mailing list archives
Re: EE BrightBox router hacked - bares all if you ask nicely
From: Tracy Reed <treed () ultraviolet org>
Date: Thu, 16 Jan 2014 11:59:32 -0800
On Thu, Jan 16, 2014 at 09:44:07AM PST, Valdis.Kletnieks () vt edu spake thusly:
Consider that of all the credit-card breaches we've seen so far this century,
something outrageous like 97% of the victim companies had current audits that
listed them as being 100% PCI compliant at the time of the incident.
You have a cite for this? I'm pretty sure I've seen stats saying exactly the
opposite although I don't have them at hand. Nobody says PCI is perfect or will
prevent you from being compromised. Like any security control, it just makes it
less likely. PCI compliance is point-in-time. What often happens is that they
have an audit (one a year so it is "current" even 6 months later) where they
are found to be compliant and then over time things slide and then they are
PCI is a standard which provides actuall security for card data making it worth
doing yet doesn't bankrupt the industry. Nobody says it is perfect. No standard
ever will be. Arguing against a standard on that basis is not reasonable.
So how do you do it so it actually adds security, rather than just being a
huge government-mandate money transfer to the auditing/certification groups
Someone has to audit otherwise there is no way to ensure appropriate security
is in place. Your assertion that auditing/certification cannot be involved in
any security mandate is a non-starter.
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
Re: EE BrightBox router hacked - bares all if you ask nicely Jeffrey Walton (Jan 16)