Aspects of compliance with regulations, standards, laws, and policies.
4
votes
3answers
150 views
Does GOOD Dynamics Proxy comply with EU data legislation?
My client is excited about GOOD technology; it allows them to have controlled access to business applications & email from BYOD (bring your own devices) and will enable a more mobile workforce. ...
4
votes
2answers
309 views
How can I assess the strength of user passwords in my office environment?
I want to assure the compliance of password policy in my office.
Environment Intro
My environment is all windows based (server 2003/2008) user base is not more than 400 employees. Nearly 90% of all ...
4
votes
2answers
498 views
What cryptographic module does Sql Server 2008 use to run in Fips 140-2 compliant mode by default?
One can configure Sql Server 2008 to run in FIPS 140-2 compliant mode, in the same manner as running Bitlocker in FIPS 140-2 compliant mode. Which is to activate FIPS 140-2 compliant mode in the ...
4
votes
1answer
544 views
HIPAA Compliance or What measures would you recommend to secure PHI for devs?
I work with a company that sells medical supplies and equipment. As part of this, we retain patient information or Protected Health Information (PHI). What measures have you taken when providing ...
4
votes
1answer
154 views
Store To Store communication through MPLS VPN
In a PCI environment with an MPLS VPN network setup should you allow store to store communication?
Do you think that an MPLS network would be consider secure enough for this? why or why not?
3
votes
1answer
192 views
Conceptual design of vulnerability scanning program in global retail network (PCI DSS)
I am trying to design yearly program to scan for vulnerabilities on a very large network of payment terminals.
The company has thousands of retail points all around the world which need to be ...
3
votes
6answers
307 views
When storing private identifying information in a web application, what is “industry standard” best practices?
I am building a hosted (SaaS) web application that stores PII like name, email address, and employer of the user. As of right now, I don't intend to ever store credit card numbers or bank account ...
3
votes
1answer
511 views
How to backup database to comply with UK data protection act?
Charity has a server in their office onto which they backup a database with sensitive information. They want to get rid of this server.
Is there a cost effective solution that would allow them to ...
3
votes
1answer
579 views
How to apply FIPS to Microsoft Access database with custom VBA
As the software engineer on a project, I have been asked to make a Microsoft Access application, with custom interfaces running custom VBA. That part is going just fine. Recently though I was asked to ...
3
votes
1answer
75 views
Nessus HTML5 version 5.0.3 - PCI Scan
I've been searching for a couple days, even contacting support, to find out if Nessus has a bundle that scans for PCI compliance. It selects all 44 categories and regardless of what kind of scan I ...
3
votes
1answer
82 views
What security features and qualifications should we look for in an online backup provider?
What security features and qualifications should we look for in an online backup provider for an Internet-exposed web server storing sensitive data?
In the backups themselves - encryption type, ...
3
votes
2answers
180 views
A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant?
We have to design and construct a system that signs files with sensible data, like evidences/proofs. The sign process is simple, basically calculate MD5 of the file content and encrypt the MD5 result ...
3
votes
1answer
89 views
Data Protection in EU for usage of personal documents
I don't know if this question fits into this forum or not.
Is there some template documents that comply with the EU regulations for Data Protection and Privacy that I can reuse / (get them signed by ...
3
votes
1answer
80 views
Server Certification Processes
We are considering a certification process for new internal server builds before they are allowed to be placed into production. That is, the system administration team will send the server up to the ...
3
votes
2answers
408 views
The point of PCI 1.3.1 through 1.3.3
In expansion to my previous question what qualifies as public access? I'm trying to wrap my head around the intent of the points 1.3.1 and 1.3.2 and 1.3.3 of the PCI standard.
I have four DMZs at my ...
3
votes
3answers
211 views
HIPAA compliance in web forums?
If a website has a private forum (membership is not free) where people may ask health questions and paid Doctors are around to answer them, do normal HIPAA compliance rules apply?
In any forum, ...
