Aspects of compliance with regulations, standards, laws, and policies.

learn more… | top users | synonyms

5
votes
1answer
217 views

Security evaluation: what is there apart from common criteria?

ACME makes a product that is used in some security-sensitive applications. There are no particular security regulations or industry standards in the domain of this product. ACME's business arm would ...
5
votes
1answer
658 views

Does PA-DSS apply to a SaaS eCommerce system?

My company develops and hosts a custom eCommerce and CMS system. We provide this only under a hosted, software-as-a-service model. We are in full control of the hosting environment, and our customers ...
5
votes
1answer
56 views

What security controls should be in place for online updates of user's correspondance address?

Addresses are one of the key pieces of security information for an account. They're used for authentication, determine where statements go, and changing an address on an account provide enough ...
5
votes
2answers
620 views

What SSD maker has implemented Secure Erase to spec?

I have a Kingston hyperx drive circa 2012. I kicked off a secure erase on it. I then remounted the drive and was horrified (well, not really more like bemused) to see my whole parts of my old file ...
5
votes
1answer
817 views

Are Linux vendor-supplied security updates enough for PCI Compliance?

I have several systems that require PCI compliance, all of them are running CentOS 6.4 with all security updates applied daily. However, PCI compliance scanning will often reject detected versions of ...
4
votes
5answers
3k views

Becoming HIPAA Compliant

What is required to become HIPAA Compliant? Do I need to take a test or do I just need to follow a certain set of guidelines? EDIT: Just to provide my background. I am a small IT Firm and we would ...
4
votes
3answers
548 views

Does (J-)SOX Forbid the Use of Open Source Software?

With Regard to Sarbanes Oxley and particularly The Japanese version thereof: Is it true that in order to comply with (J-)SOX you must have a support contract - and therefore a responsible party - for ...
4
votes
2answers
2k views

FIPS Compliance for my Android project

I am working on a security-related project and have to make sure it is FIPS 140-2 compliant. According to my understanding, FIPS compliance is compliance at hardware as well as software level. ...
4
votes
6answers
1k views

When storing private identifying information in a web application, what is “industry standard” best practices? [closed]

I am building a hosted (SaaS) web application that stores PII like name, email address, and employer of the user. As of right now, I don't intend to ever store credit card numbers or bank account ...
4
votes
2answers
298 views

Is a “SAS 70 Type II” audited host SEC compliant?

From what I have read and known, SEC compliance is quite vague. It is best to be addressed in a strong manner, but when it comes to hosting in third-parties, the only way for you to prove their ...
4
votes
4answers
2k views

Why do we trust organizations that certificate ISO 27001?

I've been asked why do we trust organizations that certifies ISO 27001? From where did they get the authority and recognition to be able to certify ISO 27001? For example, I can start a certification ...
4
votes
1answer
359 views

Conceptual design of vulnerability scanning program in global retail network (PCI DSS)

I am trying to design yearly program to scan for vulnerabilities on a very large network of payment terminals. The company has thousands of retail points all around the world which need to be ...
4
votes
2answers
263 views

Issues with the use of network surveillance tool in your company?

What issues will we face with the use of network surveillance tool in the company network with respect to the Telecommunication Interception Act and Privacy Act ? And what policies could be ...
4
votes
1answer
605 views

Nessus HTML5 version 5.0.3 - PCI Scan

I've been searching for a couple days, even contacting support, to find out if Nessus has a bundle that scans for PCI compliance. It selects all 44 categories and regardless of what kind of scan I ...
4
votes
1answer
1k views

How to backup database to comply with UK data protection act?

Charity has a server in their office onto which they backup a database with sensitive information. They want to get rid of this server. Is there a cost effective solution that would allow them to ...
4
votes
2answers
390 views

Is PCI DSS applicable to other solutions than those dealing with payment cards?

According to this quote from "applicability" section of PCI DSS it's not: The primary account number is the defining factor in the applicability of PCI DSS requirements. PCI DSS requirements ...
4
votes
2answers
1k views

Is storing CVV compliant with PCI standards?

