Re: PCI DSS & Firewalls

["Paul D. Robertson" <paul () compuwar net>]

On Thu, 2 Apr 2009, Chris Blask wrote:

> piece of serious substance in there somewhere.  It is - at best - the
> morning of a one-day Network Security For Idiots class (maybe the first
> hour) and the folks writing it are a thousand times more interested in
> not doing anything that could lead to them being sued than they are
> about creating actual security.  But we need to set baseline standards

That's the point- if it were more well-written and had depth, it would be 
more than the "Don't get sued" checklist, it'd be a move forward to 
achieving security, and the point is supposed to be about DLP for CC info, 
not not getting sued, so it's already lost at some level.  Great synopsis 
though!

> in industry as a whole somehow and whatever we can get people to
> reliably follow is a better start than a more laudable standard that is
> ignored.

Contractually, it can't be ignored without great peril, so that's a bad 
excuse for them not doing better.
> > I also agree with Marcus that it's the Pen Tester's Employment Security 
> > Act..
>
>
> Oh, it is.  And even there, having more Pen Testing done in the world is
> itself a move in a positive direction, so that's a good thing by any
> metric.

If you're a pen tester.  I can set up a gazillion systems with holes that 
a pen test won't ever find- pen testing as a stipulated requirement is 
silly- there are lots of ways to ensure your security that actually work, 
pen testing at best should be an option in conjunction with stronger 
methods like configuration auditing of security devices.

Paul
-----------------------------------------------------------------------------
Paul D. Robertson      "My statements in this message are personal opinions
paul () compuwar net       which may have no basis whatsoever in fact."
           Moderator: Firewall-Wizards mailing list
           Art: http://PaulDRobertson.imagekind.com/

_______________________________________________
firewall-wizards mailing list
firewall-wizards () listserv icsalabs com
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards