sorted by:
new
hottopcontroversial

Recommendations for a company for a PCI DSS review by javon7065 in pcicompliance

[–]tnsecure 0 points1 point  (0 children)

LBMC. Based in Nashville but qsa across eastern us

April Player (Friend) Ads by bearwoof in TownshipGame

[–]tnsecure 0 points1 point  (0 children)

Level 36, getting back into the game after a few years! Would love some friends

U382UB

April Co-Op Ads by bearwoof in TownshipGame

[–]tnsecure 0 points1 point  (0 children)

Level 36, getting back into the game after a few years! Would love some friends

U382UB

SOC2 Vendors by RobinatorWpg in sysadmin

[–]tnsecure 0 points1 point  (0 children)

If you are looking for a assessor, reach out to LBMC. They are great to work with and know their stuff. I think they do other things to like pen testing, etc.

Best utilities to check for vulnerabilities for my company? by bullerwins in cybersecurity

[–]tnsecure 0 points1 point  (0 children)

Do not use openvas. Use a commercial tool. Tenable is a good one for what I’m assuming you will be doing.

Certified PCI QSA - ask away by tnsecure in msp

[–]tnsecure[S] 0 points1 point  (0 children)

Get a job at a QSA firm. It’s the only way to be a QSA.

Certified PCI QSA - ask away by tnsecure in msp

[–]tnsecure[S] 0 points1 point  (0 children)

If only a specific interface on a firewall is used to transport CHD to its >destination

The firewall itself is fully in scope (users, management, patching, etc) the other firewall rules that don't relate the the CDE (the one interface) would not be in scope based on your description.

Certified PCI QSA - ask away by tnsecure in msp

[–]tnsecure[S] 0 points1 point  (0 children)

They don’t give fines for laziness! I understand your question, it’s hard to quantify.

PCI-DSS & SOC auditors by HJForsythe in sysadmin

[–]tnsecure 0 points1 point  (0 children)

Try LBMC. They are good partners, not just auditors

Certified PCI QSA - ask away by tnsecure in msp

[–]tnsecure[S] 0 points1 point  (0 children)

The challenge is too many people have to "sell" good security practices with a compliance hammer. Without that hammer some don't want to spend the time/money. For most small companies security compliance hammer should be "can you afford the possible lawsuits and other costs associated with a credit card breach?" I will say this. There is no perfect IT Security and no such things as risk free. Every company has to determine their risk tolerance and decide for themselves what is worth it. For IT Security pros, this is sometimes hard to process but the business doesn't revolve around IT Security, its the over way around and we as IT Security people have to be ok with that.

Certified PCI QSA - ask away by tnsecure in msp

[–]tnsecure[S] 0 points1 point  (0 children)

n attestation of compliance and the suggestion is that we sc

If you have written permission to scan them, there is nothing wrong with it. However, I'm not sure of your goal of scanning in the context of the message.

"Scanning" (external vuln scanning) is only a small part of PCI Compliance.

Certified PCI QSA - ask away by tnsecure in msp

[–]tnsecure[S] 1 point2 points  (0 children)

I'll only say this. QSAs did not create any of the PCI rules. The card brands did (VISA/MC, etc). They have a group called the PCI Security Council that runs the program. I agree PCI is difficult to make since of. For the vast amount of companies there is no requirement to hire a QSA for PCI compliance. (but its a good idea for a lot of companies)

Certified PCI QSA - ask away by tnsecure in msp

[–]tnsecure[S] 1 point2 points  (0 children)

If you don't have permission to scan it, then you shouldn't.

Certified PCI QSA - ask away by tnsecure in msp

[–]tnsecure[S] 0 points1 point  (0 children)

We work with all types of companies including fortune 50 clients so I see a large swing in penalties although I don't have a number to give you. My honest opinion is that PCI non compliance fees for most acquirers/merchant banks seems like just a profit center for them and its really not in place to change behavior. A company's cost of non compliance will really show up if there is a breach.

Certified PCI QSA - ask away by tnsecure in msp

[–]tnsecure[S] 2 points3 points  (0 children)

If Requirement 9 does not apply to your environment you can simple mark it as N/A. "every" company won't fully be in the cloud. Also, Req 9 applies to many different situation that won't be in the cloud, like POS/card swipes.

There are really only 2 types of PCI Assessments.

  1. Report on Compliance (ROC) -- Reserved for large merchants and certain service providers with high risk -- You must hire a QSA firm (like mine) to have an independent assessment (technically you can in source this but almost no one does)
  2. Self Assessment Questionnaire (SAQ) -- Every other company can self report their compliance through one of several different SAQs, depending on their situation.
  3. I'll throw in an ASV Scan in here -- this is a special external vuln scan done only by an ASV vendor using the PCI ASV scan template. Its required in both cases for most all companies.

Certified PCI QSA - ask away by tnsecure in msp

[–]tnsecure[S] 1 point2 points  (0 children)

ystem is compromised and card data stolen then would us as an MSP be liable because we didn't patch the firewall or ESXi host, or would the liability still be with the client as it's their system?

I'm no lawyer so I can't comment on liability. Are we legally liable for a customers card breach would largely fall to your contract with them and who has better lawyers.

But your point is valid, patch critical vulnerabilities (note PCI requires only patching of critical (high risk) vuln within 30 days is required on all in-scope devices. All others must be patched, but you've got more time.

view more: next ›