Hackers Breached Virginia Bank Twice in Eight Months, Stole $2.4M

Re:Hackers Breached Virginia Bank Twice in Eight Months, Sto... by Jach on Tuesday July 24, 2018 @11:59AM (#17602227)

If we're going to start firing people, first on my chopping block would be IT staff who implement security theater policies which go against NIST recommendations (like forced rotation of passwords every x days) and create security hygiene problems as side effects.

[ Parent | on HN ]

Re:Hackers Breached Virginia Bank Twice in Eight Months, Sto... by monocasa on Tuesday July 24, 2018 @12:10PM (#17602356)

Unfortunately PCI compliance requires rotating passwords last time I checked. : \

[ Parent | on HN ]

Re:Hackers Breached Virginia Bank Twice in Eight Months, Sto... by downtown_ on Thursday July 26, 2018 @05:27AM (#17616142)

No. You are free to reference nist and use a compensating control for that. No more pw changes :) Source: QSA

[ Parent | on HN ]

Re:Hackers Breached Virginia Bank Twice in Eight Months, Sto... by monocasa on Thursday July 26, 2018 @03:50PM (#17620364)

I guess I was under the impression that compensating controls don't really let you question the efficacy of the point of the original requirement, but instead "we're meeting the requirement in this other way"?

[ Parent | on HN ]

Re:Hackers Breached Virginia Bank Twice in Eight Months, Sto... by MaxGabriel on Tuesday July 24, 2018 @06:40PM (#17605521)

That's correct :(

> 8.2.4 Change user > passwords/passphrases at least once > every 90 days.

[ Parent | on HN ]

Re:Hackers Breached Virginia Bank Twice in Eight Months, Sto... by analogmemory on Tuesday July 24, 2018 @12:32PM (#17602599)

and then you get Password1990!!!!!!

[ Parent | on HN ]