Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
More Than 50% Of Biggest Holiday Retailers May Not Be PCI-Compliant
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 2 / 2
Dr.T
0%
100%
Dr.T,
User Rank: Ninja
12/26/2016 | 8:24:36 PM
Re: TJX -- have we not learned?
"Who do we hold accountable"

This is a good question. Unless we put bad guys under enough pressure this will most likely never end.
Dr.T
0%
100%
Dr.T,
User Rank: Ninja
12/26/2016 | 8:22:20 PM
D?
 

I really wonder what D stands for in this case, is it like no firewall in the perimeter?
Dr.T
0%
100%
Dr.T,
User Rank: Ninja
12/26/2016 | 8:21:54 PM
Re: TJX -- have we not learned?
"I tend to pay with cash almost always."

This is a good idea. What I hate is the changes I get back, becomes harder to deal with after a while.
Dr.T
0%
100%
Dr.T,
User Rank: Ninja
12/26/2016 | 8:20:27 PM
Re: TJX -- have we not learned?
"The wise man learns from the others' mistakes."
Agree. Wiser man put his learning into action.

 
Dr.T
0%
100%
Dr.T,
User Rank: Ninja
12/26/2016 | 8:19:02 PM
No security breach yet?
I would wait for a few years to see if there was any security breach during this holiday season, it seem that is how it works these days.
ClarenceR927
100%
0%
ClarenceR927,
User Rank: Strategist
12/23/2016 | 10:49:13 AM
compliance != secure
Having consulted at 4 very large and well known retailers (and countless smaller ones) I can assure you that compliance does not equal secure. Management has always been very concerned about PCI compliance but not really willing to do what is necessary to be secure.  Good enough to pass the audit is good enough. I made things as much better as management was willing to go but none of them is really as secure as we should expect and PCI is mostly window dressing.

When you use your credit card you are simply a wildebeest on the plains. If the lion chooses you, you are as good as eaten.
RetiredUser
50%
50%
RetiredUser,
User Rank: Ninja
12/23/2016 | 2:51:32 AM
Re: TJX -- have we not learned?
Not paying with Bitcoin, Joe? :-)

It's tough knowing what we know and then going out and having to decide how we pay for things.  Personally, while I do try to use caution, I also case the hardware and make eye contact with my clerks when paying with credit.

The question I always ask here is "Who do we hold accountable?"  The vendors for not better promoting secure practices with their hardware?  The companies for not hiring good InfoSec?  Or InfoSec for not getting the message out there better?

Sometimes it feels like we have to have more than regulatory and legal shackles to force security to happen.  Perhaps a cease-and-desist order to close a business that doesn't pass should be implemented.  How many of those will be issued before everyone starts passing their compliance audits.

That this happens again and again is almost rediculous.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
12/22/2016 | 6:55:40 PM
TJX -- have we not learned?
There's an old adage:

The fool never learns.

The smart man learns from his own mistakes.

The wise man learns from the others' mistakes.

Its applicability here: After the TJX breach years ago, which happened because of the failure to be compliant with the spirit of PCI-DSS and best practices related thereto, this is inexcusable.

For these reasons, I tend to pay with cash almost always.  (And ESPECIALLY this time of year!)

<<   <   Page 2 / 2


7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16029
PUBLISHED: 2020-01-26
A vulnerability in the application programming interface (API) of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to change user account information which can prevent users from logging in, resulting in a denial of service (DoS) condition of the web interface. Th...
CVE-2020-3115
PUBLISHED: 2020-01-26
A vulnerability in the CLI of the Cisco SD-WAN Solution vManage software could allow an authenticated, local attacker to elevate privileges to root-level privileges on the underlying operating system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerabi...
CVE-2020-3121
PUBLISHED: 2020-01-26
A vulnerability in the web-based management interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability is due to insufficient validation of user-supplie...
CVE-2020-3129
PUBLISHED: 2020-01-26
A vulnerability in the web-based management interface of Cisco Unity Connection Software could allow an authenticated, remote attacker to perform a stored cross-site scripting (XSS) attack. The vulnerability is due to insufficient input validation by the web-based management interface. An attacker c...
CVE-2020-3131
PUBLISHED: 2020-01-26
[CVE-2020-3131_su] A vulnerability in the Cisco Webex Teams client for Windows could allow an authenticated, remote attacker to cause the client to crash, resulting in a denial of service (DoS) condition. The attacker needs a valid developer account to exploit this vulnerability. The vulnerability i...