Aspects of compliance with regulations, standards, laws, and policies.

learn more… | top users | synonyms

3
votes
0answers
12 views

Open source tools to run generic audit of user entitlements? [on hold]

Over the past years, my team has been asked to conduct audits/reviews for other teams. Most of these audits have been compliance-driven and almost all of them have followed the same format: some group ...
0
votes
1answer
19 views

Would an IM app server holding user's messages long after the content was delivered be an issue of personal data protection? [closed]

Take a IM app like WhatsApp. If I send a message to another user while their client is offline, the server holds the message and then delivers it when the receiver's client goes online. It even has ...
2
votes
2answers
138 views

security reviews of third party code

I am not familiar with all the steps involved in a full-fledged information security review of an in-house developed application, so I am wondering whether or not the following scenario is ...
2
votes
2answers
62 views

Determining PCI DSS SAQ level

I have a b2b SaaS that my clients then use with their own customers to gather data in a face to face scenario with iPads, I would like to expand it to take credit card details. The credit card details ...
0
votes
1answer
23 views

Possible for Lync clients to adopt Activesync-style policies?

My compliance manager recently told me that Lync IMs should be treated as e-mail for compliance purposes. This also made me realize that our other email policies (encrypted device, pin required, ...
8
votes
7answers
1k views

Is this set-up PCI-Compliant?

Question: Is there a way to store credit card information on a shared hosting server AND be PCI compliant? Here is the setup: 1) SSL is being implemented for the whole checkout process and for the ...
4
votes
2answers
437 views

Is storing CVV compliant with PCI standards?

From personal, job-related experience I know that many "Booking Engines" store the CVV info for customers' credit cards from the time a reservation is made until the time the guest leaves the hotel. ...
4
votes
2answers
1k views

FIPS Compliance for my Android project

I am working on a security-related project and have to make sure it is FIPS 140-2 compliant. According to my understanding, FIPS compliance is compliance at hardware as well as software level. ...
2
votes
4answers
393 views

unix config scanner / compliance checks

I'm looking for a tool, that scans unix operating systems for configuration issues. E.g. a script that finds PermitRootLogin yes in the ssh config file or with other words: a script that automates ...
2
votes
2answers
2k views

Credit card storage, hashes, truncation, encrypted data

I'm trying to figure out a way to meet multiple business requirements that don't seem to go well in hand in terms of security: store encrypted card data associated with customer accounts for ...
5
votes
1answer
628 views

How can Stripe be PCI-compliant?

According to the Stripe FAQ, they are PCI-compliant. Also, in their API documentation, one of the parameters to create a new card is the CVC (although, granted, it is optional). So, I assume they ...
0
votes
1answer
33 views

Viewing PCI data via 3rd party sites securely

I'm working on a project that requires PCI protected data (card PIN numbers) to be made visible to customers, via a Third Party (a non PCI compliant) company site. The hierarchy is as follows: Us ...
0
votes
1answer
37 views

For FDA certification hipaa is mandatory?

I am working on a medical device. I want to FDA certification for it. The device is having ePHI (protected health information). So is it mandatory to have HIPAA compliance for FDA approval?
-1
votes
1answer
67 views

iFrame or Tokenization for Credit card transactions [closed]

My company is currently processing less than 4000 Credit Card transactions a year and we are a level 4 organization. I see that we are storing the credit card data in one of our databases but the PAN ...
6
votes
2answers
1k views

Is BitLocker on a virtual machine still FIPS 140-2 compliant?

BitLocker can be used as a cryptographic module to fulfill FIPS 140-2 security level 1 compliance. In a common setup, USB thumb drives can be used to unlock drives encrypted by BitLocker on startup. ...
3
votes
1answer
83 views

What documentation can I ask a vendor for to show HIPAA compliance

Over the past year, several vendors I've contracted with have claimed hipaa compliance. I have asked them for documentation of their compliance and I've never seen any. I would expect an audit ...
3
votes
1answer
93 views

Level 4 merchants becoming PCI Compliant

I was prompted recently to take a deeper look into some of the PCI requirement information, and I have found some pretty serious discrepancies with regard to the reporting obligations of Level 4 ...
2
votes
1answer
83 views

Must the distinguished subject name of an issued SSL Certificate match that of the generated Certificate Signing Request?

