4 ms·
Wouldn't doing that be a massive PCI violation? Aren't there extensive audits for this sort of thing?
by jlgreco 14y ago
Wouldn't doing that be a massive PCI violation? Aren't there extensive audits for this sort of thing?
- tptacek 14y agoExtensive PCI audits. Heh.
- jimktrains2 14y agoLike the "scan" that said our linux boxes were running an out-of-date version of IIS.
- psychometry 14y agoThat compliance web form I absentmindedly clicked through sure had a lot of buttons.
- larrys 14y agoCan't think of the exact word to describe that practice (what you did in response to the long list of questions which I've seen) but on the part of the company requesting you to answer the questions it's more or less a "absence of malice" type of thing that allows them to appear that they are doing the right thing while fully knowing that people are doing what you are doing. It's a "we will look the other way until we need to show that it's not our fault because we have passed the liability to you - look you acknowledge doing all the right things".
- 3825 14y agoIt does not mean anything until they decide you are not compliant and you need to prove you are compliant. (I've never had to but I'd appreciate insight from people who have)
- pointyhatuk 14y agoErr no. PCI DSS is basically farts in the wind. Its beyond useless and the testing agencies are all snake oil salesmen.
- toomuchtodo 14y agoI've done PCI "audits" for several companies I've worked for; it's a checklist you go down yourself. That's why its called a "pci self assessment".
- tptacek 14y agoActually, if you're processing cards directly, you do in fact need to have an PCI-qualified outside firm† (a QSA) audit you for PCI compliance. But those audits are notoriously superficial; PCI audits are a race-to-the-bottom affair. † We are not one of those.
- trafficlight 14y agoEvery one of these reviews that I've been involved in has been conducted by a couple of guys with laughable abilities.
- tptacek 14y agoThe quality of PCI security audits is a continual aggravation to everyone I routinely talk to in my industry. I've told more than one client: if you need a QSA audit, get the cheapest one you can. If you need a software security assessment, don't use a QSA firm.
- flyt 14y agoNote that you hire those firms yourself, and they work for you. They want you to pass the audit and will work to make that happen.
- larrys 14y ago"But those audits are notoriously superficial" Will add that just having gone through an ICANN registrar audit (which by the way were specified and supposed to be done literally 10 or 12 years ago but never requested by ICANN) with a third party company hired (accounting firm) it's total compliance theater. Add: "hired by ICANN after a bidding process". Same happened with data escrow which was just implemented a few years ago and is operated by Iron Mountain.
- FlyingAvatar 14y agoMost PCI audits are not mandatory unless you have had a breech that compromises data. Before that "self-certification" reigns.
- Thebigcheeze 14y agoCompanies are split into PCI Levels based on how much money/customers they handle. Level 1 are big companies like amazon, level 2 are medium sized online retailers generally, and level 3 are smaller retailers. The 'lower' your level, the easier the PCI audits are. If you are level 1 you have mandatory external audits. If you are level 2 you have a 'self assessment' which is basically a checklist which says "Yes, I promise I'm in compliance". If you have a confirmed breach, you are upgraded to Level 1 merchant audit requirements. This is generally quite costly as the external audit is extensive and must be paid for.
- bifrost 14y agoThe audits are toothless and ultimately the audit only happens once (if ever) and people keeping pub/secret key in the same place unprotected... well.... They're just unlikely to get security at all...