News for hackers. Stuff that matters.

A comment on Hackers Breached Virginia Bank Twice in Eight Months, Stole $2.4M. Parent comment

Re:Hackers Breached Virginia Bank Twice in Eight Months, Sto... by monocasa on Tuesday July 24, 2018 @12:10PM (#17602356)
Unfortunately PCI compliance requires rotating passwords last time I checked. : \
[ Parent | on HN ]
Re:Hackers Breached Virginia Bank Twice in Eight Months, Sto... by downtown_ on Thursday July 26, 2018 @05:27AM (#17616142)
No. You are free to reference nist and use a compensating control for that. No more pw changes :) Source: QSA
[ Parent | on HN ]
Re:Hackers Breached Virginia Bank Twice in Eight Months, Sto... by monocasa on Thursday July 26, 2018 @03:50PM (#17620364)
I guess I was under the impression that compensating controls don't really let you question the efficacy of the point of the original requirement, but instead "we're meeting the requirement in this other way"?
[ Parent | on HN ]
Re:Hackers Breached Virginia Bank Twice in Eight Months, Sto... by MaxGabriel on Tuesday July 24, 2018 @06:40PM (#17605521)
That's correct :(

> 8.2.4 Change user > passwords/passphrases at least once > every 90 days.

[ Parent | on HN ]
Re:Hackers Breached Virginia Bank Twice in Eight Months, Sto... by analogmemory on Tuesday July 24, 2018 @12:32PM (#17602599)
and then you get Password1990!!!!!!
[ Parent | on HN ]