Comments for Steve Shead Dot Net http://www.steve-shead.net An Information Security Blog Mon, 25 Jul 2011 14:14:54 +0000 hourly 1 http://wordpress.org/?v=3.3.1 Comment on allinurl: admin mdb by Admin mdb | Interswitchweb http://www.steve-shead.net/information-technology-and-security/allinurl-admin-mdb/#comment-6792 Admin mdb | Interswitchweb Mon, 25 Jul 2011 14:14:54 +0000 http://www.steve-shead.com/?p=1434#comment-6792 [...] allinurl: admin mdb « Steve Shead Dot NetApr 30, 2009 … Normally you would type allinurl: admin mdb into Google, but I’ve linked the query above for instant gratification, but remember this is … [...] [...] allinurl: admin mdb « Steve Shead Dot NetApr 30, 2009 … Normally you would type allinurl: admin mdb into Google, but I’ve linked the query above for instant gratification, but remember this is … [...]

]]> Comment on PCI Compliance in the Cloud by Steve Shead http://www.steve-shead.net/information-technology-and-security/pci-compliance-in-the-cloud/#comment-1566 Steve Shead Sat, 04 Dec 2010 01:31:26 +0000 http://www.steve-shead.net/?p=3330#comment-1566 Sujay - absolutely agree, but the concept still hasn't matured, and the new PCI DSS standard is now in place without deference to cloud issues, such as multi-tenant environments. Perhaps it's a maturing view - time will tell - but I do appreciate your insights. Steve Sujay – absolutely agree, but the concept still hasn’t matured, and the new PCI DSS standard is now in place without deference to cloud issues, such as multi-tenant environments. Perhaps it’s a maturing view – time will tell – but I do appreciate your insights.

Steve

]]> Comment on PCI Compliance in the Cloud by Sujay Jaladi http://www.steve-shead.net/information-technology-and-security/pci-compliance-in-the-cloud/#comment-1540 Sujay Jaladi Thu, 02 Dec 2010 07:30:58 +0000 http://www.steve-shead.net/?p=3330#comment-1540 Sorry if I am off-track with the topic here but what rings in my mind after reading your article is the following. Compliance requirements definitely need to be redefined with the considerations of ever changing technology I would say. At this point even though we are speaking about PCI compliance in the cloud understanding it as “Compliance with the evolving technology” seems to be more appropriate and again this is not me taking a position but this is definitely my understanding of the ever-changing trends. Compliance rule set is a living document and just because it is not mentioned in the set does not mean it cannot be applied as due diligence. The more threats we have the more controls will be added to the compliance requirements. It is very important to know what, where and who has the data and infrastructure that is being used by an organization. Without the right understanding of this it is difficult to implement controls to enforce compliance. For e.g. clouds is a new concept but how about collocations? This is not a new concept but we have successfully implemented compliance in collocations. If we request information on who have entered the location we will not be given access to all the information that is available but just the information that is applicable to the requesting organization is what is provided but there are alternative controls or compensating controls on whether you own the cage and if you can trace and audit entry to the cage by everyone. Trace and audit capabilities is what it comes down to at the end of the day in compliance and it does not really matter whether an organization is in the cloud or in its own data center, as long as all due diligence is administered and every transaction & action can be traced and audited to the satisfaction of the auditors (means enough auditable proof) and to protect the customers from being impacted the organization will be compliant. Sorry if I am off-track with the topic here but what rings in my mind after reading your article is the following.

Compliance requirements definitely need to be redefined with the considerations of ever changing technology I would say. At this point even though we are speaking about PCI compliance in the cloud understanding it as “Compliance with the evolving technology” seems to be more appropriate and again this is not me taking a position but this is definitely my understanding of the ever-changing trends. Compliance rule set is a living document and just because it is not mentioned in the set does not mean it cannot be applied as due diligence.

The more threats we have the more controls will be added to the compliance requirements. It is very important to know what, where and who has the data and infrastructure that is being used by an organization. Without the right understanding of this it is difficult to implement controls to enforce compliance. For e.g. clouds is a new concept but how about collocations? This is not a new concept but we have successfully implemented compliance in collocations. If we request information on who have entered the location we will not be given access to all the information that is available but just the information that is applicable to the requesting organization is what is provided but there are alternative controls or compensating controls on whether you own the cage and if you can trace and audit entry to the cage by everyone. Trace and audit capabilities is what it comes down to at the end of the day in compliance and it does not really matter whether an organization is in the cloud or in its own data center, as long as all due diligence is administered and every transaction & action can be traced and audited to the satisfaction of the auditors (means enough auditable proof) and to protect the customers from being impacted the organization will be compliant.

]]>