Still thinking about the framework

11 September 2010

  Last month, when I wrote my post "how would write a framework to replace the PCI?"  I had a core idea that I just had to go in one way or another.  It has been bouncing around in my head for weeks, and rather than continue to let the Ricochet off the inside of my head, I launch a project in this post and figured out the rest, it will just naturally from there.  Except when I started writing some of my ideas into iThoughts and after talking with folks like Josh Korman and Andy Ellis, I realized how great project, I was really begins and how complex is the whole thing.  I also got some very insightful comments on the original post, which gave me even more to think about.And one of the things I realized that this is not something I can do in one or two posts, this is what I actually need to plan and write with some forethought. This is not my normal expression at all. 

  One of the basic principles I have for me was to focus on results rather than the controls.  I also said that I would like all derived from the policy that is directly opposed to focusing on the results.  Politics is never a result is a range of base controls, we have created our results, we hope to work towards.So from the outset, I myself and not contrary to life before my own purposes, the only thing I can say is, if done right, wait for results, the business of creating.  In other words, I think the policy as a way to create rules for PCI and security, so I think they should be the very first thing that makes business when they want to help improve security. 

I'm not much closer to the next article in this series than I was when I wrote the first every time I speak with someone about PCI and how it can be reformed, I come away with more questions than answers and have to wonder if perhaps frame, suitable for a broad and diverse cross-section of the industry.We are working on security as an institution within three to four decades, but firewalls and antivirus is the best thing we can think of.I am not a delusion that I was going to be able to fix or even significantly improve the situation.

I'm still thinking about how to move, I still plan on writing more on the subject, but I need to plan it out and tell more people about how this can be done, and could be a few months before I can write the following steps in this article series, but I'm still thinking about it and answer it and I hope it will be worth the wait.