Linode hacked, CCs and passwords leaked

Re:Linode hacked, CCs and passwords leaked by tptacek on Monday April 15, 2013 @02:13PM (#5553121)

Actually, if you're processing cards directly, you do in fact need to have an PCI-qualified outside firm† (a QSA) audit you for PCI compliance. But those audits are notoriously superficial; PCI audits are a race-to-the-bottom affair.

† We are not one of those.

[ Parent | on HN ]

Re:Linode hacked, CCs and passwords leaked by flyt on Monday April 15, 2013 @02:32PM (#5553245)

Note that you hire those firms yourself, and they work for you. They want you to pass the audit and will work to make that happen.

[ Parent | on HN ]

Re:Linode hacked, CCs and passwords leaked by trafficlight on Monday April 15, 2013 @02:29PM (#5553226)

Every one of these reviews that I've been involved in has been conducted by a couple of guys with laughable abilities.

[ Parent | on HN ]

Re:Linode hacked, CCs and passwords leaked by tptacek on Monday April 15, 2013 @02:32PM (#5553244)

The quality of PCI security audits is a continual aggravation to everyone I routinely talk to in my industry. I've told more than one client: if you need a QSA audit, get the cheapest one you can. If you need a software security assessment, don't use a QSA firm.

[ Parent | on HN ]

Re:Linode hacked, CCs and passwords leaked by larrys on Monday April 15, 2013 @03:28PM (#5553668)

"But those audits are notoriously superficial"

Will add that just having gone through an ICANN registrar audit (which by the way were specified and supposed to be done literally 10 or 12 years ago but never requested by ICANN) with a third party company hired (accounting firm) it's total compliance theater.

Add: "hired by ICANN after a bidding process". Same happened with data escrow which was just implemented a few years ago and is operated by Iron Mountain.

[ Parent | on HN ]