From personal, job-related experience I know that many "Booking Engines" store the CVV info for customers' credit cards from the time a reservation is made until the time the guest leaves the hotel. ...
4
votes
2answers
977 views

What cryptographic module does Sql Server 2008 use to run in Fips 140-2 compliant mode by default?

One can configure Sql Server 2008 to run in FIPS 140-2 compliant mode, in the same manner as running Bitlocker in FIPS 140-2 compliant mode. Which is to activate FIPS 140-2 compliant mode in the ...
4
votes
3answers
448 views

HIPAA compliance in web forums?

If a website has a private forum (membership is not free) where people may ask health questions and paid Doctors are around to answer them, do normal HIPAA compliance rules apply? In any forum, ...
4
votes
1answer
962 views

HIPAA Compliance or What measures would you recommend to secure PHI for devs?

I work with a company that sells medical supplies and equipment. As part of this, we retain patient information or Protected Health Information (PHI). What measures have you taken when providing ...
4
votes
1answer
691 views

HIPAA: How am I required to secure PHI database access creds on my web server?

Assuming I have a database of PHI that my web application needs to access, how am I required to secure the credentials on the webserver that the web application uses to access this database? Is ...
4
votes
3answers
1k views

MS-SQL Monitoring/Auditing of PHI for HIPAA

We're currently looking for a solution (hardware or software-based) that can monitor and audit all PHI viewing activity per new HIPAA rules. We use MS-SQL for our production database. We have the ...
4
votes
2answers
196 views

How can IA-5(1)(b) be enforced on non-Windows systems?

I have a question posted already for this issue in Windows systems, and thought that non-Windows systems should perhaps be covered separately. In NIST SP 800-53 Rev. 3, IA-5 is the control addressing ...
4
votes
1answer
235 views

Store To Store communication through MPLS VPN

In a PCI environment with an MPLS VPN network setup should you allow store to store communication? Do you think that an MPLS network would be consider secure enough for this? why or why not?
4
votes
2answers
132 views

Evaluating hosting providers for CC development environment

An organization that develops software that may be subject to security evaluations such as Common Criteria is looking to externalize part of its IT infrastructure, including critical components such ...
3
votes
4answers
266 views

What actions should be taken by site according to Data Protection legislations?

Many countries have data protection legislation: Data Protection Directive in EU Data Protection Act 1998 in UK privacy laws in USA Web application may have registration form where fields for ...
3
votes
3answers
190 views

Does requiring users to fill out a PDF w/ CC information and mail it back violate PCI compliance?

I'm attempting to place an order with an American company and I reside outside of America. Upon placing the order (and already submitting payment) I received an email asking me to fill out a PDF ...
3
votes
3answers
431 views

Web application security standards/certificates

I'm currently working on Web application/service that (hopefully) will be used in a wide variety of ways. Of course I'm looking to attracting some commercial users as well, and as we all know, they ...
3
votes
2answers
468 views

A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant?

We have to design and construct a system that signs files with sensible data, like evidences/proofs. The sign process is simple, basically calculate MD5 of the file content and encrypt the MD5 result ...
3
votes
1answer
919 views

How to apply FIPS to Microsoft Access database with custom VBA

As the software engineer on a project, I have been asked to make a Microsoft Access application, with custom interfaces running custom VBA. That part is going just fine. Recently though I was asked to ...
3
votes
2answers
577 views

How can I assess the strength of user passwords in my office environment?

I want to assure the compliance of password policy in my office. Environment Intro My environment is all windows based (server 2003/2008) user base is not more than 400 employees. Nearly 90% of all ...
3
votes
1answer
119 views

What security features and qualifications should we look for in an online backup provider?

What security features and qualifications should we look for in an online backup provider for an Internet-exposed web server storing sensitive data? In the backups themselves - encryption type, ...
3
votes
1answer
120 views

Level 4 merchants becoming PCI Compliant

I was prompted recently to take a deeper look into some of the PCI requirement information, and I have found some pretty serious discrepancies with regard to the reporting obligations of Level 4 ...
3
votes
3answers
147 views

If I host a web form which submits CC details to a provider, are there PCI implications form host?

