Aspects of compliance with regulations, standards, laws, and policies.
6
votes
2answers
717 views
Is BitLocker on a virtual machine still FIPS 140-2 compliant?
BitLocker can be used as a cryptographic module to fulfill FIPS 140-2 security level 1 compliance.
In a common setup, USB thumb drives can be used to unlock drives encrypted by BitLocker on startup.
...
6
votes
2answers
877 views
Are TPM chips or the equiavlent required for FIPS 140-2 security level 1 compliance?
A 'TPM chip' is:
a secure cryptoprocessor that can store cryptographic keys that
protect information
FIPS 140-2 requires a cryptographic module, which can be hardware, software, or both that ...
9
votes
2answers
56 views
Do I need to password-protect an “Electronic Copy” of health information given to a patient on e-media?
I'm struggling to find good documentation regarding requirements around security and encryption of patient clinical information when delivered to a patient in electronic format. Patient portals, ...
5
votes
1answer
164 views
What compliance problem does “Common Criteria Certification” solve?
It has been said Common Criteria solves a "Compliance problem, and not a security problem". Can someone explain where CC certification is required or benefits an industry?
Is it simply a marketing ...
0
votes
1answer
252 views
Enterprise Encryption Considerations
What are the different aspects to consider for Enterprise Encryption policy?
So far the resources I have are:
https://www.owasp.org/index.php/Cryptographic_Storage_Cheat_Sheet
...
5
votes
1answer
112 views
Security evaluation: what is there apart from common criteria?
ACME makes a product that is used in some security-sensitive applications. There are no particular security regulations or industry standards in the domain of this product. ACME's business arm would ...
3
votes
6answers
326 views
When storing private identifying information in a web application, what is “industry standard” best practices?
I am building a hosted (SaaS) web application that stores PII like name, email address, and employer of the user. As of right now, I don't intend to ever store credit card numbers or bank account ...
2
votes
3answers
303 views
Any place where I can find some template or base documents for IT/Infosec Compliance?
We're facing an audit and we are sorely lacking in documentation regarding information security policies. I've done some Googling and have been surprised by the difficulty of finding a good "template" ...
7
votes
3answers
236 views
How do I secure my advertisement space against ad overlay browser attachments?
I don't really have an issue with advertisements simply being blocked by individual users who are visiting a customers site or my own site. As an individual you have the freedom to choose not to look ...
10
votes
4answers
632 views
Is Google Analytics HIPAA compliant? How can I find out?
I'd really like to implement Google Analytics at my work on web software that is required to be HIPAA compliant. But I'm wondering if it's against the rules. Does anyone know how I can find out? I've ...
3
votes
1answer
91 views
Data Protection in EU for usage of personal documents
I don't know if this question fits into this forum or not.
Is there some template documents that comply with the EU regulations for Data Protection and Privacy that I can reuse / (get them signed by ...
15
votes
3answers
640 views
Do HIPAA Security Officers face personal liability for breaches?
The role of HIPAA Security Officer is very important in maintaining compliance. In smaller organizations, there's overlap in employees' roles, so the person that ends up as the HIPAA Security Officer ...
3
votes
3answers
225 views
HIPAA compliance in web forums?
If a website has a private forum (membership is not free) where people may ask health questions and paid Doctors are around to answer them, do normal HIPAA compliance rules apply?
In any forum, ...
6
votes
1answer
146 views
How to Get and Set Digital Signatures with FDA 21 CFR Part 11 Standards
How do I get and set digital signatures with the 21 CFR part 11 standards as defined by the Food&Drug Administration of the USA?
4
votes
2answers
176 views
Is a “SAS 70 Type II” audited host SEC compliant?
From what I have read and known, SEC compliance is quite vague. It is best to be addressed in a strong manner, but when it comes to hosting in third-parties, the only way for you to prove their ...
7
votes
7answers
2k views
Storing credit cards for automatic payments?
I have no experience with storing credit cards and I do not know anything about the legal end of this.
The company I work for / develop for wants to store credit cards to process auto payments for ...
5
votes
3answers
243 views
Certifiable standards for server security, besides PCI-DSS?
