PCI Segmentation - Seriously?

A friend who recently went through the new annual QSA re-certification training a while back shared the most recent training manual with me. I have to say, that some of the clarifications are astonishingly... bad.

Specifically what I am taking issue with is the clarification around network segmentation. The title of the slide is:

"What are acceptable forms of Network Segementation?"

Then the slide describes Cisco access control lists.

Right.

Think I'm nuts? The slide goes on further to give the following example:

access-list 100 deny ip 10.0.0.0 0.255.255.255 any log

access-list 100 deny ip 127.0.0.0 0.255.255.255 any log

etc...

Another interesting sub bulletpoint is "Confirm audit logging is in place for all access to segmented network," suggesting that there are cases wherein you would not only be exclusively using ACLs, but that you may create specific ACLs which allow access to the "protected" network from the unprotected interface.

Translated:

"Cisco ACLs are effective protection for the cardholder environment, and if you need to make exceptions to your already bad security practice by allowing administrative traffic in from the outside, then go ahead."

Its any wonder that compliance numbers grow every year, and so do the number of compromises.

PCI QSA Training - Assess, Remediate, Reassess ?

I was speaking with a friend and colleague today about his experience with the most recent PCI training and what I found out was, well, interesting to say the least.

On the topic of independence and thoroughness, the SSC is apparently suggesting that it is acceptable to have an individual QSA:

• Perform the assessment.


• Remediate the issues in the environment.


• Re-assess the environment in subsequent years.

In my opinion, you may as well have the merchant or service provider simply self-assess at this point, because the QSA's objectivity is all but gone.

Anyone who has ever gone through QSA training and has spent any time doing work in the infosec space will tell you that the training materials are fairly simple, and the test is a walk in the park.

In fact most QSAs will tell you that they haven't learned anything substantially new by virtue of becoming a QSA. For the most part, the certification only enables them be the examiner of record on paper.

In other words, no special knowledge required, zero objectivity, and lots of multi-year managed service contracts between QSAs and merchants.

Its not hard to see why things like Heartland and RBS are happening. The ROC has become less honest than the tax return.