I'm wondering if anyone has any thoughts on a specific question I have. I read a lot about systems that 'store, process, submit' CC data requiring compliance. If I host a form on my website which ...
3
votes
3answers
2k views

Any place where I can find some template or base documents for IT/Infosec Compliance?

We're facing an audit and we are sorely lacking in documentation regarding information security policies. I've done some Googling and have been surprised by the difficulty of finding a good "template" ...
3
votes
1answer
131 views

Data Protection in EU for usage of personal documents

I don't know if this question fits into this forum or not. Is there some template documents that comply with the EU regulations for Data Protection and Privacy that I can reuse / (get them signed by ...
3
votes
3answers
214 views

What is the job of an IT auditor?

I am going through training in information security, as a part of the course they included compliance standards like: PCI DSS ISO 27001-2005 Cobit framework So after searching over Google, I came ...
3
votes
1answer
91 views

Server Certification Processes

We are considering a certification process for new internal server builds before they are allowed to be placed into production. That is, the system administration team will send the server up to the ...
3
votes
2answers
987 views

The point of PCI 1.3.1 through 1.3.3

In expansion to my previous question what qualifies as public access? I'm trying to wrap my head around the intent of the points 1.3.1 and 1.3.2 and 1.3.3 of the PCI standard. I have four DMZs at my ...
3
votes
2answers
322 views

Which PCI SAQ would you say to use if you are neither a merchant nor service provider?

Low down: This client does zero with credit card data (no processing, no passing of it, nothing), but they do have a device often placed on the same network segment of a POS (Point of sale) system. ...
3
votes
1answer
118 views

What documentation can I ask a vendor for to show HIPAA compliance

Over the past year, several vendors I've contracted with have claimed hipaa compliance. I have asked them for documentation of their compliance and I've never seen any. I would expect an audit ...
3
votes
1answer
102 views

Must the distinguished subject name of an issued SSL Certificate match that of the generated Certificate Signing Request?

For example: from Issued SSL Certificate: CN = abc.com.my, OU = Room, O = House, C = MY from generated CSR: CN = abc.com.my, OU = Room , O = House, L = KL, ST = KL , C = MY Is it legal for a ...
3
votes
3answers
177 views

In what situations are web services required to protect confidentiality of user information?

I know that if a web application needs to be PCI-DSS or HIPAA compliant the user personal identifiable information (e.g. user password, etc) needs to be kept confidential. Under what other situations ...
3
votes
1answer
172 views

Facebook changed the default email address for every contact. How do I mitigate the impact and risk?

Facebook created a problem for regulated industries and Registered Investment Advisers (RIAs) by changing the default outgoing SMTP address for every contact to a @Facebook.com address. This is an ...
3
votes
2answers
132 views

What drives FIPS140-2 compliance?

I guess this questions is directed at Product Managers, but I would be very interested to learn what people in the know think. What are the most common factors that drives FIPS140-2 compliance for ...
3
votes
1answer
585 views

Strange packets coming over wireless, looking for clues

While running airodump-ng in town, I have noticed an unusual type of AP or pseudo-AP. There is a steady stream of wireless beacon frames coming in on channel 6. The frames are valid, but have several ...
3
votes
0answers
41 views

Open source tools to run generic audit of user entitlements? [closed]

Over the past years, my team has been asked to conduct audits/reviews for other teams. Most of these audits have been compliance-driven and almost all of them have followed the same format: some group ...
3
votes
2answers
93 views

Determining PCI DSS SAQ level

I have a b2b SaaS that my clients then use with their own customers to gather data in a face to face scenario with iPads, I would like to expand it to take credit card details. The credit card details ...
2
votes
3answers
1k views

Vulnerability scanning applicability for PCI DSS

I'm fully up to speed on PCI DSS requirements and have attend the ISA course recently. The course was helpful and I was able to bounce ideas off of the trainer. However I keep coming back to one ...
2
votes
4answers
444 views

unix config scanner / compliance checks

I'm looking for a tool, that scans unix operating systems for configuration issues. E.g. a script that finds PermitRootLogin yes in the ssh config file or with other words: a script that automates ...