Just as a quick aside: PCI compliance is a huge (mandatory) motivation that fuels much of the information security industry. While I'm careful not to "bite the

Just as a quick aside: PCI compliance is a huge (mandatory) motivation that fuels much of the information security industry. While I'm careful not to "bite the hand that feeds," there is a large gap between being PCI compliant and being in any way secure. For those that are interested, hacker/security conferences such as DEF CON, Black Hat, ShmooCon, etc. regularly have interesting presentations on completely owning PCI compliant networks.