full-disclosure - Re: EE BrightBox router hacked

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140116195932.GH32486@tracyreed.org>
Date: Thu, 16 Jan 2014 11:59:32 -0800
From: Tracy Reed <treed@...raviolet.org>
To: Valdis.Kletnieks@...edu
Cc: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: EE BrightBox router hacked - bares all if you
 ask nicely

On Thu, Jan 16, 2014 at 09:44:07AM PST, Valdis.Kletnieks@...edu spake thusly:
> Consider that of all the credit-card breaches we've seen so far this century,
> something outrageous like 97% of the victim companies had current audits that
> listed them as being 100% PCI compliant at the time of the incident.

You have a cite for this? I'm pretty sure I've seen stats saying exactly the
opposite although I don't have them at hand. Nobody says PCI is perfect or will
prevent you from being compromised. Like any security control, it just makes it
less likely. PCI compliance is point-in-time. What often happens is that they
have an audit (one a year so it is "current" even 6 months later) where they
are found to be compliant and then over time things slide and then they are
breached.

PCI is a standard which provides actuall security for card data making it worth
doing yet doesn't bankrupt the industry. Nobody says it is perfect. No standard
ever will be. Arguing against a standard on that basis is not reasonable.

> So how do you do it so it actually adds security, rather than just being a
> huge government-mandate money transfer to the auditing/certification groups
> involved?

Someone has to audit otherwise there is no way to ensure appropriate security
is in place. Your assertion that auditing/certification cannot be involved in
any security mandate is a non-starter.

-- 
Tracy Reed

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/