Comments on: PCI Compliance in 60 days? http://hackreport.net/2007/08/08/pci-compliance-in-60-days/ Security News Sat, 19 May 2012 00:46:55 +0000 http://wordpress.org/?v=2.0.4 by: wow gold http://hackreport.net/2007/08/08/pci-compliance-in-60-days/#comment-34346 Fri, 28 May 2010 01:29:27 +0000 http://hackreport.net/2007/08/08/pci-compliance-in-60-days/#comment-34346 I also had strong executive sponsorship and support of the CTO to help us overcome obstacles in IT. I also had strong executive sponsorship and support of the CTO to help us overcome obstacles in IT.

]]> by: metin2yang http://hackreport.net/2007/08/08/pci-compliance-in-60-days/#comment-34345 Fri, 28 May 2010 01:24:07 +0000 http://hackreport.net/2007/08/08/pci-compliance-in-60-days/#comment-34345 I am interested to hook up with a reputable group of consultants for bringing turnkey solutions in less than 60 days to a few of our clients NOW. I am interested to hook up with a reputable group of consultants for bringing turnkey solutions in less than 60 days to a few of our clients NOW.

]]> by: Mike Ghodoosian http://hackreport.net/2007/08/08/pci-compliance-in-60-days/#comment-4955 Sat, 29 Sep 2007 22:08:13 +0000 http://hackreport.net/2007/08/08/pci-compliance-in-60-days/#comment-4955 I read your comments on the preparation of PCI solutions in healthcare. I am interested to hook up with a reputable group of consultants for bringing turnkey solutions in less than 60 days to a few of our clients NOW. I could also use a white paper or two on the details. Can you help or give me some advice? Thanks, Mike Ghodoosian, URC I read your comments on the preparation of PCI solutions in healthcare. I am interested to hook up with a reputable group of consultants for bringing turnkey solutions in less than 60 days to a few of our clients NOW.

I could also use a white paper or two on the details. Can you help or give me some advice?

Thanks,

Mike Ghodoosian, URC

]]> by: Cary Sholer http://hackreport.net/2007/08/08/pci-compliance-in-60-days/#comment-4308 Wed, 29 Aug 2007 22:51:30 +0000 http://hackreport.net/2007/08/08/pci-compliance-in-60-days/#comment-4308 Allen and Martin, I agree with both of you. Implementing any solution in less than 60 days requires advanced planning, standard procedures, and a very high functioning team with lots of experience. Implementing a security and compliance solution also requires more standards, e.g. a security policy template, well thought our support processes, and job descriptions parced out to maintain separation of duties. While all of this sounds simple enough, to implement a security and compliance solution in 60 days can be done and I have done it. Yet, we had most of the prework done before we acquired the vendor solution. We also had strong executive sponsorship and support of the CTO to help us overcome obstacles in IT. The seven P's that I learned early in my career make all of the difference on these types of projects: Prior Proper Planning Prevents Piss Poor Performance. The best teams with enough prior proper planning can implement almost anything in 60 days. Regards, Cary Allen and Martin, I agree with both of you. Implementing any solution in less than 60 days requires advanced planning, standard procedures, and a very high functioning team with lots of experience. Implementing a security and compliance solution also requires more standards, e.g. a security policy template, well thought our support processes, and job descriptions parced out to maintain separation of duties.

While all of this sounds simple enough, to implement a security and compliance solution in 60 days can be done and I have done it. Yet, we had most of the prework done before we acquired the vendor solution. We also had strong executive sponsorship and support of the CTO to help us overcome obstacles in IT. The seven P's that I learned early in my career make all of the difference on these types of projects: Prior Proper Planning Prevents Piss Poor Performance. The best teams with enough prior proper planning can implement almost anything in 60 days.
Regards,
Cary

]]> by: Martin Hack http://hackreport.net/2007/08/08/pci-compliance-in-60-days/#comment-3898 Fri, 10 Aug 2007 03:40:02 +0000 http://hackreport.net/2007/08/08/pci-compliance-in-60-days/#comment-3898 I'm not sure whether everything has to be in place *before* you hire a vendor. For example, most of the vendor specific documentation won't be possible to produce after it's been deployed and aligned for a given customer environment, The underlying issue here is that there are companies that look at PCI as, "oh it's just another audit we've got to pass", and then there are organizations who simply want to have a great security posture. Two observations here, the first group are usually the guys who always operate out of a tactical, "that's good enough" catch-up mode, the second group are the ones who have a much more strategic approach to security. Nothing that's in the current PCI DSS spec should be a surprise to anyone who deals with security, all of the requirements make security AND business sense and one could argue that companies should have been following them even without a standard and the threatening of fines. So I would suggest that if you approach every new security requirement from a tactical point of view you are already screwed. At the same time organizations could start and use a "60 days to compliance" at least as a framework that gets them out of the tactical and into a anticipatory mode for security. For a disciplined organization - yes they are out there - chances are they are already there and if there are a couple of things they have to update to pass an audit, they should be able to do it in 60 days. I'm not sure whether everything has to be in place *before* you hire a vendor. For example, most of the vendor specific documentation won't be possible to produce after it's been deployed and aligned for a given customer environment,

The underlying issue here is that there are companies that look at PCI as, "oh it's just another audit we've got to pass", and then there are organizations who simply want to have a great security posture. Two observations here, the first group are usually the guys who always operate out of a tactical, "that's good enough" catch-up mode, the second group are the ones who have a much more strategic approach to security. Nothing that's in the current PCI DSS spec should be a surprise to anyone who deals with security, all of the requirements make security AND business sense and one could argue that companies should have been following them even without a standard and the threatening of fines.

So I would suggest that if you approach every new security requirement from a tactical point of view you are already screwed. At the same time organizations could start and use a "60 days to compliance" at least as a framework that gets them out of the tactical and into a anticipatory mode for security. For a disciplined organization - yes they are out there - chances are they are already there and if there are a couple of things they have to update to pass an audit, they should be able to do it in 60 days.

]]>