Full Disclosure mailing list archives
Re: Compliance Is Wasted Money, Study Finds
From: Digital X <digitalx00 () gmail com>
Date: Wed, 07 Apr 2010 15:52:00 -0600
Whether said checkbox is actually the best solution *for the actual problem* is the issue. I've seen cases where checkbox auditors insisted that a certain critical system "absolutely positively *HAD* to have a firewall".This is where compensating controls come in with PCI. If there is an even better solution you are free to implement it.Yes, the PCI "compensating controls" are overall a Good Thing. Unfortunately, a lot of regulatory regimes don't see things that way yet. And it still requires a clued PCI auditor who actually understands the real world enough to deal with compensating controls.
Having just gone through a PCI audit I can safely say a few things: A) Approaching compliance from a risk management approach went out the window B) Items the auditor didn't understand absolutely went back to a checkmark mentality C) Items that were gray areas were treating VERY liberally in their interpretation Bleh _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Compliance Is Wasted Money, Study Finds, (continued)
- Re: Compliance Is Wasted Money, Study Finds Bert Knabe (Apr 07)
- Re: Compliance Is Wasted Money, Study Finds John Morrison (Apr 07)
- Re: Compliance Is Wasted Money, Study Finds Keith Tomler (Apr 07)
- Re: Compliance Is Wasted Money, Study Finds J Roger (Apr 07)
- Re: Compliance Is Wasted Money, Study Finds Valdis . Kletnieks (Apr 07)
- Re: Compliance Is Wasted Money, Study Finds J Roger (Apr 07)
- Re: Compliance Is Wasted Money, Study Finds Valdis . Kletnieks (Apr 07)
- Re: Compliance Is Wasted Money, Study Finds Stephen Mullins (Apr 07)
- Re: Compliance Is Wasted Money, Study Finds Tracy Reed (Apr 07)
- Re: Compliance Is Wasted Money, Study Finds Valdis . Kletnieks (Apr 07)
- Re: Compliance Is Wasted Money, Study Finds Digital X (Apr 08)
- Re: Compliance Is Wasted Money, Study Finds Tracy Reed (Apr 09)
- Re: Compliance Is Wasted Money, Study Finds Nick FitzGerald (Apr 10)
- Re: Compliance Is Wasted Money, Study Finds Thor (Hammer of God) (Apr 10)
- Re: Compliance Is Wasted Money, Study Finds Valdis . Kletnieks (Apr 10)
- Re: Compliance Is Wasted Money, Study Finds Valdis . Kletnieks (Apr 22)
- Re: Compliance Is Wasted Money, Study Finds Christopher Gilbert (Apr 23)
- Re: Compliance Is Wasted Money, Study Finds Mike Hale (Apr 23)
- Re: Compliance Is Wasted Money, Study Finds Thor (Hammer of God) (Apr 23)
- Re: Compliance Is Wasted Money, Study Finds Christian Sciberras (Apr 23)