The Payment Card Industry Data Security Standard is widely used in the financial industry and seems to be a useful requirement from the standpoint of a potential customer (see also Does PCI compliance ...
4
votes
2answers
256 views
Is Common Criteria (CC) a suitable standard to certify web applications
I never came across a web application that has been certified according to Common Critera. As far as I know there isn't even a protection profile available for web applications.
What is the reason ...
6
votes
7answers
828 views
Is this set-up PCI-Compliant?
Question: Is there a way to store credit card information on a shared hosting server AND be PCI compliant?
Here is the setup:
1) SSL is being implemented for the whole checkout process and for the ...
4
votes
2answers
669 views
Storing account numbers and sort codes online
There are a lot of questions on storing credit card information, and of how PCI SSC/PA-DSS regulations apply to such activities and systems. I have read a lot of these, but my question relates to a ...
19
votes
1answer
1k views
Has anyone achieved PCI compliance on AWS?
All the FAQs, documents and statements published by AWS aside, did any Level 1 merchant or service provider actually achieve PCI compliance on AWS yet? We're evaluating moving some of our services to ...
12
votes
3answers
566 views
Whistleblowing, business ethics and credit card data
I'm writing this post as I'm facing a personal, ethical dillemma and I would like feedback on the best way to approach this situation, particularly from a philosophical point of view.
I work for a ...
4
votes
2answers
253 views
Is PCI DSS applicable to other solutions than those dealing with payment cards?
According to this quote from "applicability" section of PCI DSS it's not:
The primary account number is the
defining factor in the applicability
of PCI DSS requirements. PCI DSS
requirements ...
4
votes
1answer
159 views
Store To Store communication through MPLS VPN
In a PCI environment with an MPLS VPN network setup should you allow store to store communication?
Do you think that an MPLS network would be consider secure enough for this? why or why not?
10
votes
4answers
925 views
Question of importance of FIPS in security implementations
I am by far, no security expert but I experience on the subject working in Java (JCA,JCE and JSSE).
Anyway, recently there was a discussion about FIPS compliance.
I looked into this and SUN's ...
9
votes
4answers
596 views
New credit card security standards regarding PA-DSS Compliance
The new credit card standards including PA-DSS can be quite confusing for software companies.
My question is this: If your software company designs a POS software system (like we do) which utilizes ...
8
votes
2answers
174 views
How can one easily determine which IT Security related regulations apply?
Joe Tech gets a job managing Acme Startup's IT services. Acme Startup handles information of X, Y, and Z data types, and offers services A, B, and C. Joe Tech is aware that some of these data types ...
2
votes
1answer
432 views
PCI Compliance - If am eligible to self certify - do I need to use a QSA company in this context?
Setting up a new company with ecommerce app, and looking at PCI compliance.
What I need to know is if I need to use a pci security assessor to verify the answers to the self assessment questionnaire?
...
7
votes
1answer
836 views
Is there a way for a consumer to report PCI non compliance?
Is there a way for a consumer to report PCI non compliance?
5
votes
2answers
154 views
How can IA-5(1)(b) be enforced on non-Windows systems?
I have a question posted already for this issue in Windows systems, and thought that non-Windows systems should perhaps be covered separately.
In NIST SP 800-53 Rev. 3, IA-5 is the control addressing ...
7
votes
2answers
364 views
How can IA-5(1)(b) be enforced on Windows systems?
Note: I've also posted a question for this issue on non-Windows systems.
In NIST SP 800-53 Rev. 3, IA-5 is the control addressing "Authenticator Management". The requirements in this control include ...
17
votes
4answers
1k views
Why doesn't the client's web browser need to be PCI compliant?
A hypothetical online store that accepts credit card payment will have to be PCI compliant because it receives (transmit), process and possibly store credit card numbers.
But the client's web browser ...
4
votes
3answers
361 views
Does (J-)SOX Forbid the Use of Open Source Software?
With Regard to Sarbanes Oxley and particularly The Japanese version thereof: Is it true that in order to comply with (J-)SOX you must have a support contract - and therefore a responsible party - for ...
