I was flying my boat to the moon the other night, when John Glenn asked me to review the list of PCI requirements still to be completed (or remediated, in PCI argot). The list … shows we haven’t started … almost 270 items to go … its all blank … oh no … beep-beep-beep and my alarm clock wakes me up. Yet another PCI nightmare is over. The good news, however, is that we are done with this process and now technically have passed our PCI-DSS audit. Woo-hoo!

What were the pitfalls we encountered? Verisign has a nice list of the top PCI audit failures. The areas where companies most commonly fail are generally what you might expect: failure to protect stored data, failure to test security systems and processes, failure to assign user’s a unique id to access a system, failure to install a strong firewall configuration, etc.

However, there are a couple of areas in the top 10 that are pretty frightening to discover still exist in 2008, such as failure to change default system passwords and failure to restrict physical access to cardholder data.

How did Envysion do against the averages?

I’ll share that tomorrow.