network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 1 year, 10 months |
| seen | Jul 29 '11 at 9:51 | |
| stats | profile views | 26 |
|
Jul 23 |
awarded | Yearling |
|
Mar 20 |
awarded | Great Answer |
|
Jul 24 |
awarded | Good Answer |
|
Jul 23 |
comment |
Our security auditor is an idiot. How do I give him the information he wants? To be fair, though, (as I can't edit the answer above) I'd just like to add that your answer is correct. If the server holds personal data, anything that weakens that server or the system accessing it is technically in scope of principle 7. |
|
Jul 23 |
comment |
Our security auditor is an idiot. How do I give him the information he wants? Assuming there's any personal information on those servers, yes. But it's far from clear there is. Are you suggesting it would be ok if he passed over the plain text passwords of all servers not holding personal data? The main issues are that this is a) against policy, and b) against PCI. You don't need to bring distractions into it. |
|
Jul 23 |
comment |
Our security auditor is an idiot. How do I give him the information he wants? This has nothing to do with the data protection act, which is purely related to personally identifiable information. From the sound of it, this is a PCI audit. |
|
Jul 23 |
awarded | Nice Answer |
|
Jul 23 |
awarded | Teacher |
|
Jul 23 |
answered | Our security auditor is an idiot. How do I give him the information he wants? |
