PCI Compliance Projects?

**ContractIn** · 1 May 2007, 14:17

Originally posted by portseven

Anyone seeing much activity in regards to PCI compliance projects?

Given then latest deadline is June 2007, I would like to think there are a few projects out there, but then again I wouldn't mind a few years of this work. Sounds like another Y2K / Chip + Pin thing.

Yes a lot of work being done, but not seen much in demand for contractors with PCI experience.

I know a lot of big consultancies have jumped on the band wagon and offering a compliance service for this.

**wendigo100** · 1 May 2007, 14:38

Originally posted by portseven

Anyone seeing much activity in regards to PCI compliance projects?

Oh, I've nearly finished it all. Sorry.

**ratewhore** · 1 May 2007, 15:19

If you look at PCI compliance it's a piece of p1ss. There's not much contract work around because it's the larger companies with x number of transactions who really need to knuckle down so they are calling in the big consultancies.

It's the same as Mifid. All this compliance stuff is the same old sh1t in a different wrapper, that's all...

**ContractIn** · 1 May 2007, 15:26

Originally posted by ratewhore

If you look at PCI compliance it's a piece of p1ss. T

Not if you are non-compliant as some of my clients are not. Especially legacy systems. Is a costly exercise to become compliant.

**ratewhore** · 1 May 2007, 15:27

Originally posted by ContractIn

Not if you are non-compliant as some of my clients are not. Especially legacy systems. Is a costly exercise to become compliant.

Sorry, I meant from a security professionals point of view, not the clients.

**portseven** · 1 May 2007, 19:34

Originally posted by ratewhore

If you look at PCI compliance it's a piece of p1ss.

Erm, think not. My current gig has a lot of work ahead to become compliant, full upgrade of EPOS software (2800 tills), segmentation and firewall installation into all store networks (200 of the buggers!!), and all that before we look at all the log analysis infrastructure, intrusion detection systems, file integrity monitoring bollox.

Apparently they are not the worst retailer out there, there are others in worse positions

**ratewhore** · 1 May 2007, 20:02

Originally posted by portseven

Erm, think not. My current gig has a lot of work ahead to become compliant, full upgrade of EPOS software (2800 tills), segmentation and firewall installation into all store networks (200 of the buggers!!), and all that before we look at all the log analysis infrastructure, intrusion detection systems, file integrity monitoring bollox.

Apparently they are not the worst retailer out there, there are others in worse positions

My point is none of that is rocket science and given the correct technical and managerial resources, pretty straightforward to deliver. Wait until you get into the secure application development - that's fun!!

That aside, make hay while the sun still shines...

**portseven** · 1 May 2007, 21:27

Originally posted by ratewhore

My point is none of that is rocket science and given the correct technical and managerial resources, pretty straightforward to deliver. Wait until you get into the secure application development - that's fun!!

That aside, make hay while the sun still shines...

Yes very true, all the requirements are very sensible things you should do. It's the retro-fitting to a non-compliant architecture thats the 'hard' bit.

making hay!!

PCI Compliance Projects?