Grant it I don’t find it as bad as HIPPA in trying to get compliant but as was stated above no matter how much money and time you throw at being or trying to be complaint you can almost always digg deep enough and find something that is not complaint.

A QSA friend of mine put it best one time in a talk we was giving about securing a network. If a bear is chasing you, you don’t have to run faster than the bear you just have to run faster than the person with you. You don’t and probably won’t have the most secure network but striving to be more secure than the next person will deter your average person attempting to breach your network.

Mike

Compliance management service provider and PCI QSA Trustwave appear to be having tough time recently. A colleague of mine pointed out today that Trustwave had been the QSA who certified RBS Worldpay as being compliant just 4 days before their data breach.

Fair enough, every one can get caught out now and then but I have also found out that Trustwave (all complaint companies and their assessors can be found here http://www.mastercard.com/us/sdp/assets/pdf/Compliant%20Service%20Providers%20-%20January%2015%202009.pdf) had also certified Heartlands as being compliant with PCI. If you have ignored the security news for a few days you would have missed the fact that Heartlands have also had breach of data which could top TJX as the largest breach ever. Heartlands process in excess of 100m transactions per month so I would imagine the amount of records lost could be immense.

Trustwave, I think the PCI Council should think about something George Bush once said: fool me once, shame on — shame on you. Fool me — you can’t get fooled again.

Dave

http://securityninja.co.uk/blog/?p=145

Martin

The problem is, most companies don’t take it seriously until two months before their deadline.