Home page logo

basics logo Security Basics mailing list archives

Re: [Full-disclosure] Compliance Is Wasted Money, Study Finds
From: Valdis.Kletnieks () vt edu
Date: Wed, 07 Apr 2010 17:29:37 -0400

On Wed, 07 Apr 2010 14:06:41 PDT, Tracy Reed said:
On Wed, Apr 07, 2010 at 12:43:47PM -0400, Valdis.Kletnieks () vt edu spake thusly:
Whether said checkbox is actually the best solution *for the actual problem*
is the issue.  I've seen cases where checkbox auditors insisted that a
certain critical system "absolutely positively *HAD* to have a firewall".

This is where compensating controls come in with PCI. If there is an
even better solution you are free to implement it.

Yes, the PCI "compensating controls" are overall a Good Thing.  Unfortunately,
a lot of regulatory regimes don't see things that way yet.  And it still
requires a clued PCI auditor who actually understands the real world enough
to deal with compensating controls.

Attachment: _bin

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]