3 ms·
PCI standard is the minimum requirement. In my experience, people don't really think about security and PCI at least forces them to think and ask questions. Fro
by lsh123 13y ago
PCI standard is the minimum requirement. In my experience, people don't really think about security and PCI at least forces them to think and ask questions. From this perspective, PCI is actually doing its job.
- windexh8er 13y agoThe problem is that there is no transparency to the end user (customer). As stated previously PCI is a barebones set of recommendations that doesn't make any commitments to a real world security model at all. Instead it is more of a revenue model than a tool that helps offset risk for businesses. All of the audit and products built around it are mostly as valuable as PCI itself. If PCI were to be revamped an actual assessment which graded real-world efficacy would be transparent to the customer prior to purchase. Real-world efficacy is the hard part, as it is not a static of any sort. TL;DR Businesses are bound by process and governance. Attackers are not. If you use PCI as a driver for security implementation you will fail. PCI 'compliance' continues to be a fallacy of warm and fuzzy security kittens.