3 ms·
Another thing to keep in mind is that a lot of these lists are compliance-driven. - Hosts which process credit cards (PCI) - Hosts which reconcile the ge
by agnokapathetic 11y ago
Another thing to keep in mind is that a lot of these lists are compliance-driven.
- Hosts which process credit cards (PCI)
- Hosts which reconcile the general ledger (SOX)
- Hosts with medical data (HIPAA)
- Hosts with student data (FERPA)
The problem is that while the security of the enumerated hosts is taken quite seriously, systems which have security trust relationships which grant access to the enumerated hosts are not locked down.
- PCI Payment Processing Application server: locked down.
- CI system with deployment keys to said host: zero authentication.
- emidln 11y agoIf there was a PCI audit, that CI system would fall inside the audit's scope and thus held to the same rules as the app server.