Re: [Full-disclosure] Compliance Is Wasted Money, Study Finds

[Valdis.Kletnieks () vt edu]

On Wed, 07 Apr 2010 14:06:41 PDT, Tracy Reed said:
> On Wed, Apr 07, 2010 at 12:43:47PM -0400, Valdis.Kletnieks () vt edu spake thusly:
> > Whether said checkbox is actually the best solution *for the actual problem*
> > is the issue.  I've seen cases where checkbox auditors insisted that a
> > certain critical system "absolutely positively *HAD* to have a firewall".
>
> This is where compensating controls come in with PCI. If there is an
> even better solution you are free to implement it.

Yes, the PCI "compensating controls" are overall a Good Thing.  Unfortunately,
a lot of regulatory regimes don't see things that way yet.  And it still
requires a clued PCI auditor who actually understands the real world enough
to deal with compensating controls.

Attachment: _bin
Description: