Aspects of compliance with regulations, standards, laws, and policies.

learn more… | top users | synonyms

5
votes
1answer
823 views

How can Stripe be PCI-compliant?

According to the Stripe FAQ, they are PCI-compliant. Also, in their API documentation, one of the parameters to create a new card is the CVC (although, granted, it is optional). So, I assume they ...
4
votes
1answer
769 views

HIPAA: How am I required to secure PHI database access creds on my web server?

Assuming I have a database of PHI that my web application needs to access, how am I required to secure the credentials on the webserver that the web application uses to access this database? Is ...
4
votes
3answers
1k views

MS-SQL Monitoring/Auditing of PHI for HIPAA

We're currently looking for a solution (hardware or software-based) that can monitor and audit all PHI viewing activity per new HIPAA rules. We use MS-SQL for our production database. We have the ...
5
votes
5answers
4k views

Becoming HIPAA Compliant

What is required to become HIPAA Compliant? Do I need to take a test or do I just need to follow a certain set of guidelines? EDIT: Just to provide my background. I am a small IT Firm and we would ...
5
votes
1answer
916 views

Are Linux vendor-supplied security updates enough for PCI Compliance?

I have several systems that require PCI compliance, all of them are running CentOS 6.4 with all security updates applied daily. However, PCI compliance scanning will often reject detected versions of ...
4
votes
2answers
2k views

FIPS Compliance for my Android project

I am working on a security-related project and have to make sure it is FIPS 140-2 compliant. According to my understanding, FIPS compliance is compliance at hardware as well as software level. ...
1
vote
1answer
171 views

Would using Websockets cause PCI compliance failure?

Would utilizing WebSockets cause an issue with obtaining or maintaining PCI compliance?
10
votes
5answers
1k views

Data needed for why not to load third party JavaScript on web page with credit card form

My company makes a JavaScript widget that e-commerce sites can embed on their pages. Our current instructions to our customers tell them to load our JS on every page of their site and most follow this ...
4
votes
1answer
628 views

Nessus HTML5 version 5.0.3 - PCI Scan

I've been searching for a couple days, even contacting support, to find out if Nessus has a bundle that scans for PCI compliance. It selects all 44 categories and regardless of what kind of scan I ...
2
votes
1answer
140 views

Backup media storage strategy

As a company we are performing daily backups onto RDX removable media which is fully encrypted (shows as unformatted drive) and the backup software also encrypts the files during the backup process, ...
3
votes
3answers
459 views

Web application security standards/certificates

I'm currently working on Web application/service that (hopefully) will be used in a wide variety of ways. Of course I'm looking to attracting some commercial users as well, and as we all know, they ...
2
votes
2answers
1k views

What certification would be considered equivalent to the U.S.-EU Safe Harbor Framework?

The Safe Harbor website says the following: The European Commission’s Directive on Data Protection went into effect in October of 1998, and would prohibit the transfer of personal data to ...
0
votes
1answer
374 views

How to enforce NTFS permission compliance?

I have to enforce NTFS permissions based on business roles. Each role (group in ADS) can be granted the permission to read or write a file server directory. I do not care about share permissions. I ...
3
votes
1answer
93 views

Server Certification Processes

We are considering a certification process for new internal server builds before they are allowed to be placed into production. That is, the system administration team will send the server up to the ...
7
votes
1answer
363 views

Enterprise standard for securing servers.

This must be the most broad question to ask, but through the years, i've come up with my own list of things I so to secure my servers, I follow the obvious steps I could gather online such as, ...
1
vote
1answer
585 views

How to define audit controls responsibility? @ SIEM

I'm assigned to write procedural documentation for the SIEM use cases for the IT asset owners. For example, the procedures for selecting events indicating unauthorized access to user-mail box. I have ...
13
votes
4answers
2k views

PCI-DSS - one application per server?

How do I interpret the 2.2.1 point for PCI-DSS? Is "application server" 'one primary function' or does it need to be "program x server", "program y server" etc? I have a collection of applications ...
5
votes
3answers
451 views

Does GOOD Dynamics Proxy comply with EU data legislation?

My client is excited about GOOD technology; it allows them to have controlled access to business applications & email from BYOD (bring your own devices) and will enable a more mobile workforce. ...
3
votes
3answers
176 views

If I host a web form which submits CC details to a provider, are there PCI implications form host?

I'm wondering if anyone has any thoughts on a specific question I have. I read a lot about systems that 'store, process, submit' CC data requiring compliance. If I host a form on my website which ...
3
votes
3answers
199 views

Does requiring users to fill out a PDF w/ CC information and mail it back violate PCI compliance?

I'm attempting to place an order with an American company and I reside outside of America. Upon placing the order (and already submitting payment) I received an email asking me to fill out a PDF ...
4
votes
1answer
381 views

Conceptual design of vulnerability scanning program in global retail network (PCI DSS)

I am trying to design yearly program to scan for vulnerabilities on a very large network of payment terminals. The company has thousands of retail points all around the world which need to be ...
2
votes
3answers
1k views

Vulnerability scanning applicability for PCI DSS

I'm fully up to speed on PCI DSS requirements and have attend the ISA course recently. The course was helpful and I was able to bounce ideas off of the trainer. However I keep coming back to one ...
8
votes
3answers
2k views

If PCI DSS isn't a law, how can I be prosecuted for not being compliant?

PCI DSS isn't a law. Why can I be prosecuted for not being compliant?
1
vote
1answer
431 views

Which PCI DSS SAQ applies when you don't store store but transmit CHD?

We have a merchant website that uses Authorize.net's AIM. Cardholder data (credit card number, expiration date, etc.) is entered at our website. Then it's transmitted to payment gateway and isn't ...
31
votes
2answers
17k views

Minimum requrements for storing last 4 digits of credit card number?

We have a merchant website that uses Autorize.net's CIM and AIM. Our users may have multiple credit cards so we'd want to give them opportunity to distinguish between credit cards that they use on ...
0
votes
2answers
704 views

Is this way of using Authorize.net's CIM PCI compliant?

We have a webapp where Authorize.NET's CIM and AIM are used for payment operations. When user buys something at first time he enters his CC number and other billing information at our site. This ...
5
votes
1answer
56 views

What security controls should be in place for online updates of user's correspondance address?

Addresses are one of the key pieces of security information for an account. They're used for authentication, determine where statements go, and changing an address on an account provide enough ...
2
votes
4answers
514 views

unix config scanner / compliance checks

I'm looking for a tool, that scans unix operating systems for configuration issues. E.g. a script that finds PermitRootLogin yes in the ssh config file or with other words: a script that automates ...
2
votes
2answers
1k views

PCI Compliance network scope

I was wondering if anyone could clarify the scope of PCI compliance with regard to multiple networks. At present, there's one PCI compliant network to which another network connects via VPN. The PCI ...
1
vote
0answers
101 views

What category of security measures are required by popular regulations? [closed]

There's a few very popular regulations, HIPAA, SOX, PCI-DSS, PII, ITAR, GLBA. Can anyone explain what are their exact security implications? Exactly what type of implementations would my organization ...
3
votes
3answers
181 views

In what situations are web services required to protect confidentiality of user information?

I know that if a web application needs to be PCI-DSS or HIPAA compliant the user personal identifiable information (e.g. user password, etc) needs to be kept confidential. Under what other situations ...
24
votes
5answers
3k views

Is it common practice to log rejected passwords?

While selecting unique passwords for each purpose is a great idea, in practice this rarely happens. Therefore many select passwords from a personal pool of passwords that are easily remembered. When ...
3
votes
1answer
179 views

Facebook changed the default email address for every contact. How do I mitigate the impact and risk?

Facebook created a problem for regulated industries and Registered Investment Advisers (RIAs) by changing the default outgoing SMTP address for every contact to a @Facebook.com address. This is an ...
3
votes
2answers
135 views

What drives FIPS140-2 compliance?

