Re: [Full-disclosure] Compliance Is Wasted Money, Study Finds

On Tue, Apr 27, 2010 at 08:58:24AM -0400, Honer, Lance wrote:
What's your choice:
Company A installs an anti-virus and updates it regularly (BTW
regularly
includes once a year).
Company B has a recovery concept, incident response team,
vulnerability
monitoring, patch management, NIDS, security training but no
anti-virus.

You do realize that PCI says everything you stated above needs to be
done, right?

I never stated what needs to be done or what PCI might require :)
And I didn't ask to compare the two statements but just choose your priority:
A = Spend money on compliance but don't *think* about your threats
B = Think about security, reduce your risks and don't waste money on compliance


'nuff said

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages

  • RE: Business justification for pentesting
    ... Run internal and external network vulnerability scans at least ... I would love to see any Pen test which could blindly test #8.5.12... ... Clean results being "The results of each scan satisfy the PCI Security ... >Audit your website security with Acunetix Web Vulnerability Scanner: ...
    (Pen-Test)
  • Re: [Full-disclosure] Compliance Is Wasted Money, Study Finds
    ... Compliance Is Wasted Money, ... I argued a lot with my managers about the PCI stuff, ... security measures, but in the end if a breach is discovered they are the ones who shall get the penalty in the face, not us:) ...
    (Full-Disclosure)
  • Re: [Full-disclosure] Compliance Is Wasted Money, Study Finds
    ... The entire compliance industry has design flaws which cause results to be ... CompanyA hires a PCI auditor for their annual PCI audit. ...
    (Full-Disclosure)
  • Re: [Full-disclosure] Compliance Is Wasted Money, Study Finds
    ... The Evolution of PCI DSS ... [Full-disclosure] Compliance Is Wasted Money, ...
    (Full-Disclosure)
  • RE: Vulnerability scanner/appliance
    ... I can suggest Qualys a good vulnerability product ... Moreover PCI standards focus is on encryption, ... properly securing their environment to do so...but ... When I say there are scanners that will pass the PCI ...
    (Security-Basics)