Re: Compliance Is Wasted Money, Study Finds

["Thor (Hammer of God)" <Thor () hammerofgod com>]

Another thing that I think people fail to keep in mind is that when it comes to PCI, it is part of a contractual 
agreement between the entity and card facility they are working with.   If a business wants to accept credit cards as a 
means of payment (based on volume) then part of their agreement is that they must undergo compliance to a standard 
implemented by the industry.  I don't know why people get all emotional about it and throw up their hands with all the 
"this is wasted money" positioning - it's not wasted at all; it is simply part of the cost of doing business in that 
market.

t

From: full-disclosure-bounces () lists grok org uk [mailto:full-disclosure-bounces () lists grok org uk] On Behalf Of 
Christopher Gilbert
Sent: Thursday, April 22, 2010 4:48 PM
To: Mike Hale
Cc: full-disclosure; security-basics () securityfocus com
Subject: Re: [Full-disclosure] Compliance Is Wasted Money, Study Finds

The paper concludes that companies are underinvesting in--or improperly prioritizing--the protection of their secrets. 
Nowhere does it state that the money spent on compliance is money wasted.
On Wed, Apr 21, 2010 at 5:44 PM, Mike Hale <eyeronic.design () gmail com<mailto:eyeronic.design () gmail com>> wrote:
I find the findings completely flawed.  Am I missing something?

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/