It's possible to go overboard. You could mandate that all credit card data be treated like classified data, no sharing of systems or network domains, label eve

It's possible to go overboard. You could mandate that all credit card data be treated like classified data, no sharing of systems or network domains, label everything, MAC everywhere, encrypt or hash everything at rest... How do you strike a balance between that level of security and the current horrible (I think everyone realizes PCI is horrible) industry self-regulation? a) PCI is lame. b) Auditors audit according to lame PCI standards c) The entire credit card payment scheme is insecure and broken d) Larger companies (payment processors, Citi, or Sony PSN) make juicier targets Doesn't that pretty much sum it up?