Monthly ArchivesApril 2009

Did you miss the super-duper, fantsmoriffic webinar that we did with Forrester? If you were not one of the more than 300 attendees, don’t worry! The webcast was recorded, and can now be viewed online! Check it out at http://www.iian.ibeam.com/events/nrfe001/30288/! Possibly Related Posts: PCI DSS 4.0 Released plus BOOK DETAILS! PCI Council Loses $600K in Revenue, PO Population on the Decline Why PCI DSS 4.0 Needs to be a Complete Rewrite Orfei Steps Down Should you be a PCI Participating Organization?

See part 1 here. What a Compensating Control Is In the early years of PCI DSS (and even my experience under the CISP program), the term compensating control was used to describe everything from a legitimate work-around for a security challenge to something that Michael Phelps may have dreamed up while expanding his mind at approximately twenty minutes after four in the afternoon ((Aww… too soon?)). If you are considering a compensating control, you must perform a risk analysis and have a legitimate technological or documented business constraint before you even go to the next step. We will see more of the documented business constraints coming our way for review based on the current economic situation. Just remember the word ...

Few payment security professionals can find a hotter topic than compensating controls. They always look like this mythical accelerator to compliance used to push PCI Compliance initiatives through completion at a minimal cost to your company with little or no effort. Sound familiar? I wish I had a tape recorder at every meeting where I heard the phrase, “Don’t worry, we’ll just write up a compensating control for this.” It may not be as great as the twenty-seven minute long video floating around of every single expletive uttered during The Soprano’s legendary run on HBO ((How impressive is twenty-seven minutes? Seriously!)), but I bet I could fill a few podcasts with the audio. Compensating controls are challenging. They often require ...

It’s been a few days now, and the dust is still settling as they say. Anton Chuvakin posted some great thoughts on the hearing, including one that I TOTALLY missed. In Mr. Jones’s ((CMS 7.18. Look it up.)) defense, the site that has the XSS error in it MAY NOT be in scope for PCI depending on where code base lies, but regardless, the vulnerability is inexcusable from a guy talking to Congress about this stuff. I fired the info around to some of our consultants and had a couple of responses of note. James, a Consulting Manager in our group says (I am paraphrasing some of this): The contention that PCI forces retailers to stray from their core competency ...