Re:The Mirai Botnet Is Proof the Security Industry Is Broken
by CaptSpify on Tuesday November 01, 2016 @04:53PM
(#12849924)
The problem I had with PCI DSS is that you could check the boxes and if you are never audited, you don't actually have to fix those problems. I worked for a place that ran that way for ~3 years.
[ Parent
| on HN ]
Re:The Mirai Botnet Is Proof the Security Industry Is Broken
by kbenson on Tuesday November 01, 2016 @06:38PM
(#12850747)
Yeah, it is a sort of honor system, but I'm sure if you were hacked, and they see you aren't compliant, it won't go well for you. The fines get steep fairly quick[1][2]. Considering it mentions you might be charged $50-$90 per card even if you are compliant. Although I think those are actually fees for the issuers, I can't imagine they don't have a way to pass then along to merchants.
1: http://www.focusonpci.com/site/index.php/pci-101/pci-noncomp...