What makes a user account “inactive”? I think most QSAs would say “any account not used with in 90 days”. I think these QSAs would also say that the PCI DSS (v3.2.1) actually defines an inactive account as one that has not been used within 90 days. But maybe this definition is from the Mandela…
Have you heard of fishbowl? I was recently introduced to it. It bills itself as a way to “Connect and share with people in your industry”. The groups of interest are referred to as “bowls” and there is one for PCI DSS practicioners. Supposedly there is a mechanism for anonymously sharing working conditions (and compensation…
Purchase electronics, technology or anything that uses electricity in person at random retail brick and mortar locations whenever possible to minimize adversary’s opportunity to mess with your stuff during delivery. Especially items like keyboards, laptops, personal assistants, cameras, etc. Use your neighbour’s address for deliveries and all your mail. The risk of being poisoned…
The case against certificates of compliance: They aren’t a real thing. The AOC (attestation of compliance) is a real thing. Please don’t ask your service providers for a certificate of compliance. You will make the PCI Guru angry. He correctly guides us to FAQ 1220 and thinks they aren’t worth the paper they are printed…
Do you just click on anything in your inbox? Tsk. If so, here is a clickable ad for you:
The term REPORT FINDINGS HERE occurs 844 times in the version 3.2 ROC reporting template. 939 times in version 3.1 926 times in 3.0 Not once in v2.0 (it had a different format). Some can be filled with as little as two letters: NO Some require several paragraphs. Huh, I thought it was bigger…
British technology news and opinion website The Register puts their unique spin on the arrival of PCI DSS 3.2. Take it with a grain of salt. http://www.theregister.co.uk/2016/04/28/pci_dss_32_lands/ Ad below this line.
I recently saw this press release and thought it illustrated the high level of confusion that exists about the security standards. I am going to remove their company name to try save them a little embarrassment. The bold comments are mine under excerpts from the press release. <<COMPANYNAME>> Announces PCI-DSS v3.1 Rating – The Highest…
The SkyTrain is a great way to get downtown from the airport. A short (covered!) outdoor walk to the trainstop. Follow the signs to the DOWNTOWN TRAIN. You want a WATERFRONT train. You can buy a ticket at the train stop, but the PRO tip is to get yourself an unlimited day pass. You can…
Not a QSA, ISA, PCIP, sponsor or employee of a participating organization AND interested in attending the North American community meeting in Vancouver? Two paths are available. Become a PCIP ($2245 USD for course and exam) and register for the meeting ($1295 USD). Total costs $3540, but you are now a PCIP ( includes first…
