Yeah.
What about second assessment?
Are these typically places that fail the second time around?
Is this something that's hard to keep up with?
I would say if you have that sort of legacy catchup problem,
I've seen organizations that try to play the game of just sort of patching
and hardening the sampled sets and then sort of shoveling the other ones
kind of behind the curtain and then having to sort of play the which shell
has the pea under it year over year.
So, as an assessor, how do you look behind the curtain?
Part of what I try to do is if I say I want to sample these sets of things,
I need a good inventory to be able to do that.
And if I suspect the inventory isn't complete,
I mean, then part of it is how do you follow up on that suspicion,
right?
If I'm finding IP addresses in the firewall rules,
for example, that are not specified in the inventory,
then I'm going to say, hey, what about all these hosts?
What about all these IP addresses?
And either there are servers that they haven't told us about or there are
deadwood firewall rules that they haven't taken care of,
right?
So kind of one way or the other you're stuck.
But that's okay, isn't it?
Because if you've hidden stuff behind the curtain so your assessor can't see it,
the criminals won't be able to find it either,
will they?
Well, that's nonsense because of course they will.
Oh yeah, of course they will, yeah.
Of course they will.
And again, if you're the attacker,
if you're looking for a vulnerable spot in the organization,
right,
you've got a very different set of objectives and a very different
way you utilize your sort of time and effort,
right?
If I'm the assessor,
I have a relatively short period of time not just
to understand your environment,
but to understand it at a detailed enough level to be able
to assess it against the requirements, right?
We're all sort of working against the clock, right?
You don't want me assessing you for months and months and months,
in part because you don't want to pay me for that amount of time.
And I want to be done with this and move on to the
next thing just as much as you.
So yeah, we have the trouble that if you're trying to conceal things from me,
I mean, maybe I'll find it, maybe I won't,
but what techniques you use to hide things from me will
not shield you from the attacker.
And the point of DSS is not to get compromised,
not to get you to sign an attestation of compliance.
Right, that is the point.
And this is one, speaking as someone who used to look at forensic reports,
this was a very classic thing of these were just excluded from the sample.
These were hidden from the assessor because it was too much like hard work.
Right.
But if you've got an unhardened machine,
bizarrely, that's the one the criminal breaks into.
Invariably.
Yeah, okay.
I'm going to ask a really old question.