Re: EE BrightBox router hacked - bares all if you ask nicely

[Tracy Reed <treed () ultraviolet org>]

On Thu, Jan 16, 2014 at 09:44:07AM PST, Valdis.Kletnieks () vt edu spake thusly:
> Consider that of all the credit-card breaches we've seen so far this century,
> something outrageous like 97% of the victim companies had current audits that
> listed them as being 100% PCI compliant at the time of the incident.

You have a cite for this? I'm pretty sure I've seen stats saying exactly the
opposite although I don't have them at hand. Nobody says PCI is perfect or will
prevent you from being compromised. Like any security control, it just makes it
less likely. PCI compliance is point-in-time. What often happens is that they
have an audit (one a year so it is "current" even 6 months later) where they
are found to be compliant and then over time things slide and then they are
breached.

PCI is a standard which provides actuall security for card data making it worth
doing yet doesn't bankrupt the industry. Nobody says it is perfect. No standard
ever will be. Arguing against a standard on that basis is not reasonable.

> So how do you do it so it actually adds security, rather than just being a
> huge government-mandate money transfer to the auditing/certification groups
> involved?

Someone has to audit otherwise there is no way to ensure appropriate security
is in place. Your assertion that auditing/certification cannot be involved in
any security mandate is a non-starter.

-- 
Tracy Reed

Attachment: _bin
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/