11 reputation
1
bio website
location
age
visits member for 1 year, 11 months
seen Oct 30 '12 at 14:07

Oct
29
comment Vulnerability scanning applicability for PCI DSS
Hi Avid, sorry for the confusion. We do not store the data at all, its sent encrypted from the device and then we only see/store the confirmation (Yes/No) and the last 4 digits. The only storage that occurs is in high memory for 10 seconds. PCI still applies as there are otehr aspects to consider, mostly policy and physical access.
Oct
29
comment Vulnerability scanning applicability for PCI DSS
To clarify the work load for Section 11.2, in order to complete the internal vulnerability scans, I would have to setup/create site2site VPNs for each site, purchase software or a hardware scanning tool to cover all IP's and find someone else to run those scans as it cannot be Me or our Support guys who maintain the network. Additionally all vulnerabilities would need to be patched quickly.Yes the scans only have to run once a quarter but im trying to focus on the fact do i need to do them at all? I see it as something we should do, but not necessarily for PCI at the moment.
Oct
29
comment Vulnerability scanning applicability for PCI DSS
Avid, I totally understand what you are asying, however PCI DSS is not black and white and is open to interpretation. It is designed that way to allow companies to descope aspects of their environment. By using Tier 1 Card handlers and software and by not having the data ourselves we restrict the level of scope and can rightly cross/ say yes to many areas of PCI as they now do not apply. If we had control of the card data then i would nopt be asking this question.
Oct
26
comment Vulnerability scanning applicability for PCI DSS
I appreciate your honesty Polynomial. Thank you
Oct
26
comment Vulnerability scanning applicability for PCI DSS
Hi Polynomial, I agree with you but short term plan is to get PCI compliant, We more or less are and this is the only thing stopping me signing off on it. My main goal long term will be better security and prevention but i have a limited timeframe for PCI. If i can de-scope this aspect, it will buy me some time and immediate work while i work the other stuff out. Let me clear at the moment i feel i could leave every vulnerability on a machine and still the data would be secure. Im really interested in a general concensous or would like to hear from someone who has addressed this.
Oct
26
awarded  Student
Oct
26
asked Vulnerability scanning applicability for PCI DSS