Society of Payment Security Professionals - Payment Security Blog

There is No Spoon - Compliance in a New World

The arguments for and against PCI have gone far to both extremes of either standing ideologically PRO or CON both the standard and the industry as a whole.  When it comes to payments security people either love or hate the current compliance initiative called PCI DSS.  I’m here to tell you there is no spoon!

As part of our daily lives we believe what we are told and follow the leader, sometimes almost lemmingish, on both extremes of the spectrum.  The title of this post is meant to reflect the fact that there is no one answer to compliance.  There is no one point at which you are compliant and thus can stop security.  There is no hair splitting on the topic of what is compliant and what is not.  There only exists risk management, and I would argue risk is primarily based on the current and ever changing attack environment.  The answer to compliance is not the point at which you can stop, but the ever changing spectrum of risk itself.

I’m a strong proponent of what I’ve coined Attack Vector based Risk Management (AVRM).  This means simply that you cannot economically defend your home until you better understand the evolving threat landscape.  For example, if you know that attackers are breaking into cars in your neighborhood and stealing the 8-track players then putting another lock on your front door will not solve the problem.  You need to start parking your car in your garage or putting a better surveillance system outside your house.  Sure you could build a fortress to keep all your systems inside but that’s not economically feasible (especially these days.)

So, we have people on one end of the spectrum that cry monkey every time a house gets broken into and we have people on the other side that preach about building fortresses.  Who should we listen to?  How bad is the world out there?  What risks are we willing to accept and what are we not willing to accept?  Once you understand that there is no one ‘right’ answer for all companies of all sizes in all industries across the entire globe, you will begin to accept the fact that a risk based approach is the only real and scalable approach towards not just security but also compliance.

I’m famous for asking the question, “Can a firewall be used to segment a network?” Most people will say ‘yes’ but I will say ‘no’.  I feel the paradigm change and mind shift when I say, “No, only a properly configured firewall can segment a network.”

So again I say, there is no spoon.  Try to imagine a world in which there is no concept of compliance, and then you will realize that the end goal for both security and compliance should be a risk based approach and not one involving a checklist.  Try to imagine a world where there are not QSAs making point-in-time assessments but an internal and ongoing process of review and maintenance.  It is only then that you will realise the truth, which is to say that it’s not compliance you dislike but the attackers, and only by understanding their motivations and patterns can you better protect against them.