Aspects of compliance with regulations, standards, laws, and policies.
8
votes
4answers
131 views
Data needed for why not to load third party JavaScript on web page with credit card form
My company makes a JavaScript widget that e-commerce sites can embed on their pages. Our current instructions to our customers tell them to load our JS on every page of their site and most follow this ...
3
votes
1answer
76 views
Nessus HTML5 version 5.0.3 - PCI Scan
I've been searching for a couple days, even contacting support, to find out if Nessus has a bundle that scans for PCI compliance. It selects all 44 categories and regardless of what kind of scan I ...
6
votes
3answers
501 views
Is storing card details without the permission of the card holder against PCI DSS?
I've bought something from an online store, and when entering the card details, it sent the details to their server through a HTTPS connection, which I then assume they forwarded to their provider - ...
9
votes
4answers
589 views
New credit card security standards regarding PA-DSS Compliance
The new credit card standards including PA-DSS can be quite confusing for software companies.
My question is this: If your software company designs a POS software system (like we do) which utilizes ...
7
votes
7answers
2k views
Storing credit cards for automatic payments?
I have no experience with storing credit cards and I do not know anything about the legal end of this.
The company I work for / develop for wants to store credit cards to process auto payments for ...
2
votes
1answer
74 views
Backup media storage strategy
As a company we are performing daily backups onto RDX removable media which is fully encrypted (shows as unformatted drive) and the backup software also encrypts the files during the backup process, ...
2
votes
3answers
136 views
Web application security standards/certificates
I'm currently working on Web application/service that (hopefully) will be used in a wide variety of ways. Of course I'm looking to attracting some commercial users as well, and as we all know, they ...
2
votes
3answers
288 views
Any place where I can find some template or base documents for IT/Infosec Compliance?
We're facing an audit and we are sorely lacking in documentation regarding information security policies. I've done some Googling and have been surprised by the difficulty of finding a good "template" ...
2
votes
2answers
180 views
What certification would be considered equivalent to the U.S.-EU Safe Harbor Framework?
The Safe Harbor website says the following:
The European Commission’s Directive on Data Protection went into effect in October of 1998, and would prohibit the transfer of personal data to ...
2
votes
2answers
243 views
What compliance framework is appropriate for firewalls
As a more corpose vulnerability assessment and penetration test, one step of our activity is to review from a security perspective the policy of some firewall.
In our society we have a deep ...
7
votes
5answers
491 views
What security requirements are a defacto standard in the Financial Industry?
What technologies, processes, or laws that relate to InfoSec apply specifically to the Financial industry?
If you're familliar with the Financial Industry, can you share details? For example:
What ...
0
votes
1answer
99 views
How to enforce NTFS permission compliance?
I have to enforce NTFS permissions based on business roles. Each role (group in ADS) can be granted the permission to read or write a file server directory. I do not care about share permissions. I ...
3
votes
1answer
80 views
Server Certification Processes
We are considering a certification process for new internal server builds before they are allowed to be placed into production. That is, the system administration team will send the server up to the ...
3
votes
2answers
181 views
A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant?
We have to design and construct a system that signs files with sensible data, like evidences/proofs. The sign process is simple, basically calculate MD5 of the file content and encrypt the MD5 result ...
7
votes
1answer
256 views
Enterprise standard for securing servers.
This must be the most broad question to ask, but through the years, i've come up with my own list of things I so to secure my servers, I follow the obvious steps I could gather online such as, ...
1
vote
1answer
154 views
How to define audit controls responsibility? @ SIEM
I'm assigned to write procedural documentation for the SIEM use cases for the IT asset owners. For example, the procedures for selecting events indicating unauthorized access to user-mail box. I have ...
20
votes
5answers
1k views
Is it common practice to log rejected passwords?
While selecting unique passwords for each purpose is a great idea, in practice this rarely happens. Therefore many select passwords from a personal pool of passwords that are easily remembered. When ...
10
votes
4answers
327 views
PCI-DSS - one application per server?
