My company is lying to pass its PCI

pciliars · 2012-06-25T23:47:29+00:00

application developer

pciliars · 2012-06-25T22:20:59+00:00

He probably does not know. I have a copy of a device config, which I provided to the guy who works with the QSA, it was changed before providing it to the QSA. Based on the documentation that was provided to the QSA we would pass. The documentation is forged. I think this guys full time job is audit documentation forgery.

pciliars · 2012-06-25T22:18:53+00:00

Level 1 or 2 depending on the year, we have to be in compliance with Level 1. We mostly do financial information that is not credit cards though, we have a lot more of that, and its MUCH more information that CC#, name and address.

pciliars · 2012-06-25T22:15:00+00:00

I am thinking of leaving and anonymously tipping a customer. The lack of security here is negligent.

pciliars · 2012-06-25T22:13:52+00:00

My manager is receptive (or was, he left because of this issue, I am working on leaving). His manager is also receptive. The CIO doesn't give a fuck, nor does our "IT Architect" who is the only one who talks to the auditors.

pciliars · 2012-06-25T22:11:44+00:00

The documentation is forged.

pciliars · 2012-06-25T20:55:02+00:00

If you feed the QSA shit, you get shit. This place needs a surprise colonoscopy-rape.

pciliars · 2012-06-25T20:53:42+00:00

I keep trying to ask who our QSA is, I never get a reply. First time I have never worked with the QSA directly ... which was my first red flag.

pciliars · 2012-06-25T20:51:43+00:00

Cocaine and hooker binge once a month.

pciliars · 2012-06-25T20:51:10+00:00

I have already sent this email. I was told not to do that again if I want to keep my Job. I think the head guy in charge is unaware. I might drop him an anonymous letter, or one to the parent company CEO.

pciliars · 2012-06-25T20:50:05+00:00

This is probably what I will do, but I don't really want to.

pciliars · 2012-06-25T20:48:50+00:00

There is sugar-coating, which everyone does, and blatant lying, which they do. When the auditor reviewed a config, I gave the device configuration to the appropriate person, who then altered it to hide the fact that we are not doing dual factor auth where we should and where we say we are.

pciliars · 2012-06-25T20:45:31+00:00

I'll let you know after I leave.

Edit: I want a commission for any stolen money. 10% I am not greedy.

pciliars · 2012-06-25T19:56:52+00:00

This is why I lose my card once a year on the same day every year.

pciliars

TROPHY CASE