> If there is a corrupt Security Assessor, the problem is bigger than one processor Huh? As a service provider who has to deal with these third parties (for o

> If there is a corrupt Security Assessor, the problem is bigger than one processor Huh? As a service provider who has to deal with these third parties (for our hosted/colo type of clients) I would say I have yet to find one that isn't corrupt. They basically are completely worthless, at least at the lower-tiers. They more or less run nmap and a nessus scan, and then tell the client how to game those scans without improving security whatsoever (e.g. hiding an exploitable version of PHP's version banner, firewalling the test probe IPs from certain ports the world can see, etc.). In fact, from a service provider perspective PCI has made things less secure since we no longer have as much traction with clients when we tell them they need to do X to store financial data securely. Now they can point to their "audit" and say it's fine. > Visa is quite serious about enforcing those standards. Not in my experience. They only seem to care after a breach happens and only for PR purposes. Report anything before that, and from what I can tell it's completely ignored. That said, we generally don't deal with the higher compliance levels - those that do, seem to get it more or less right (or at least put resources and thought into it if nothing else).