Linking your business to more business.

Caught between PCI-DSS compliance mandates and a shrinking budget?

Use our quick contact form above and we'll show you how to become PCI-DSS complient on a seriously tight budget!

Still looking for more conventional answers? Here are some possible resources for PCI-DSS...

http://chuvakin.blogspot.com/
it So once again PCI was never supposed to guarantee intrusion-free operation nothing did does or will do. No canned checklist is sufficient for adequate security now or ever. It makes no sense to write prescriptive checklists for the impossible e.g.... will do. No canned checklist is sufficient for adequate security now or ever. It makes no sense to write prescriptive checklists for the impossible e.g. your defenses MUST stop all known and unknown malware as well as mal-hard-ware If you find... dealing with said risks. Following 12 PCI requirements is a great start but being secure cannot be reduced to a checklist PCI does not replace addressing the risks to your business however it is an awesome start for those who cannot...

http://riskmanagementinsight.com/riskanalysis/
Our ability to make good decisions Our ability to execute on those decisions THIS is what we should be making checklists for 1 and developing metrics around. All your technology purchases should be subservient to those two aims. Are you deciding... shelfware Ive seen purchased over the last ten years in the name of compliance. We can have all sorts of checklist compliance but not be able to do a thing about preventiondetectionresponse because we cannot execute no skills no resources no... just that. And therefore so is your budget your ability to execute and ultimately your security. 1 after all checklists do have their placeA Couple of Links on Risk Decision Making Filed on January 13 3 comments First...

http://www.watchguard.com/infocenter/whitepapers/pci_dss.asp?t=pci_shout
met with a Firebox X deployment.Download the two page summary of our PCI compliance white paper. Youll have a handy checklist of PCI requirements each mapping to the specific Firebox capabilities that ensure your network meets the standards. For more detailed...

http://jtgraves.wordpress.com/2009/02/16/security-is-not-a-checklist/
but through continuous integration of security into design development management and operations. Id add another maxim security is not a checklist. When I was in QSA training a few years back our trainer claimed that no one who was PCI DSS... compliance doesnt guarantee security. That should be obvious. But maybe its not. PCIs strength and weakness is that its a checklist of detailed requirements. Its specificity is an improvement over laws like HIPAA which calls for protecting against reasonably anticipated threats... Requirement 5.1 and so on. Theres very little it depends in the PCI DSS requirements. But companies sometimes think the checklist is all they needthat once theyve checked compliant next to all the requirements theyre done until the next audit rolls... the most they need to do. They forget that being able to answer yes we have a process to a checklist item is not as important as whether that process works. Then when data is lost they point to the checklist... checklist i

http://blog.paymentsecuritypros.com/
that the end goal for both security and compliance should be a risk based approach and not one involving a checklist. Try to imagine a world where there are not QSAs making point-in-time assessments but an internal and ongoing process of... gap analysis. Identify ways to reduce the scope. Involve business units and technology solutions. Focus on security strategy rather than checklist items. Maintain Develop daily weekly monthly quarterly and annual process task list. Assign review and escalate issues as they arise.... list. Assign review and escalate issues as they arise. Please focus on your overall security strategy plan rather than then checklist. If you have a sound security strategy the aspect of validating compliance should be simple. Also remember that crime does...

http://www.mckeay.net/2008/11/02/pci-compliance-in-the-cloud-get-it-in-writing/
huge huge problem in a short period of time.Im pushing awareness and highlighting issues while youre selling compliance against a checklist thats not a knockit just illustrates the point. The regulations and those whose job it is to assess against them... correct in that you can become compliant but is that really the objective We have to get out of the checklist mentality with PCI or we end up with thinking we have protected cardholder data when we have not. A checklist... checklist mentality with PCI or we end up with thinking we have protected cardholder data when we have not. A checklist mentality will lead us away from the tough questions and give a false sense of comfort we will fall back...

http://www.pciknowledgebase.com
-- that there is no recognition of differences in risk across the various controls and that this posture promotes a checklist mentality and ineffective implementation...Tutorial How to use PCI Knowledge BaseClick on the slide The PCI Knowledge Base has many features...