Got a copy of this at Black Hat. If you're new to PCI, this is a great free resource. Granted you have to fill out their form, but there are worse fates.


Get it here:
http://www.qualys.com/forms/ebook/pcifordummies/

Don

Just curious, but who are the big five consulting companies?

Thanks Don for the Link, sounds interesting.

Awesec, I have always that they were Andersen Consulting, Delloitte, KPMG, Price Waterhouse Cooper, and Ernst & Young.   They are the ones doing most of the audits out there.   I was told that only they can actually certify you as PCI compliant.   I am not even sure what that means.   

Bill, I have no idea.  I  was hoping to get a straight answer to that question, but I have been told conflicting stories.   I am going to read that PCI for Dummies book

Thanks Ketchup, didn't hear of all of them.

$25K sounds a little much for a certification. :O

PCI... HIPA... ohhh how I hate you all.  I worked on a POS system earlier this month, they were full of viruses... running built in admin for all users... surfing the web.  I tried to encourage them to work on thier security, by mentioning some of the highlights out of PCI etc.  The whole... "if you are playing with my credit card, for gods sake don't have the system be the same one you check your yahoo mail and gossip sites on.  It'sa smoothy bar.  Hot girls, not hot on security though.  Meh.  Either way, yeah I guess it would be an interesting cert to get for testing for compliance etc.  Interesting if you can get a business to pay for it that is.  Heh.

Nice link/info Ketchup.    Thanks for the info.

Justin,

Most of us that have an interest in security are closer than you realize to the minimum number of years of experience required to sit for these exams.  It's really how you structure you resume.   For example, if you are currently employed as Network Administrator, chances are you are responsible for at least some of Operations security, such as keeping servers patched, AntiVirus deployed, etc.  When you put all this together, you are closer than you think to the number of years required.  Remember, it's not experience in all domains of security, it's one or more.   

When you sit for these exams, you have to structure your resume in such a way that it emphasizes your security experience.  In the CISSP sense, actually indicate that you are responsible for a particular area of security on your resume. 

Regarding the PCI experience requirement, I actually think it should be more than 5 years.   As many of us have seen there are a ton of auditors out there who are not worth a dime.   I don't mean to sound pompous, but passing an exam just demonstrates that you can take tests.   Experience counts more than anything in my opinion.  Would you really want someone who simply passed an exam looking after your credit card information?  Don't get me wrong, the CISSP test is not easy, but in my opinion it doesn't prove that you can tell <insert retailer here> how to store financial and personal data.