For example: from Issued SSL Certificate: CN = abc.com.my, OU = Room, O = House, C = MY from generated CSR: CN = abc.com.my, OU = Room , O = House, L = KL, ST = KL , C = MY Is it legal for a ...
1
vote
3answers
200 views

USGCB on a non-networked computer

We will be getting some data that needs to be kept in accordance with USGCB regulations. Our intent was to keep it secure by storing and using it on a non-networked computer, but the regulations seem ...
2
votes
3answers
495 views

Difference between hardening guides (CIS, NSA, DISA)

I'm researching OS hardening and it seems there are a variety of recommended configuration guides. I realize the different configuration providers supply different offerings per Operating System, but ...
6
votes
3answers
5k views

PCI DSS requirement 6.4.2 separation of duties between development/test environments

6.4.2 Is there separation of duties between personnel assigned to the development/test environments and those assigned to the production environment? What does the separation of duties here mean? ...
2
votes
2answers
52 views

Question regarding browser windows when integrating with 3rd party payment software

I've been told that when integrating with a 3rd party payment gateway, the other website's window should not be opened in an iFrame or a separate window - that the current application window itself ...
8
votes
2answers
562 views

How can Network Disconnect be implemented for RDP on a Windows system (2003/XP or later)?

From NIST SP 800-53, Rev. 3: SC-10 NETWORK DISCONNECT Control: The information system terminates the network connection associated with a communications session at the end of the session or ...
0
votes
1answer
89 views

What is the danger or downside of using online/cloud web app scanner vs on premise ones?

Cloud scanners are becoming more common these days. Pricing is a lot cheaper than on premise scanners. My concern with cloud scanners is that they store sensitive information on 3rd party network. (I ...
9
votes
2answers
2k views
0
votes
0answers
32 views

Compliant login process

Working with a developer to update a login system through a web-UI: Currently, we use: Enter login ID Goes through Challenge/Step-up Based on results: Challenge/Step-up User is presented the ...
1
vote
4answers
2k views

Questions about in-scope information assets for an ISO27001 ISMS

I am in the process of writing a Scope for the information assets - in preparation for writing an ISO27001 compliant ISMS. I am confused as to if a VPN network is considered to be in Scope? as well ...
3
votes
4answers
1k views

Why do we trust organizations that certificate ISO 27001?

I've been asked why do we trust organizations that certifies ISO 27001? From where did they get the authority and recognition to be able to certify ISO 27001? For example, I can start a certification ...
1
vote
2answers
140 views

Compliance with an industry recognized framework - ISO27k

I've been asked to figure out how to get our company to comply with an "Industry Recognized [Security] Framework" where '“Industry Recognized Framework” means a global industry recognized information ...
2
votes
3answers
999 views

Vulnerability scanning applicability for PCI DSS

I'm fully up to speed on PCI DSS requirements and have attend the ISA course recently. The course was helpful and I was able to bounce ideas off of the trainer. However I keep coming back to one ...
2
votes
2answers
269 views

Is PCI Compliance mandatory?

I recently started working on an eCommerce addition to a site I'm working on.In my research looking for a way to do SSL without a certificate/a free certificate I came across PCI Compliance.I have ...
5
votes
2answers
561 views

What SSD maker has implemented Secure Erase to spec?

I have a Kingston hyperx drive circa 2012. I kicked off a secure erase on it. I then remounted the drive and was horrified (well, not really more like bemused) to see my whole parts of my old file ...
1
vote
0answers
24 views

Does HDCP impose HD-playback restrictions for sinks?

In order to be HDCP compliant, a source can only output HDCP-encrypted digital HD content. However, is the opposite true for HDCP sinks? In order to be HDCP compliant, should a sink only accept to ...
22
votes
1answer
2k views

Has anyone achieved PCI compliance on AWS?

