Right now I'm doing a work term through my school and they want me to write a report on something I've worked on. They are really serious about "proprietary reports" and reports requiring destruction after they've been marked. I'm planning to write about becoming PCI compliant and my boss tells me not to worry about marketing it as a "proprietary report". My question is, does making security details public increase or decrease security? I can't find the wikipedia article I read this on but after 9/11 a report found that agencies such as the FBI didn't share information enough, each agency felt that they worked to obtain the information and wanted to keep it confidential and to themselves which ultimately was counterproductive. Can it be seen as the same, the more people who look over a PCI implementation the more likely someone can spot a weakness?
In general, the consensuses within the security community is that disclosing security practices (aka, transparency) leads to improved security. Transparency has many benefits:
That said, transparency is really only beneficial if you plan to respond to security problems. If you aren't planning on it, transparency can cause problems because you make the attackers work less hard to find vulnerabilities.
PCI is a public standard that a lot of people conform to, so it's unlikely that very many of the details related to your implementation will be very unique. It's possible your boss doesn't think that information about proposed PCI compliance would be harmful.