The Register has an article on the Payment Card Industry decertifying Heartland Payment Systems and RBS World Pay from their Data Security Standard. As of now, those two entites that suffered the most recent, and dare one say huge, security breaches, are no longer able to do business with PCI merchants.
I wrote before (The New Computer Hacking Game) that it was a amazing to me that a company could be PCI-DSS certified and have an ongoing breaches as Heartland, and apparently RBS, did. It seems I’m not alone in being incredulous, as the Reg observes:
The ability of attackers to penetrate both companies while they were in good standing with the PCI guidelines has prompted some to criticize them as little more than a rubber stamp designed to make the public feel more comfortable using credit cards.
It would be nice to have something positive come out of this, other than getting new credit cards where the shinyness hasn’t worn off the numbers yet…
via [The Register]
I’m of the opinion that those who think should also do. I believe it helps keep us honest. For years now, I’ve been continually confronted with the curious creature the White Board Architect. WBAs are great talkers, and their ideas really do make sense, well at least most of the time. But I’m highly skeptical.
As a practicing architect, I’m convinced I can’t do without the feedback I get by actually using my designs. If building software is truly creating a theory of how a system should work, then I just need the proof. I’m a pretty good architect, and I’m further convinced that if I need that feedback, then others probably do too. Which is why I’m such a skeptic that WBAs can continue to do a good job without getting their hands dirty.
Perhaps I’m not as good as I think I am. Perhaps all those WBAs out there aren’t as good as they think. Perhaps it’s both: I’m probalby not as good as I think, they could really use the feedback from trying to consume their own designs.
Something’s been on my mind, and I need to speak up a bit. I’ve grown increasingly annoyed by agile practitioners who are slavishly devoted to their favorite agile author. It doesn’t matter if it’s Uncle Bob, Ken Schwaber or Kent Beck, I think there’s something a little unhealthy in some people attitudes. I’ve seen trained professionals claim that they can’t do something because “Scrum doesn’t say they can.” I’ve heard them take umbrage with questioning what their favorite author’s written, as though we were questioning the word of God himself. How dare we question the word of Schwaber?!? Read more
- Ars Technica
- Dark Reading - IT Security
- Help Net Security
- SANS Internet Storm Center
- Schneier on Security - Dr. Bruce Schieier’s blog
- Security Info Watch
- What to Fix - Daniel Markham, fellow consultant
- Wired Gadget Lab
- Wordpress Documentation
- WordPress Planet
- Wordpress Support Forum