Another tidbit on PCI

tate@ClearNetSec.com (Tate Hansen) — Tue, 06 Nov 2007 18:31:00 -0700

Today I was talking with a colleague from a partner company about the PCI certification - I think he's up for recertification.

The interesting thing is he was talking to a Qualys representative recently whom, affably speaking, offered tips on how to tune the Qualys scans based on new modifications made at Mastercard's test lab. The representative also said he could review the report Qualys automatically builds. My colleague exclaimed to me "It sounded like they already have the answers".

Of course they do. Qualys pays PCI to verify their ability to discover what PCI wants them to discover. People pay and use Qualys so they can become PCI certified. Anybody willing to click "start scan" has the ability to be an Approved Scanning Vendor.

What's my problem with all this? For one, the certification process is rotten:

http://blog.clearnetsec.com/articles/2007/05/16/pci-not-our-problem.
http://blog.clearnetsec.com/articles/2007/05/04/pci-misleading-racket

On top of that, it's costly and does little to vet engineers claiming competency. Its design is to weed out small security firms, which is probably why it fires me up in the first place and turns me into a cynical punk all day.

ClearNet Security: Another tidbit on PCI

Another tidbit on PCI