifications (I took companies through the p
by xtracto 5y ago
> If such an option is allowed by PCI, what is even the point of making it a requirement?
The point of all those certifications (I took companies through the processes required for PCI, SOC2, and ISO27001 ) is security theater, a path in the back for the execs, the ability to have "I'm not to blame, I have this cert" in case of some shit happening, and the ability for sales to throw TLAs to prospects to show how Seriously(tm) the company takes security. Oh, and to check boxes to be able to transact with some large corporations.
There are plenty of stories of highly certified companies that were deeply penetrated and exposed, and all their security theater did not help.
- tptacek 5y agoIt's an extremely low bar for cluefulness. There is space between the bar and the ground, but most serious going concerns clear it easily unless they screw up the compliance process and make things hard for themselves. The problem isn't these low bars, but rather the market for services to "help" people clear them, and the widespread perception that the bars are higher than they actually are.