The conference season is upon us. This week we discuss SOURCE in Boston and RSA with our guest, Jennifer Leggio. We spend a bit of time on the Hannaford breach and my Mac antivirus article. As always, full show notes and the podcast are here. < p style=”text-align:right;font-size:10px;”>Technorati Tags: Network Security Podcast Share:
Make the list of who is compliant (and by default, not compliant) public. Allow consumers to decide if they want value security enough to do something about it. < p style=”text-align:right;font-size:10px;”>Technorati Tags: PCI Share:
Update : Yes, I know it’s the QSAs not ASVs that certify. Dumb mistake on my part. Yesterday I posted an analysis of the Hannaford breach in which I made a contentious statement. In other words, PCI is worthless. Some of the commenters weren’t too pleased with this statement, an example from @Mike: That said, to discount the program as “worthless” makes me question how informed the person saying it really is about this topic. I’ve been digging into PCI since before it was PCI (Visa CISP) and talked with all sides, from struggling retailers, to credit card processors, to auditors, to the big guys themselves. You might not like my conclusions. You might think I’m an idiot. But I’m definitely a well informed idiot. Now back to PCI. I admit that PCI isn’t completely worthless. But let’s not call something that’s degraded into a very costly awareness nudge an effective industry standard for protecting cardholder information. Pretty much everyone involved, with whom I have discussed PCI, admits it’s not very effective- especially considering the cost. A few points and suggestions for fixing the system: PCI-DSS was established to transfer risk from the credit card companies to the retailers and processors. There is a lot the credit card companies could do to reduce risk on the processing side, but they have instead chosen to push it onto the retailers and processors. Going back to CardSystems, a large majority of major breaches involve companies that were PCI compliant, including (probably) Hannaford. TJX is an open question. In many cases, the companies involved were certified but found to be non-compliant after the breach, which indicates a severe breakdown in the certification process No ASV has been dropped from PCI, even after certifying non-compliant companies. There is no accountability in the system. ASVs are allowed to offer services to the companies they certify, which is a built-in conflict of interest. They should be held to the same standard as financial auditors where the audit function and compliance assistance/services/consulting cannot come from the same auditor. Many auditors certify compensating controls that are clearly ineffective. Due to lack of accountability in the system, companies push ASVs for the lowest price possible to achieve “compliance”. This price pressure leads to cheap certification, and the approval of inadequate controls mentioned in point 5. PCI-DSS is moving to a checkbox that doesn’t necessarily reflect any level of security, and the credit card companies are okay with that since they can just later find the company in violation after a breach, yank certification, levy fines, and push all costs to the retailer. We can fix PCI, but right now it’s very ineffective at stopping real breaches. The standard needs to adapt faster; there needs to be accountability and separation of duties at the auditor level; and the credit card companies need to adjust the processing system to reduce fraud- not just set an incomplete standard for retailers. Maybe not worthless, but considering the cost we sure as heck should be getting more out of it. Some companies use PCI to improve their security, but many others do as little as possible to comply, and thus security isn’t increased in any meaningful way. < p style=”text-align:right;font-size:10px;”>Technorati Tags: PCI Share:
Totally Transparent Research is the embodiment of how we work at Securosis. It’s our core operating philosophy, our research policy, and a specific process. We initially developed it to help maintain objectivity while producing licensed research, but its benefits extend to all aspects of our business.
Going beyond Open Source Research, and a far cry from the traditional syndicated research model, we think it’s the best way to produce independent, objective, quality research.
Here’s how it works:
In essence, we develop all of our research out in the open, and not only seek public comments, but keep those comments indefinitely as a record of the research creation process. If you believe we are biased or not doing our homework, you can call us out on it and it will be there in the record. Our philosophy involves cracking open the research process, and using our readers to eliminate bias and enhance the quality of the work.
On the back end, here’s how we handle this approach with licensees:
Here is the language we currently place in our research project agreements:
“Content will be created independently of LICENSEE with no obligations for payment. Once content is complete, LICENSEE will have a 3 day review period to determine if the content meets corporate objectives. If the content is unsuitable, LICENSEE will not be obligated for any payment and Securosis is free to distribute the whitepaper without branding or with alternate licensees, and will not complete any associated webcasts for the declining LICENSEE. Content licensing, webcasts and payment are contingent on the content being acceptable to LICENSEE. This maintains objectivity while limiting the risk to LICENSEE. Securosis maintains all rights to the content and to include Securosis branding in addition to any licensee branding.”
Even this process itself is open to criticism. If you have questions or comments, you can email us or comment on the blog.