3
votes
1answer
608 views
How to apply FIPS to Microsoft Access database with custom VBA
As the software engineer on a project, I have been asked to make a Microsoft Access application, with custom interfaces running custom VBA. That part is going just fine. Recently though I was asked to ...
5
votes
2answers
347 views
How can Network Disconnect be implemented for RDP on a Windows system (2003/XP or later)?
From NIST SP 800-53, Rev. 3:
SC-10 NETWORK DISCONNECT
Control: The information system terminates the network connection associated with a
communications session at the end of the session or ...
5
votes
2answers
470 views
What is the equivalent European organization of NIST, especially in the Security Computer Division?
What is the European counterpart organization to USA's NIST?
I want to check the European best practices and guidelines on computer security.
Does anyone know if this organization exists, and if ...
2
votes
2answers
248 views
What compliance framework is appropriate for firewalls
As a more corpose vulnerability assessment and penetration test, one step of our activity is to review from a security perspective the policy of some firewall.
In our society we have a deep ...
8
votes
4answers
613 views
What is an appropriate auditing standard for a law firm?
I'm an IT Admin at a law firm. We handle sensitive customer data and some health records. I'd really like to have an outside consultant assess our data security practices, but I'm not sure what to ask ...
5
votes
1answer
326 views
Does PA-DSS apply to a SaaS eCommerce system?
My company develops and hosts a custom eCommerce and CMS system. We provide this only under a hosted, software-as-a-service model. We are in full control of the hosting environment, and our customers ...
7
votes
4answers
1k views
Is Facebook Connect or Twitter OAuth PCI Compliant?
We have a system that stores credit cards securely on file. We'd love to allow users to sign up using Facebook Connect or Twitter.
Obviously this wouldn't be secure if we were trusting just any old ...
3
votes
2answers
295 views
Which PCI SAQ would you say to use if you are neither a merchant nor service provider?
Low down: This client does zero with credit card data (no processing, no passing of it, nothing), but they do have a device often placed on the same network segment of a POS (Point of sale) system.
...
12
votes
3answers
2k views
Nessus vs third-party scans
As part of our PCI-DSS compliance process we get scans done by a third party. Based on the form and wording of the output, it's pretty clear they're using Nessus for most of their heavy lifting. Same ...
4
votes
2answers
238 views
Issues with the use of network surveillance tool in your company?
What issues will we face with the use of network surveillance tool in the company network with respect to the Telecommunication Interception Act and Privacy Act ?
And what policies could be ...
4
votes
1answer
573 views
HIPAA Compliance or What measures would you recommend to secure PHI for devs?
I work with a company that sells medical supplies and equipment. As part of this, we retain patient information or Protected Health Information (PHI). What measures have you taken when providing ...
20
votes
5answers
2k views
PCI Encryption Key Management
(Full disclosure: I'm already an active participant here and at StackOverflow, but for reasons that should hopefully be obvious, I'm choosing to ask this particular question anonymously).
I currently ...
10
votes
2answers
483 views
logging requirements for PCI for web applications
Does PCI dictate how much should be logged at an application level or simply what shouldn't be logged?
I'm struggling with too much logging right now and some people who think we should have it. From ...
5
votes
3answers
286 views
Are Windows security updates audited?
An IT guy said that in his company, the Windows updates (small security updates that are downloaded automatically by the Windows autoupdate) are checked by the auditor. ie: the auditor checks if every ...
7
votes
5answers
501 views
What security requirements are a defacto standard in the Financial Industry?
What technologies, processes, or laws that relate to InfoSec apply specifically to the Financial industry?
If you're familliar with the Financial Industry, can you share details? For example:
What ...
17
votes
5answers
749 views
Does PCI compliance really reduce risk and improve security?
Might as well bring this hot topic to here!
For those not in the know: https://www.pcisecuritystandards.org/
8
votes
4answers
404 views
Wireless Activity Monitoring for PCI DSS Compliance
In an effort to be PCI DSS compliant, I took a trustkeeper.net questionnaire. I failed the question that asks
Is the presence of wireless access points tested for by using a wireless analyzer at ...
