[Autogenerated] And when you do this exercise now,
bear in mind is a requirement in D s s to review your
firewall rules every six months.
Right?
Do you typically find the reform or rules that shouldn't be there,
that people don't know why they're there?
Okay, Yes.
Again,
even a modestly complex firewall rule set turns into this sort of
thicket of unknowns very quickly on and very often we can kind of
spot them just from putting them up on ah,
good size screen in a conference room and looking at and say,
What is that thing?
D'oh!
Right.
And then everybody sort of gives you that kind of ______ face.
Ah, and they say Let us investigate it and then two weeks later,
the way don't know, right, we should get rid of it.
And that's really one of the points that hopefully
that people work out about an order.
But an order isn't just about for somebody to come in and say,
Oh,
you're compliant with the standard and give it to your
acquiring bank or to the card schemes.
It's actually about somebody else coming and looking at your
environment and helping you find the bits that you missed.
So it's a security exercise as much as a compliance.
That's exactly right, right?
And that's why it's a security standards, right?
It's in the name Ah, and yeah, part part of part of what's in requirement one.
Part of what's in a number of the requirements is not just the state.
At the moment it is observed right,
but the process by which you get there and stay there.
Right?
So, yes, I want to see your process for reviewing firewall rules.
Your rules maybe.
Okay, today, right now, at this moment, I'm in examining them.
But if your ability to review them is deficient,
right, if there's no sort of meaningful output,
if there's no sort of rigor to your method to reviewing them every six months,
then okay, that's a problem.
Um, imagine my first assessment.
Haven't reviewed my firewall six months ago.
Is that problem?
Not necessarily right?
There's not.
There's not generally a need to go fabricate historical events.
Okay, right.
So if we say this is your first assessment, you have a current fire will rule.
Set review.
You have a procedure that says you will review them every six
months and that procedure is believable,
right?
You have the right people.
They have that task sort of assigned to them appropriately.
You've got a reasonable calendar of events.
If you can show me the one review that you've got.
Okay, let's fast forward a year.
You come on site for the second year on.
There's no six month review.
Is the organization now completely out of compliance for the rest of their life?
Won't No, no.
The general practice in PC ideas s is Okay, fine.
We find something that's not in compliance, and then you remedy it.
All right?
So if you haven't done that six month review six months ago, right?
You know, we can't go back in time and change that dress on.
And it's not really intended that you then have to sit in the non
compliance sort of penalty box for a whole year.
Uh, you know, find going.
Do the review of you go and do the review going.
Send them or right.
But now, if you keep doing that year over,
year over year where I come back, you know,
in your three and oh, yeah,
we let all the intermediate controls fall down while your back was turned.
Um, I mean, one have typical on and and to,
you know,
I might start reevaluating my relationship with you
as your successor and saying, Do I really want this organization?
Because let's be very clear.
The que ESAs primary goal is to retire without having signed the
A SC foreign entity that gets a major breach.
Okay,
so So you don't want to have your signature on the aft
estacion of compliance for breached entity?
Yes.
I don't want that.
Has that ever happened to, You know, that's really good to hear.
I'm very pleased with that.
I intend to keep it that way.
I have some colleagues in the industry who know Emma.
Yes, and in many km in its complex, right.
In many cases, it's not really their fault.
Yeah.
I mean, I've been on site is an assessor on,
You know,
you get that thing that there is another firewall that they're not
telling about this not on the network diagram.
And I mean, if they don't tell you, you can't do anything about right, right?
This is this is the truth of the matter, right?
For this requirement, particularly as well as a number of others.
If if you, as the assessed entity,
want to pull the wool over my eyes and you're even a moderately decent liar,
you can do that.
Yeah.
And that, of course,
gets someone in a really great position of being compliant but insecure.
Right?
So, you know, one boxes takes in the other box isn't right.
The much more important box remains UnTech absolute on dhe waiting,
you know, toe cause problems down the line.