Aspects of compliance with regulations, standards, laws, and policies.

learn more… | top users | synonyms

2
votes
2answers
61 views

Is PCI Compliance mandatory?

I recently started working on an eCommerce addition to a site I'm working on.In my research looking for a way to do SSL without a certificate/a free certificate I came across PCI Compliance.I have ...
3
votes
3answers
372 views

Why do we trust organizations that certificate ISO 27001?

I've been asked why do we trust organizations that certifies ISO 27001? From where did they get the authority and recognition to be able to certify ISO 27001? For example, I can start a certification ...
5
votes
2answers
282 views

What SSD maker has implemented Secure Erase to spec?

I have a Kingston hyperx drive circa 2012. I kicked off a secure erase on it. I then remounted the drive and was horrified (well, not really more like bemused) to see my whole parts of my old file ...
1
vote
0answers
20 views

Does HDCP impose HD-playback restrictions for sinks?

In order to be HDCP compliant, a source can only output HDCP-encrypted digital HD content. However, is the opposite true for HDCP sinks? In order to be HDCP compliant, should a sink only accept to ...
19
votes
1answer
2k views

Has anyone achieved PCI compliance on AWS?

All the FAQs, documents and statements published by AWS aside, did any Level 1 merchant or service provider actually achieve PCI compliance on AWS yet? We're evaluating moving some of our services to ...
1
vote
1answer
46 views

Compliance with an industry recognized framework - ISO27k

I've been asked to figure out how to get our company to comply with an "Industry Recognized [Security] Framework" where '“Industry Recognized Framework” means a global industry recognized information ...
13
votes
3answers
3k views

Nessus vs third-party scans

As part of our PCI-DSS compliance process we get scans done by a third party. Based on the form and wording of the output, it's pretty clear they're using Nessus for most of their heavy lifting. Same ...
0
votes
1answer
47 views

HIPAA compliant on Azure cloud? [closed]

We are using WebRoles to host our api, Table storage to persist PHI and Blob Storage to persist MRIs and CT images. What is required to become HIPAA Compliant? -- Edit 2014-02-17 -- I just want to ...
32
votes
2answers
1k views

Why does Google cripple the 2FA Google Authenticator PAM module?

If you enable 2FA for Google Apps the shared secret is 160 bits. The google_authenticator PAM module on the other hand seems to use 80 bits for the shared secret. According to RFC 4226: R6 - The ...
0
votes
1answer
90 views

When does a PA-DSS certified application expire?

When you search the PCI website for validated payment applications it shows a re-validation date and an expiry date. There is also two categories of payment applications, "Acceptable for new ...
0
votes
3answers
535 views

Questions about in-scope information assets for an ISO27001 ISMS

I am in the process of writing a Scope for the information assets - in preparation for writing an ISO27001 compliant ISMS. I am confused as to if a VPN network is considered to be in Scope? as well ...
3
votes
1answer
188 views

Strange packets coming over wireless, looking for clues

While running airodump-ng in town, I have noticed an unusual type of AP or pseudo-AP. There is a steady stream of wireless beacon frames coming in on channel 6. The frames are valid, but have several ...
15
votes
3answers
477 views

Any comments or advice on OWASP-2013 top 10 number A9

In this iteration of the OWASP top 10 application security vulnerabilities list (https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project), a new category 'A9 Using Components with Known ...
1
vote
1answer
348 views

How to define audit controls responsibility? @ SIEM

I'm assigned to write procedural documentation for the SIEM use cases for the IT asset owners. For example, the procedures for selecting events indicating unauthorized access to user-mail box. I have ...
2
votes
2answers
56 views

ICO compliance and Google Cloud SQL

I have a basic simple question for which I couldn't find anywhere. Is is possible to use Google Cloud SQL services and still retain the regulations from ICO and other similar requirements? I ...
1
vote
3answers
120 views

Are there any security related rules in PCI-DSS that govern when I can capture a payment?

Is there a PCI-DSS rule that a merchant cannot capture the funds for an order until we have actually shipped it? I can't seem to find an official reference that describes this as a PCI DSS ...
1
vote
2answers
129 views

How should I store and maintain secure configuration documents?

We have many scripts that we call "secure baselines" that allow our server/desktop installation people to install operating systems using best security practice. We test that the baselines have been ...
5
votes
2answers
576 views

Is SSL terminated at a load balancer PCI compliant?

I've read this nice question: Should SSL be terminated at a load balancer? And I have the same question, but with PCI-DSS compliance in mind. Is SSL terminated at the load balancer, with clear ...
3
votes
3answers
152 views

What is the job of an IT auditor?

I am going through training in information security, as a part of the course they included compliance standards like: PCI DSS ISO 27001-2005 Cobit framework So after searching over Google, I came ...
4
votes
2answers
119 views

Evaluating hosting providers for CC development environment

An organization that develops software that may be subject to security evaluations such as Common Criteria is looking to externalize part of its IT infrastructure, including critical components such ...
4
votes
2answers
359 views

Is Common Criteria (CC) a suitable standard to certify web applications

I never came across a web application that has been certified according to Common Critera. As far as I know there isn't even a protection profile available for web applications. What is the reason ...
5
votes
1answer
211 views

What compliance problem does “Common Criteria Certification” solve?

