PCI Compliance: The Myth of the Compliant But Unsecure Enterprise

Historical Archive Note: This post was originally published on the Gartner Blog Network on November 5, 2008 by Anton Chuvakin.
Original URL: http://blogs.gartner.com/anton-chuvakin/2014/02/10/pci-compliance-myth-of-compliant-but-unsecure/ | Archive.org Snapshot

In writing our book on PCI Compliance, the most striking finding is how many retailers achieve clean Reports on Compliance (ROC) only to suffer catastrophic credit card breaches weeks later.

PCI DSS Section 10 mandates log review, but checking a box that says "logs were reviewed" does not mean a threat hunter actually looked for anomalous lateral movement. Compliance is a trailing indicator; threat-driven security operations must lead.