I guess this questions is directed at Product Managers, but I would be very interested to learn what people in the know think. What are the most common factors that drives FIPS140-2 compliance for ...
1
vote
1answer
72 views

Are there any FIPS140-2 requirements that apply when boot code is updated in the field?

FIPS140-2 standard specifies the following conditional test to be performed by the cryptographic module if software or firmware components can be externally loaded into a cryptographic module: ...
4
votes
2answers
136 views

Evaluating hosting providers for CC development environment

An organization that develops software that may be subject to security evaluations such as Common Criteria is looking to externalize part of its IT infrastructure, including critical components such ...
3
votes
2answers
505 views

A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant?

We have to design and construct a system that signs files with sensible data, like evidences/proofs. The sign process is simple, basically calculate MD5 of the file content and encrypt the MD5 result ...
4
votes
1answer
2k views

How to backup database to comply with UK data protection act?

Charity has a server in their office onto which they backup a database with sensitive information. They want to get rid of this server. Is there a cost effective solution that would allow them to ...
3
votes
2answers
623 views

How can I assess the strength of user passwords in my office environment?

I want to assure the compliance of password policy in my office. Environment Intro My environment is all windows based (server 2003/2008) user base is not more than 400 employees. Nearly 90% of all ...
3
votes
4answers
270 views

What actions should be taken by site according to Data Protection legislations?

Many countries have data protection legislation: Data Protection Directive in EU Data Protection Act 1998 in UK privacy laws in USA Web application may have registration form where fields for ...
2
votes
1answer
153 views

Industrial security — resources for ISO27k compliance, social-engineering trend reports

I'm attempting to compile resources on industrial IT security from a non-technical standpoint as it pertains to the U.S petrochemical industry. This is for my final research paper as an undergraduate ...
6
votes
3answers
1k views

Is storing card details without the permission of the card holder against PCI DSS?

I've bought something from an online store, and when entering the card details, it sent the details to their server through a HTTPS connection, which I then assume they forwarded to their provider - ...
6
votes
3answers
6k views

PCI DSS requirement 6.4.2 separation of duties between development/test environments

6.4.2 Is there separation of duties between personnel assigned to the development/test environments and those assigned to the production environment? What does the separation of duties here mean? ...
1
vote
3answers
458 views

What is the best way to get a third party audit done of website security?

I have a website that needs to be PCI compliant. I have coded it using the guidelines but to be safe i wanted to get a third party audit done where this individual who runs a IT security firm and ...
3
votes
1answer
122 views

What security features and qualifications should we look for in an online backup provider?

What security features and qualifications should we look for in an online backup provider for an Internet-exposed web server storing sensitive data? In the backups themselves - encryption type, ...
1
vote
2answers
127 views

Can I instruct a Telco to prevent 2G connections from our phones?

Given that 2G is proven to be insecure (broken) at DefCon, is it possible for a Corporate IT department to work with the Telco and ban 2G connections for their devices? Some cell phones are unable to ...
1
vote
1answer
969 views

Help with scope clarification of PCI requirement 8.5.15

Section 8.5.15 reads: If a session has been idle for more than 15 minutes, require the user to re-enter the password to re-activate the terminal. Section 8 Accompanying note reads: These ...
3
votes
2answers
1k views

The point of PCI 1.3.1 through 1.3.3

In expansion to my previous question what qualifies as public access? I'm trying to wrap my head around the intent of the points 1.3.1 and 1.3.2 and 1.3.3 of the PCI standard. I have four DMZs at my ...
8
votes
2answers
185 views

Cloud-specific standards and regulations

Not specific to any particular industry or requirements, but in general - are there currently commonly accepted standards regarding cloud-based applications? I* am developing a system that will be ...
1
vote
3answers
198 views

Information Security standards in corporations

I'm developing a web based application. I want to create it so that it could be adopted by teams within corporations and large organisations that have tight IS standards. The initial organisations ...