Aspects of compliance with regulations, standards, laws, and policies.

learn more… | top users | synonyms

10
votes
4answers
2k views

Question of importance of FIPS in security implementations

I am by far, no security expert but I experience on the subject working in Java (JCA,JCE and JSSE). Anyway, recently there was a discussion about FIPS compliance. I looked into this and SUN's ...
9
votes
4answers
909 views

New credit card security standards regarding PA-DSS Compliance

The new credit card standards including PA-DSS can be quite confusing for software companies. My question is this: If your software company designs a POS software system (like we do) which utilizes ...
8
votes
2answers
193 views

How can one easily determine which IT Security related regulations apply?

Joe Tech gets a job managing Acme Startup's IT services. Acme Startup handles information of X, Y, and Z data types, and offers services A, B, and C. Joe Tech is aware that some of these data types ...
2
votes
1answer
578 views

PCI Compliance - If am eligible to self certify - do I need to use a QSA company in this context?

Setting up a new company with ecommerce app, and looking at PCI compliance. What I need to know is if I need to use a pci security assessor to verify the answers to the self assessment questionnaire? ...
8
votes
2answers
1k views

Is there a way for a consumer to report PCI non compliance?

Is there a way for a consumer to report PCI non compliance?
4
votes
2answers
188 views

How can IA-5(1)(b) be enforced on non-Windows systems?

I have a question posted already for this issue in Windows systems, and thought that non-Windows systems should perhaps be covered separately. In NIST SP 800-53 Rev. 3, IA-5 is the control addressing ...
7
votes
2answers
619 views

How can IA-5(1)(b) be enforced on Windows systems?

Note: I've also posted a question for this issue on non-Windows systems. In NIST SP 800-53 Rev. 3, IA-5 is the control addressing "Authenticator Management". The requirements in this control include ...
17
votes
4answers
2k views

Why doesn't the client's web browser need to be PCI compliant?

A hypothetical online store that accepts credit card payment will have to be PCI compliant because it receives (transmit), process and possibly store credit card numbers. But the client's web browser ...
4
votes
3answers
501 views

Does (J-)SOX Forbid the Use of Open Source Software?

With Regard to Sarbanes Oxley and particularly The Japanese version thereof: Is it true that in order to comply with (J-)SOX you must have a support contract - and therefore a responsible party - for ...
3
votes
1answer
803 views

How to apply FIPS to Microsoft Access database with custom VBA

As the software engineer on a project, I have been asked to make a Microsoft Access application, with custom interfaces running custom VBA. That part is going just fine. Recently though I was asked to ...
8
votes
2answers
517 views

How can Network Disconnect be implemented for RDP on a Windows system (2003/XP or later)?

From NIST SP 800-53, Rev. 3: SC-10 NETWORK DISCONNECT Control: The information system terminates the network connection associated with a communications session at the end of the session or ...
5
votes
2answers
994 views

What is the equivalent European organization of NIST, especially in the Security Computer Division?

What is the European counterpart organization to USA's NIST? I want to check the European best practices and guidelines on computer security. Does anyone know if this organization exists, and if ...
2
votes
2answers
312 views

What compliance framework is appropriate for firewalls

As a more corpose vulnerability assessment and penetration test, one step of our activity is to review from a security perspective the policy of some firewall. In our society we have a deep ...
9
votes
4answers
863 views

What is an appropriate auditing standard for a law firm?

I'm an IT Admin at a law firm. We handle sensitive customer data and some health records. I'd really like to have an outside consultant assess our data security practices, but I'm not sure what to ask ...
5
votes
1answer
559 views

Does PA-DSS apply to a SaaS eCommerce system?

My company develops and hosts a custom eCommerce and CMS system. We provide this only under a hosted, software-as-a-service model. We are in full control of the hosting environment, and our customers ...
9
votes
4answers
2k views

Is Facebook Connect or Twitter OAuth PCI Compliant?

We have a system that stores credit cards securely on file. We'd love to allow users to sign up using Facebook Connect or Twitter. Obviously this wouldn't be secure if we were trusting just any old ...
3
votes
2answers
315 views

Which PCI SAQ would you say to use if you are neither a merchant nor service provider?

Low down: This client does zero with credit card data (no processing, no passing of it, nothing), but they do have a device often placed on the same network segment of a POS (Point of sale) system. ...
13
votes
3answers
3k views

Nessus vs third-party scans

As part of our PCI-DSS compliance process we get scans done by a third party. Based on the form and wording of the output, it's pretty clear they're using Nessus for most of their heavy lifting. Same ...
4
votes
2answers
256 views

Issues with the use of network surveillance tool in your company?

What issues will we face with the use of network surveillance tool in the company network with respect to the Telecommunication Interception Act and Privacy Act ? And what policies could be ...
4
votes
1answer
857 views

HIPAA Compliance or What measures would you recommend to secure PHI for devs?

I work with a company that sells medical supplies and equipment. As part of this, we retain patient information or Protected Health Information (PHI). What measures have you taken when providing ...
21
votes
5answers
3k views

PCI Encryption Key Management

(Full disclosure: I'm already an active participant here and at StackOverflow, but for reasons that should hopefully be obvious, I'm choosing to ask this particular question anonymously). I currently ...
11
votes
2answers
666 views

logging requirements for PCI for web applications

Does PCI dictate how much should be logged at an application level or simply what shouldn't be logged? I'm struggling with too much logging right now and some people who think we should have it. From ...
5
votes
3answers
378 views

Are Windows security updates audited?

An IT guy said that in his company, the Windows updates (small security updates that are downloaded automatically by the Windows autoupdate) are checked by the auditor. ie: the auditor checks if every ...
7
votes
5answers
1k views

What security requirements are a defacto standard in the Financial Industry?

What technologies, processes, or laws that relate to InfoSec apply specifically to the Financial industry? If you're familliar with the Financial Industry, can you share details? For example: What ...
18
votes
5answers
1k views

Does PCI compliance really reduce risk and improve security?

Might as well bring this hot topic to here! For those not in the know: https://www.pcisecuritystandards.org/
12
votes
4answers
617 views

Wireless Activity Monitoring for PCI DSS Compliance

In an effort to be PCI DSS compliant, I took a trustkeeper.net questionnaire. I failed the question that asks Is the presence of wireless access points tested for by using a wireless analyzer at ...