Re: Importance of being a QSA

On 11/28/06, 3 shool <3shool@xxxxxxxxx> wrote:
Hi All,

We have been doing Penetration tests for more than 4 years for our
customers, including financial and e-commernce segments. One of our
customer came up with a requirement that they would get PenTest
services ONLY from QSA (Qualified Security Assessor) by PCI, as part
of company policy.

We have been delivering fantastic results for them over the years and
they too haven't had any security breaches during this period. I have
heard about this in the mailing list last year but just wanted to know
how important it is to be a QSA for companies like us who have been
doing PenTests since a good period.

Is it just a marketing strategy or is it something more than OSSTMM or
other menthodologies that we don't account for in our tests?

Welcome to the 21st Century for Penetration Testing. If you're going
to want/need certification from PCI then you have to follow what PCI
says. Our industry has been pretty wild west for some time and it's
now being wrangled to fit into auditor-like qualities. OSSTMM was a
start, PCI's QSA is just the next evolution.

https://www.pcisecuritystandards.org/certification/how_to_become_a_qsa.htm

It kind of makes me feel like we're becoming sad Elevator Inspectors
(no disrespect to elevator inspectors, I'm sure they're really happy
people). Just another check-off to make people feel safer about
putting in their credit card information.

So pay your PCI fee, your (ISC)2 fee, your OWASP donation, your ISECOM
certification, get your insurance together and continue to do your
work. If the customer demands it there usually is a reason. In this
case my guess is because they want to be PCI certified.

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------

Relevant Pages

  • Re: send more than 8 bits with parallel port
    ... standard Windows API functions. ... experimenter-type interfaces to replace the parallel port for classroom ... But you cannot build them yourself and PCI isn't ... Then do a final boardfor the customer that meets ...
    (sci.electronics.basics)
  • Re: send more than 8 bits with parallel port
    ... standard Windows API functions. ... The ISA bus was really nice and not too complex for a serious hobbyist ... But you cannot build them yourself and PCI isn't ... Then do a final boardfor the customer that meets ...
    (sci.electronics.basics)
  • Re: Missing file
    ... This contains product NAMES used to identity various PCI ... "Customer readable" stuff. ... more frequent than the kernel updated devlist.h... ... away so that people who make embedded systems, ...
    (Linux-Kernel)