Weak SSL Ciphers on Remote Server - Help?!

[Darren B]

Your so mis informed about what Security Metrics actually does,. Security Metrics doesn't come up with the vulnerabilities that companies need to be flagged for its determined by PCI (Payment Card Industry).

SM - LMFAO perhaps if you had people that new what they were talking about you might be taken seriously, try searching the forum - it is clear SM have not got a clue half the time.

Some members are more upto date as to PCI-DSS than people in your organisation. If you know who should and who should not have it then its your job to inform the bank they have it wrong - oh but then you would not get any money for that

[Darren B]

Whether you believe them or not, it was a case of us having to go with PCI compliance on the webserver even if we do use a PSP for taking customer card details, otherwise the bank would not agree to let us use them.

Just out of curiosity, how many sites that people have on here, are one man bands or actual businesses who employ x amount of employees?

Dont forget we are a distributor for Philips so we have to go through the correct channels, a joe bloggs who creates sites for small businesses in their home office can (if they so wish) skip certain procedures, and have more flexibility as to what they can and cannot do.

Gavin i am a one man band, and no i dont require PCI-DSS as i use streamline, actinic payments and Protx (kite business)

What being a distributer for philips has to do with it i dont know? you lost me on that one

[Darren B]

That is what I thought until I was informed that is not correct. We use a PSP (Secure Hosting) for our payments, but your site itself still needs to be PCI Compliant, this what Barclays Bank told us, no offence here but I tend to believe them.

It's a shame really but you carry on - PCI-DSS is credit card company led, as all ready mentioned not a bank led scheme and barclays obviously go hand in hand with SM for not understanding requirements of a scheme they are impelmenting. personally i would have moved to someone that does understand it.

My letter from streamline told me if i used a PSP then i need to take no action providing my PSP is security tested. That was good ienough for me

[bamboo]

Just out of curiosity, how many sites that people have on here, are one man bands or actual businesses who employ x amount of employees?

You really aren't getting this are you?

It's got nothing to do with size of business, whether it has employees or not or it's what the Americans call a 'mom & pop store'.

I own two companies and am a partner in a third. They bank with two different banks and NEITHER of them have FORCED any of them to use Security Metrics totally pointless service. They use Worldpay, who are compliant, as the PSP for all three.

Barclays are obviously not aware of the rules, surprise surprise. I don't personally read the news any more but even I am aware the banking giants are in dire straights because of incompetence.
The quicker one of them goes to the wall the better IMO.

But with that said it is entirely up to you if you want to go along with Barclays and their trust in Security Metrics. If you do you SM will always find 'vulnerabilities' for reasons already made clear on this thread and many others.

Best of luck.

[grantglendinnin]

For anybody who is reading this thinking that because Barclays tend to publish the best transaction rates and this is a good enough reason to stay with them, despite being harassed by SM, think again.

Phone Streamline, they'll happily match the rates Barclays are offering, and they tend to know a bit more about the law than the latter.

Good job

[grantglendinnin]

I don't personally read the news any more but even I am aware the banking giants are in dire straights because of incompetence.
The quicker one of them goes to the wall the better IMO.

Derek, quick solution:- Don't, under any circumstances, pay your taxes this month, that'll sort them out when the Government doesn't have the money to bail them out....again

[RuralWeb]

And finally gavin please don't post any more about sm and vunerabilities as no body here is interested.

I suspect that this year I will make more money than barclays - let's hope the government let them go bust which should have happened to all the other banks IMO.

[RuralWeb]

For anyone who has letters from sm or barclays then perhaps they would like to get in touch with BBC working lunch and highlight the harrassment small business is still getting from bankers.

[Darren B]

For anyone who has letters from sm or barclays then perhaps they would like to get in touch with BBC working lunch and highlight the harrassment small business is still getting from bankers.

Now that is a good idea, almost wish i had one now

[parklifeclothes]

My inbox now has a total of 4 security metrics emails or should i say blackmail letters!!

[RuralWeb]

I just read that barclaus are being investigated for missleading investors - sound familiar

[parklifeclothes]

For anyone who has letters from sm or barclays then perhaps they would like to get in touch with BBC working lunch and highlight the harrassment small business is still getting from bankers.

Just emailed them!!

[RuralWeb]

Working lunch are doing a live show at the trafford center this Wednesday if anyone is in the area.

[RuralWeb]

Anyone wanting to complain about SM could try https://www.pcisecuritystandards.org/index.shtml and use the ASV feedback form

[grantglendinnin]

Indeed, Jeremy Clarkson might have some wise words to share