full-disclosure - Re: Compliance Is Wasted Money, Study Finds

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <optid.5729b21091.58DB1B68E62B9F448DF1A276B0886DF112DE3FFE@EX2010.hammerofgod.com>
Date: Fri, 23 Apr 2010 16:07:07 +0000
From: "Thor (Hammer of God)" <Thor@...merofgod.com>
To: Christopher Gilbert <motoma@...il.com>, Mike Hale
	<eyeronic.design@...il.com>
Cc: full-disclosure <full-disclosure@...ts.grok.org.uk>,
	"security-basics@...urityfocus.com" <security-basics@...urityfocus.com>
Subject: Re: Compliance Is Wasted Money, Study Finds

Another thing that I think people fail to keep in mind is that when it comes to PCI, it is part of a contractual agreement between the entity and card facility they are working with.   If a business wants to accept credit cards as a means of payment (based on volume) then part of their agreement is that they must undergo compliance to a standard implemented by the industry.  I don't know why people get all emotional about it and throw up their hands with all the "this is wasted money" positioning - it's not wasted at all; it is simply part of the cost of doing business in that market.

t

From: full-disclosure-bounces@...ts.grok.org.uk [mailto:full-disclosure-bounces@...ts.grok.org.uk] On Behalf Of Christopher Gilbert
Sent: Thursday, April 22, 2010 4:48 PM
To: Mike Hale
Cc: full-disclosure; security-basics@...urityfocus.com
Subject: Re: [Full-disclosure] Compliance Is Wasted Money, Study Finds

The paper concludes that companies are underinvesting in--or improperly prioritizing--the protection of their secrets. Nowhere does it state that the money spent on compliance is money wasted.
On Wed, Apr 21, 2010 at 5:44 PM, Mike Hale <eyeronic.design@...il.com<mailto:eyeronic.design@...il.com>> wrote:
I find the findings completely flawed.  Am I missing something?

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/