How do I interpret the 2.2.1 point for PCI-DSS? Is "application server" 'one primary function' or does it need to be "program x server", "program y server" etc?
I have a collection of applications ...
4
votes
3answers
153 views
Does GOOD Dynamics Proxy comply with EU data legislation?
My client is excited about GOOD technology; it allows them to have controlled access to business applications & email from BYOD (bring your own devices) and will enable a more mobile workforce. ...
7
votes
2answers
152 views
Cloud-specific standards and regulations
Not specific to any particular industry or requirements, but in general - are there currently commonly accepted standards regarding cloud-based applications?
I* am developing a system that will be ...
2
votes
3answers
84 views
If I host a web form which submits CC details to a provider, are there PCI implications form host?
I'm wondering if anyone has any thoughts on a specific question I have. I read a lot about systems that 'store, process, submit' CC data requiring compliance.
If I host a form on my website which ...
2
votes
2answers
138 views
Does requiring users to fill out a PDF w/ CC information and mail it back violate PCI compliance?
I'm attempting to place an order with an American company and I reside outside of America. Upon placing the order (and already submitting payment) I received an email asking me to fill out a PDF ...
3
votes
1answer
192 views
Conceptual design of vulnerability scanning program in global retail network (PCI DSS)
I am trying to design yearly program to scan for vulnerabilities on a very large network of payment terminals.
The company has thousands of retail points all around the world which need to be ...
2
votes
3answers
247 views
Vulnerability scanning applicability for PCI DSS
I'm fully up to speed on PCI DSS requirements and have attend the ISA course recently. The course was helpful and I was able to bounce ideas off of the trainer. However I keep coming back to one ...
1
vote
1answer
59 views
Are there any FIPS140-2 requirements that apply when boot code is updated in the field?
FIPS140-2 standard specifies the following conditional test to be performed by the cryptographic module if software or firmware components can be externally loaded into a cryptographic module:
...
7
votes
4answers
1k views
Is Facebook Connect or Twitter OAuth PCI Compliant?
We have a system that stores credit cards securely on file. We'd love to allow users to sign up using Facebook Connect or Twitter.
Obviously this wouldn't be secure if we were trusting just any old ...
5
votes
3answers
479 views
If PCI DSS isn't a law, how can I be prosecuted for not being compliant?
PCI DSS isn't a law. Why can I be prosecuted for not being compliant?
16
votes
2answers
3k views
Minimum requrements for storing last 4 digits of credit card number?
We have a merchant website that uses Autorize.net's CIM and AIM. Our users may have multiple credit cards so we'd want to give them opportunity to distinguish between credit cards that they use on ...
1
vote
1answer
138 views
Which PCI DSS SAQ applies when you don't store store but transmit CHD?
We have a merchant website that uses Authorize.net's AIM. Cardholder data (credit card number, expiration date, etc.) is entered at our website. Then it's transmitted to payment gateway and isn't ...
0
votes
2answers
236 views
Is this way of using Authorize.net's CIM PCI compliant?
We have a webapp where Authorize.NET's CIM and AIM are used for payment operations. When user buys something at first time he enters his CC number and other billing information at our site. This ...
4
votes
2answers
2k views
PCI DSS requirement 6.4.2 separation of duties between development/test environments
6.4.2 Is there separation of duties between personnel assigned to the development/test environments and those assigned to the production environment?
What does the separation of duties here mean? ...
5
votes
1answer
44 views
What security controls should be in place for online updates of user's correspondance address?
Addresses are one of the key pieces of security information for an account. They're used for authentication, determine where statements go, and changing an address on an account provide enough ...
5
votes
2answers
453 views
What is the equivalent European organization of NIST, especially in the Security Computer Division?
What is the European counterpart organization to USA's NIST?
I want to check the European best practices and guidelines on computer security.
Does anyone know if this organization exists, and if ...
2
votes
2answers
176 views
unix config scanner / compliance checks
I'm looking for a tool, that scans unix operating systems for configuration issues. E.g. a script that finds
PermitRootLogin yes
in the ssh config file or with other words: a script that automates ...