All the FAQs, documents and statements published by AWS aside, did any Level 1 merchant or service provider actually achieve PCI compliance on AWS yet? We're evaluating moving some of our services to ...
13
votes
3answers
4k views

Nessus vs third-party scans

As part of our PCI-DSS compliance process we get scans done by a third party. Based on the form and wording of the output, it's pretty clear they're using Nessus for most of their heavy lifting. Same ...
0
votes
1answer
284 views

HIPAA compliant on Azure cloud? [closed]

We are using WebRoles to host our api, Table storage to persist PHI and Blob Storage to persist MRIs and CT images. What is required to become HIPAA Compliant? -- Edit 2014-02-17 -- I just want to ...
32
votes
2answers
2k views

Why does Google cripple the 2FA Google Authenticator PAM module?

If you enable 2FA for Google Apps the shared secret is 160 bits. The google_authenticator PAM module on the other hand seems to use 80 bits for the shared secret. According to RFC 4226: R6 - The ...
0
votes
1answer
280 views

When does a PA-DSS certified application expire?

When you search the PCI website for validated payment applications it shows a re-validation date and an expiry date. There is also two categories of payment applications, "Acceptable for new ...
3
votes
1answer
495 views

Strange packets coming over wireless, looking for clues

While running airodump-ng in town, I have noticed an unusual type of AP or pseudo-AP. There is a steady stream of wireless beacon frames coming in on channel 6. The frames are valid, but have several ...
18
votes
3answers
688 views

Any comments or advice on OWASP-2013 top 10 number A9

In this iteration of the OWASP top 10 application security vulnerabilities list (https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project), a new category 'A9 Using Components with Known ...
1
vote
1answer
490 views

How to define audit controls responsibility? @ SIEM

I'm assigned to write procedural documentation for the SIEM use cases for the IT asset owners. For example, the procedures for selecting events indicating unauthorized access to user-mail box. I have ...
2
votes
2answers
79 views

ICO compliance and Google Cloud SQL

I have a basic simple question for which I couldn't find anywhere. Is is possible to use Google Cloud SQL services and still retain the regulations from ICO and other similar requirements? I ...
1
vote
3answers
130 views

Are there any security related rules in PCI-DSS that govern when I can capture a payment?

Is there a PCI-DSS rule that a merchant cannot capture the funds for an order until we have actually shipped it? I can't seem to find an official reference that describes this as a PCI DSS ...
1
vote
2answers
252 views

How should I store and maintain secure configuration documents?

We have many scripts that we call "secure baselines" that allow our server/desktop installation people to install operating systems using best security practice. We test that the baselines have been ...
6
votes
2answers
2k views

Is SSL terminated at a load balancer PCI compliant?

I've read this nice question: Should SSL be terminated at a load balancer? And I have the same question, but with PCI-DSS compliance in mind. Is SSL terminated at the load balancer, with clear ...
3
votes
3answers
205 views

What is the job of an IT auditor?

I am going through training in information security, as a part of the course they included compliance standards like: PCI DSS ISO 27001-2005 Cobit framework So after searching over Google, I came ...
4
votes
2answers
131 views

Evaluating hosting providers for CC development environment

An organization that develops software that may be subject to security evaluations such as Common Criteria is looking to externalize part of its IT infrastructure, including critical components such ...
4
votes
2answers
414 views

Is Common Criteria (CC) a suitable standard to certify web applications

I never came across a web application that has been certified according to Common Critera. As far as I know there isn't even a protection profile available for web applications. What is the reason ...
5
votes
1answer
253 views

What compliance problem does “Common Criteria Certification” solve?

It has been said Common Criteria solves a "Compliance problem, and not a security problem". Can someone explain where CC certification is required or benefits an industry? Is it simply a marketing ...
10
votes
5answers
894 views

Data needed for why not to load third party JavaScript on web page with credit card form

My company makes a JavaScript widget that e-commerce sites can embed on their pages. Our current instructions to our customers tell them to load our JS on every page of their site and most follow this ...