full-disclosure - Re: Compliance Is Wasted Money, Study Finds

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 24 Apr 2010 01:02:09 +0200
From: Christian Sciberras <uuf6429@...il.com>
To: BMF <badmotherfsckr@...il.com>
Cc: full-disclosure <full-disclosure@...ts.grok.org.uk>,
	"security-basics@...urityfocus.com" <security-basics@...urityfocus.com>,
	"Thor \(Hammer of God\)" <Thor@...merofgod.com>
Subject: Re: Compliance Is Wasted Money, Study Finds

Payment Gateways are a nice alternative to processing credit cards yourself.
Well, as nice as it gets...

Other then that, it's not me that is being "absolutist", but rather seeing
this from a company perspective.

"Nobody has ever claimed that PCI makes you secure."
Interesting statement. Why's the need for PCI then? (don't bother with an
answer)

"It is a minimal standard which experience has shown most companies need
spelled out for them."
Exactly.
So where was the security again?

On Sat, Apr 24, 2010 at 12:56 AM, BMF <badmotherfsckr@...il.com> wrote:

> On Fri, Apr 23, 2010 at 3:33 PM, Christian Sciberras <uuf6429@...il.com>
> wrote:
> > 4) I've looked into whether it was into our best interest to use PCI. (it
> > was decided that it wasn't worth the trouble)
> > At that time, I knew about PCI but not its details, at which point we got
> > someone to explain in detail for us.
>
> This right here screams "bullshitter". It isn't as if you get to
> decide if you want to use PCI or not. If you process credit cards with
> the major card brands you are going to do PCI either now or
> eventually. There is no other security standard which you can choose.
> You also show signs of being a victim of absolutism. Nobody has ever
> claimed that PCI makes you secure. It is a minimal standard which
> experience has shown most companies need spelled out for them. There
> is much more than just the things spelled out by PCI that need to be
> done. As usual in these situations, your real complaint isn't about
> PCI but about the people who just don't get the point.
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/