3
votes
3answers
113 views
In what situations are web services required to protect confidentiality of user information?
I know that if a web application needs to be PCI-DSS or HIPAA compliant the user personal identifiable information (e.g. user password, etc) needs to be kept confidential.
Under what other situations ...
2
votes
2answers
392 views
PCI Compliance network scope
I was wondering if anyone could clarify the scope of PCI compliance with regard to multiple networks.
At present, there's one PCI compliant network to which another network connects via VPN. The PCI ...
6
votes
7answers
797 views
Is this set-up PCI-Compliant?
Question: Is there a way to store credit card information on a shared hosting server AND be PCI compliant?
Here is the setup:
1) SSL is being implemented for the whole checkout process and for the ...
1
vote
0answers
85 views
What category of security measures are required by popular regulations? [closed]
There's a few very popular regulations, HIPAA, SOX, PCI-DSS, PII, ITAR, GLBA.
Can anyone explain what are their exact security implications? Exactly what type of implementations would my organization ...
3
votes
1answer
145 views
Facebook changed the default email address for every contact. How do I mitigate the impact and risk?
Facebook created a problem for regulated industries and Registered Investment Advisers (RIAs) by changing the default outgoing SMTP address for every contact to a @Facebook.com address.
This is an ...
3
votes
2answers
101 views
What drives FIPS140-2 compliance?
I guess this questions is directed at Product Managers, but I would be very interested to learn what people in the know think.
What are the most common factors that drives FIPS140-2 compliance for ...
3
votes
2answers
83 views
Evaluating hosting providers for CC development environment
An organization that develops software that may be subject to security evaluations such as Common Criteria is looking to externalize part of its IT infrastructure, including critical components such ...
9
votes
4answers
599 views
Is Google Analytics HIPAA compliant? How can I find out?
I'd really like to implement Google Analytics at my work on web software that is required to be HIPAA compliant. But I'm wondering if it's against the rules. Does anyone know how I can find out? I've ...
3
votes
1answer
519 views
How to backup database to comply with UK data protection act?
Charity has a server in their office onto which they backup a database with sensitive information. They want to get rid of this server.
Is there a cost effective solution that would allow them to ...
3
votes
3answers
215 views
HIPAA compliance in web forums?
If a website has a private forum (membership is not free) where people may ask health questions and paid Doctors are around to answer them, do normal HIPAA compliance rules apply?
In any forum, ...
15
votes
3answers
590 views
Do HIPAA Security Officers face personal liability for breaches?
The role of HIPAA Security Officer is very important in maintaining compliance. In smaller organizations, there's overlap in employees' roles, so the person that ends up as the HIPAA Security Officer ...
9
votes
2answers
52 views
Do I need to password-protect an “Electronic Copy” of health information given to a patient on e-media?
I'm struggling to find good documentation regarding requirements around security and encryption of patient clinical information when delivered to a patient in electronic format. Patient portals, ...
5
votes
1answer
374 views
Is BitLocker on a virtual machine FIPS 140-2 security level 1 compliant?
BitLocker can be used as a cryptographic module to fulfill FIPS 140-2 security level 1 compliance.
What if the encrypted drive is on a virtual machine, is that still FIPS 140-2 compliant?
In one ...
4
votes
2answers
310 views
How can I assess the strength of user passwords in my office environment?
I want to assure the compliance of password policy in my office.
Environment Intro
My environment is all windows based (server 2003/2008) user base is not more than 400 employees. Nearly 90% of all ...
2
votes
4answers
234 views
What actions should be taken by site according to Data Protection legislations?
Many countries have data protection legislation:
Data Protection Directive in EU
Data Protection Act 1998 in UK
privacy laws in USA
Web application may have registration form where fields for ...
1
vote
2answers
91 views
Can I instruct a Telco to prevent 2G connections from our phones?
Given that 2G is proven to be insecure (broken) at DefCon, is it possible for a Corporate IT department to work with the Telco and ban 2G connections for their devices?
Some cell phones are unable to ...