3
votes
2answers
291 views
Which PCI SAQ would you say to use if you are neither a merchant nor service provider?
Low down: This client does zero with credit card data (no processing, no passing of it, nothing), but they do have a device often placed on the same network segment of a POS (Point of sale) system.
...
3
votes
3answers
112 views
In what situations are web services required to protect confidentiality of user information?
I know that if a web application needs to be PCI-DSS or HIPAA compliant the user personal identifiable information (e.g. user password, etc) needs to be kept confidential.
Under what other situations ...
3
votes
1answer
145 views
Facebook changed the default email address for every contact. How do I mitigate the impact and risk?
Facebook created a problem for regulated industries and Registered Investment Advisers (RIAs) by changing the default outgoing SMTP address for every contact to a @Facebook.com address.
This is an ...
3
votes
2answers
101 views
What drives FIPS140-2 compliance?
I guess this questions is directed at Product Managers, but I would be very interested to learn what people in the know think.
What are the most common factors that drives FIPS140-2 compliance for ...
3
votes
2answers
83 views
Evaluating hosting providers for CC development environment
An organization that develops software that may be subject to security evaluations such as Common Criteria is looking to externalize part of its IT infrastructure, including critical components such ...
2
votes
4answers
234 views
What actions should be taken by site according to Data Protection legislations?
Many countries have data protection legislation:
Data Protection Directive in EU
Data Protection Act 1998 in UK
privacy laws in USA
Web application may have registration form where fields for ...
2
votes
3answers
246 views
Vulnerability scanning applicability for PCI DSS
I'm fully up to speed on PCI DSS requirements and have attend the ISA course recently. The course was helpful and I was able to bounce ideas off of the trainer. However I keep coming back to one ...
2
votes
2answers
176 views
unix config scanner / compliance checks
I'm looking for a tool, that scans unix operating systems for configuration issues. E.g. a script that finds
PermitRootLogin yes
in the ssh config file or with other words: a script that automates ...
2
votes
2answers
388 views
PCI Compliance network scope
I was wondering if anyone could clarify the scope of PCI compliance with regard to multiple networks.
At present, there's one PCI compliant network to which another network connects via VPN. The PCI ...
2
votes
2answers
138 views
Does requiring users to fill out a PDF w/ CC information and mail it back violate PCI compliance?
I'm attempting to place an order with an American company and I reside outside of America. Upon placing the order (and already submitting payment) I received an email asking me to fill out a PDF ...
2
votes
2answers
776 views
Credit card storage, hashes, truncation, encrypted data
I'm trying to figure out a way to meet multiple business requirements that don't seem to go well in hand in terms of security:
store encrypted card data associated with customer accounts for ...
2
votes
3answers
132 views
Web application security standards/certificates
I'm currently working on Web application/service that (hopefully) will be used in a wide variety of ways. Of course I'm looking to attracting some commercial users as well, and as we all know, they ...
2
votes
3answers
84 views
If I host a web form which submits CC details to a provider, are there PCI implications form host?
I'm wondering if anyone has any thoughts on a specific question I have. I read a lot about systems that 'store, process, submit' CC data requiring compliance.
If I host a form on my website which ...
2
votes
2answers
167 views
What does “if the Crypto Officer performs this operation” mean in this BitLocker security policy?
In the document Windows Server 2008 R2 BitLocker™ Drive Encryption Security Policy For FIPS 140-2 Validation, in the section 6.1.2 FIPS 140-2 Security Rules bullet point 2 it says:
BitLocker™ will ...
2
votes
1answer
422 views
PCI Compliance - If am eligible to self certify - do I need to use a QSA company in this context?
Setting up a new company with ecommerce app, and looking at PCI compliance.
What I need to know is if I need to use a pci security assessor to verify the answers to the self assessment questionnaire?
...
2
votes
1answer
74 views
Backup media storage strategy
As a company we are performing daily backups onto RDX removable media which is fully encrypted (shows as unformatted drive) and the backup software also encrypts the files during the backup process, ...
