Aspects of compliance with regulations, standards, laws, and policies.

learn more… | top users | synonyms

1
vote
1answer
74 views

Are there any FIPS140-2 requirements that apply when boot code is updated in the field?

FIPS140-2 standard specifies the following conditional test to be performed by the cryptographic module if software or firmware components can be externally loaded into a cryptographic module: ...
1
vote
0answers
55 views

Does our support chat need to be HIPAA compliant? [closed]

We are currently using olark to provide an instant chat support feature to our customers. Customer typically ask about outages, setup issues, etc. We are in the process of trying to become HIPAA ...
1
vote
0answers
48 views

Does HDCP impose HD-playback restrictions for sinks?

In order to be HDCP compliant, a source can only output HDCP-encrypted digital HD content. However, is the opposite true for HDCP sinks? In order to be HDCP compliant, should a sink only accept to ...
0
votes
3answers
116 views

Is there a fine for not doing penetration / vulnerability test [closed]

If a company needs to be PCI compliant are there any fines levied on them if they don't do pen/vulnerability testing, if yes, is it an automatic fine, or is it only if they are caught. Understanding ...
0
votes
2answers
933 views

Is this way of using Authorize.net's CIM PCI compliant?

We have a webapp where Authorize.NET's CIM and AIM are used for payment operations. When user buys something at first time he enters his CC number and other billing information at our site. This ...
0
votes
1answer
119 views

What is the danger or downside of using online/cloud web app scanner vs on premise ones?

Cloud scanners are becoming more common these days. Pricing is a lot cheaper than on premise scanners. My concern with cloud scanners is that they store sensitive information on 3rd party network. (I ...
0
votes
1answer
275 views

Is PCI SAQ A or A-EP applicable for my use case?

I read the FAQ over here andI feel that we do not need to be PCI Compliance but I have read many other posts, articles etc which seem to contradict my assumption. So I was wondering if any of you guys ...
0
votes
1answer
530 views

HIPAA compliant on Azure cloud? [closed]

We are using WebRoles to host our api, Table storage to persist PHI and Blob Storage to persist MRIs and CT images. What is required to become HIPAA Compliant? -- Edit 2014-02-17 -- I just want to ...
0
votes
1answer
683 views

When does a PA-DSS certified application expire?

When you search the PCI website for validated payment applications it shows a re-validation date and an expiry date. There is also two categories of payment applications, "Acceptable for new ...
0
votes
1answer
56 views

PCI SAQ C 1.2.1, 1.3.5 and remote server/software

I'm hoping someone here can help me. I'm attempting to get the small nonprofit I work at PCI compliant, as we have been paying an additional $20/month in noncompliance fees to our processor since we ...
0
votes
1answer
49 views

Viewing PCI data via 3rd party sites securely

I'm working on a project that requires PCI protected data (card PIN numbers) to be made visible to customers, via a Third Party (a non PCI compliant) company site. The hierarchy is as follows: Us >...
0
votes
1answer
509 views

How to enforce NTFS permission compliance?

I have to enforce NTFS permissions based on business roles. Each role (group in ADS) can be granted the permission to read or write a file server directory. I do not care about share permissions. I ...
0
votes
1answer
420 views

Enterprise Encryption Considerations

What are the different aspects to consider for Enterprise Encryption policy? So far the resources I have are: https://www.owasp.org/index.php/Cryptographic_Storage_Cheat_Sheet http://esj.com/...
0
votes
0answers
11 views

PCI - PA DSS - QIR

I have a PA-DSS Certified program. Do I need to be QIR Certified to remain PA-DSS Compliant? https://www.pcisecuritystandards.org/program_training_and_qualification/...
0
votes
0answers
30 views

Proper way to document and log brute force attacks when creating a user account

We have the following use case: Users can self register for a business account by filling a validation form with their ID, first name, last name, and DOB. ID is something that only the user knows ...
0
votes
0answers
19 views

Signature algorithm with ECDH ? can we use RSA or ECDSA ? or ECDSA is compulsory?

I am going through RFC 5656. I want to know if ECDH with RSA is allowed? (I am not SSH ECC compliant).
0
votes
0answers
75 views

XCCDF check with SCE - Suse Linux Enterprise Server 11

I have written some compliance checks for Red Hat based systems with XCCDF. Some of my checks are OVAL definitions others are shell-scripts. It works great. The same checks don't work on an SLES 11 ...
0
votes
0answers
47 views

Compliant login process

Working with a developer to update a login system through a web-UI: Currently, we use: Enter login ID Goes through Challenge/Step-up Based on results: Challenge/Step-up User is presented the ...
-1
votes
1answer
392 views

iFrame or Tokenization for Credit card transactions [closed]

My company is currently processing less than 4000 Credit Card transactions a year and we are a level 4 organization. I see that we are storing the credit card data in one of our databases but the PAN ...
-1
votes
1answer
40 views

Would an IM app server holding user's messages long after the content was delivered be an issue of personal data protection? [closed]

Take a IM app like WhatsApp. If I send a message to another user while their client is offline, the server holds the message and then delivers it when the receiver's client goes online. It even has ...