In Depth

PCI Shrugged: Debunking Criticisms of PCI DSS

PCI DSS is imperfect, but Ben Rothke and Anton Chuvakin say the standard is in security's best interest. Here they refute common complaints and criticisms of PCI DSS.

By Ben Rothke, CISSP, PCI QSA & Anton Chuvakin, PhD

PCI is not perfect; but neither is the world in which we live. PCI is not security pixie dust to magically make security-ignorant organization secure despite itself. If an organization is hell-bent on ignoring security, PCI will not make them security conscious. If they want to become more secure, PCI DSS guidance can be of service to them.

Ben Rothke CISSP, QSA (ben.rothke@bt.com) is a Security Consultant with BT Professional Services and the author of Computer Security: 20 Things Every Employee Should Know. Dr. Anton Chuvakin is involved with PCI DSS compliance at Qualys. He is an author of the book Security Warrior and a contributor to books PCI Compliance: Understand and Implement Effective PCI Data Security Standard Compliance, "Information Security Management Handbook", "Know Your Enemy II", "Hacker's Challenge 3", "OSSEC HIDS" and others.

• Email
• Print
• Comments
• Digg This
• SlashDot

• Critics Tear Into PCI Security Rules at Hearing
• Companies Get Checklist on PCI Security Rules
• A Tale of Two PCI Security Audits
• PCI Application Security: Who's Guarding the Data Bank?
• Lightening the PCI Load: Solutions to Reduce PCI Scope