2
votes
3answers
288 views
Any place where I can find some template or base documents for IT/Infosec Compliance?
We're facing an audit and we are sorely lacking in documentation regarding information security policies. I've done some Googling and have been surprised by the difficulty of finding a good "template" ...
2
votes
1answer
124 views
Industrial security — resources for ISO27k compliance, social-engineering trend reports
I'm attempting to compile resources on industrial IT security from a non-technical standpoint as it pertains to the U.S petrochemical industry. This is for my final research paper as an undergraduate ...
2
votes
2answers
179 views
What certification would be considered equivalent to the U.S.-EU Safe Harbor Framework?
The Safe Harbor website says the following:
The European Commission’s Directive on Data Protection went into effect in October of 1998, and would prohibit the transfer of personal data to ...
2
votes
2answers
243 views
What compliance framework is appropriate for firewalls
As a more corpose vulnerability assessment and penetration test, one step of our activity is to review from a security perspective the policy of some firewall.
In our society we have a deep ...
1
vote
3answers
238 views
What is the best way to get a third party audit done of website security?
I have a website that needs to be PCI compliant. I have coded it using the guidelines but to be safe i wanted to get a third party audit done where this individual who runs a IT security firm and ...
1
vote
3answers
172 views
Information Security standards in corporations
I'm developing a web based application. I want to create it so that it could be adopted by teams within corporations and large organisations that have tight IS standards.
The initial organisations ...
1
vote
1answer
153 views
How to define audit controls responsibility? @ SIEM
I'm assigned to write procedural documentation for the SIEM use cases for the IT asset owners. For example, the procedures for selecting events indicating unauthorized access to user-mail box. I have ...
1
vote
2answers
90 views
Can I instruct a Telco to prevent 2G connections from our phones?
Given that 2G is proven to be insecure (broken) at DefCon, is it possible for a Corporate IT department to work with the Telco and ban 2G connections for their devices?
Some cell phones are unable to ...
1
vote
1answer
323 views
Help with scope clarification of PCI requirement 8.5.15
Section 8.5.15 reads:
If a session has been idle for more than 15 minutes, require the user
to re-enter the password to re-activate the terminal.
Section 8 Accompanying note reads:
These ...
1
vote
1answer
136 views
Which PCI DSS SAQ applies when you don't store store but transmit CHD?
We have a merchant website that uses Authorize.net's AIM. Cardholder data (credit card number, expiration date, etc.) is entered at our website. Then it's transmitted to payment gateway and isn't ...
1
vote
1answer
59 views
Are there any FIPS140-2 requirements that apply when boot code is updated in the field?
FIPS140-2 standard specifies the following conditional test to be performed by the cryptographic module if software or firmware components can be externally loaded into a cryptographic module:
...
1
vote
0answers
85 views
What category of security measures are required by popular regulations? [closed]
There's a few very popular regulations, HIPAA, SOX, PCI-DSS, PII, ITAR, GLBA.
Can anyone explain what are their exact security implications? Exactly what type of implementations would my organization ...
0
votes
2answers
235 views
Is this way of using Authorize.net's CIM PCI compliant?
We have a webapp where Authorize.NET's CIM and AIM are used for payment operations. When user buys something at first time he enters his CC number and other billing information at our site. This ...
0
votes
1answer
99 views
How to enforce NTFS permission compliance?
I have to enforce NTFS permissions based on business roles. Each role (group in ADS) can be granted the permission to read or write a file server directory. I do not care about share permissions. I ...
0
votes
1answer
250 views
Enterprise Encryption Considerations
What are the different aspects to consider for Enterprise Encryption policy?
So far the resources I have are:
https://www.owasp.org/index.php/Cryptographic_Storage_Cheat_Sheet
...
-1
votes
0answers
31 views
SYS access to the ORACLE database. Table with Sensitive/Production data
Having SYS access to the back end Oracle database in SAP can be deemed critical. However, due to the vast number of 25000+ tables
in the database it might be impossible to find exactly where the ...
