Ethical Hacking Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package. | Computer Forensics Training at InfoSec Institute Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors. |

| Subject: | RE: PCI DSS Compliance |
|---|---|
| Date: | Thu, 22 Dec 2005 16:34:51 +1100 |
Herin lies, imho, the dichotomy between compliance and reality/security. With a prescriptive mangement level set of requirements, some techo issues may get lost/missed. But some techo/security issues will have been fixed in seeking/achieving compliance, things that otherwise would have remained unaddressed for ho knows how long. The upside is that there 'should' be less variabilty between sites, and a somewhat higher threshold for fraud/crime at an affordable level. This assumption is yet to be proven, however. lyal -----Original Message----- From: Roberto Tanara [mailto:tanara@protechta.it] Sent: Wednesday, 21 December 2005 7:50 PM To: webappsec@securityfocus.com Subject: Re: PCI DSS Compliance Craig Wright wrote:
The company seeking the test is seeking compliance not necessary security. These are very different things.
Maybe I am missing something, but as a customer, how could I trust a company that seeks "compliance not necessary security"? Does the compliance make me feel better if something bad happens? -- Roberto Tanara Protechta Information Security
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| ||
| Previous by Date: | Re: Mambo, Coppermine and PHPBB Attacks, Paul Laudanski |
|---|---|
| Next by Date: | RE: New OWASP project - PCI Web Security Standards, Lyal Collins |
| Previous by Thread: | Re: PCI DSS Compliance, Roberto Tanara |
| Next by Thread: | RE: PCI DSS Compliance, Craig Wright |
| Indexes: | [Date] [Thread] [Top] [All Lists] |