Sun, Jul 12, 2009 12:41 EDT

PCI DSS Legitimizes Conflicts of Interest

Posted by: Anonymous in Best Practices

Topic: Enterprise Management

Current Rating: Comments: 2

The rules and requirements for auditors reveal a number of potential conflicts of interest that could arise between an auditor and the entity it’s assessing. For example, many security auditors also make security products. The rules state that a security company will not use its status as auditor to market its products to companies it audits, but if the auditor should happen to find that the client would benefit from its product, it must also tell the client about competing products.

http://information-security-resources.com/2009/07/11/pci-dss-legitimizes-conflicts-of-interest/

You do not have flash or javascript support.

Average (1 vote)

All Comments Comments

Sun, Jul 12, 2009 21:33 EDT

PCI DSS Conflict of Interest?

Posted by: Anonymous
Rating:

So, in your example, despite the attention grabbing headline; you actually explained that the assessor whose company makes a product must also inform the client of competing products when recommending a solution. Where is the conflict of interest in that? Are you saying that it is a conflict of interest because from an assessor perspective, they would rather have the sale than have to tell the client about competing products? This example actually seems to be to the benefit of the customer and to the credit of the PCI Council.

You do not have flash or javascript support.

Reply to this comment | Post new comment | Report as spam

Fri, Jul 17, 2009 8:38 EDT

PCI DSS conflict of intrest

Posted by: Anonymous
Rating:

It is obvious that some of the requirements push products that are only available from a few vendors and are really over the top/over kill. I would question who on the committee proposed the requirement...and look into their affiliations.

I do agree with many of the concepts of producing and maintaining audit logs and controls..but frankly...no one uses or even looks at these reports unless there is a problem. What company can possibly have resources to monitors these logs?
I could see this being needed for a high volume transaction vendor...but all the same requirements should not be imposed on lower tier vendors who typically have small IT shops/staff.

Typically small shops don't have redundant staff for approval sign offs, code cross checking, or separate dev and production systems. But do have best practices for all their work.

The PCI DSS standards/committee needs to lighten up as it is very unlikely that every vendor can meet all of these requirements. I wonder what percentage of vendors even come close to meeting all the requirements..don't you?

You do not have flash or javascript support.

Reply to this comment | Post new comment | Report as spam

Post new comment

* Subject:

* Username:

* E-mail:

The content of this field is kept private and will not be shown publicly.

Homepage:

* Body:

Allowed HTML tags: <a> <em> <strong> <cite> <code> <ul> <ol> <li> <dl> <dt> <dd> <img> <blockquote> <strike> <p> <br>
Lines and paragraphs break automatically.

More information about formatting options

Are you a person?: *