It has been said Common Criteria solves a "Compliance problem, and not a security problem". Can someone explain where CC certification is required or benefits an industry? Is it simply a marketing ...
1
vote
3answers
112 views

USGCB on a non-networked computer

We will be getting some data that needs to be kept in accordance with USGCB regulations. Our intent was to keep it secure by storing and using it on a non-networked computer, but the regulations seem ...
10
votes
5answers
460 views

Data needed for why not to load third party JavaScript on web page with credit card form

My company makes a JavaScript widget that e-commerce sites can embed on their pages. Our current instructions to our customers tell them to load our JS on every page of their site and most follow this ...
4
votes
1answer
261 views

HIPAA: How am I required to secure PHI database access creds on my web server?

Assuming I have a database of PHI that my web application needs to access, how am I required to secure the credentials on the webserver that the web application uses to access this database? Is ...
1
vote
0answers
299 views

How can Stripe be PCI-compliant?

According to the Stripe FAQ, they are PCI-compliant. Also, in their API documentation, one of the parameters to create a new card is the CVC (although, granted, it is optional). So, I assume they ...
4
votes
3answers
527 views

MS-SQL Monitoring/Auditing of PHI for HIPAA

We're currently looking for a solution (hardware or software-based) that can monitor and audit all PHI viewing activity per new HIPAA rules. We use MS-SQL for our production database. We have the ...
4
votes
1answer
486 views

Are Linux vendor-supplied security updates enough for PCI Compliance?

I have several systems that require PCI compliance, all of them are running CentOS 6.4 with all security updates applied daily. However, PCI compliance scanning will often reject detected versions of ...
4
votes
4answers
2k views

Becoming HIPAA Compliant

What is required to become HIPAA Compliant? Do I need to take a test or do I just need to follow a certain set of guidelines? EDIT: Just to provide my background. I am a small IT Firm and we would ...
4
votes
2answers
826 views

FIPS Compliance for my Android project

I am working on a security-related project and have to make sure it is FIPS 140-2 compliant. According to my understanding, FIPS compliance is compliance at hardware as well as software level. ...
1
vote
1answer
123 views

Would using Websockets cause PCI compliance failure?

Would utilizing WebSockets cause an issue with obtaining or maintaining PCI compliance?
4
votes
1answer
392 views

Nessus HTML5 version 5.0.3 - PCI Scan

I've been searching for a couple days, even contacting support, to find out if Nessus has a bundle that scans for PCI compliance. It selects all 44 categories and regardless of what kind of scan I ...
6
votes
3answers
748 views

Is storing card details without the permission of the card holder against PCI DSS?

I've bought something from an online store, and when entering the card details, it sent the details to their server through a HTTPS connection, which I then assume they forwarded to their provider - ...
9
votes
4answers
794 views

New credit card security standards regarding PA-DSS Compliance

The new credit card standards including PA-DSS can be quite confusing for software companies. My question is this: If your software company designs a POS software system (like we do) which utilizes ...
7
votes
7answers
4k views

Storing credit cards for automatic payments?

I have no experience with storing credit cards and I do not know anything about the legal end of this. The company I work for / develop for wants to store credit cards to process auto payments for ...
2
votes
1answer
126 views

Backup media storage strategy

As a company we are performing daily backups onto RDX removable media which is fully encrypted (shows as unformatted drive) and the backup software also encrypts the files during the backup process, ...
3
votes
3answers
296 views

Web application security standards/certificates

I'm currently working on Web application/service that (hopefully) will be used in a wide variety of ways. Of course I'm looking to attracting some commercial users as well, and as we all know, they ...
2
votes
3answers
520 views

Any place where I can find some template or base documents for IT/Infosec Compliance?

We're facing an audit and we are sorely lacking in documentation regarding information security policies. I've done some Googling and have been surprised by the difficulty of finding a good "template" ...
2
votes
2answers
548 views

What certification would be considered equivalent to the U.S.-EU Safe Harbor Framework?

The Safe Harbor website says the following: The European Commission’s Directive on Data Protection went into effect in October of 1998, and would prohibit the transfer of personal data to ...
2
votes
2answers
288 views

What compliance framework is appropriate for firewalls

As a more corpose vulnerability assessment and penetration test, one step of our activity is to review from a security perspective the policy of some firewall. In our society we have a deep ...
7
votes
5answers
756 views

What security requirements are a defacto standard in the Financial Industry?

What technologies, processes, or laws that relate to InfoSec apply specifically to the Financial industry? If you're familliar with the Financial Industry, can you share details? For example: What ...
0
votes
1answer
223 views

How to enforce NTFS permission compliance?

I have to enforce NTFS permissions based on business roles. Each role (group in ADS) can be granted the permission to read or write a file server directory. I do not care about share permissions. I ...
3
votes
1answer
85 views

Server Certification Processes

We are considering a certification process for new internal server builds before they are allowed to be placed into production. That is, the system administration team will send the server up to the ...
3
votes
2answers
310 views

A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant?

We have to design and construct a system that signs files with sensible data, like evidences/proofs. The sign process is simple, basically calculate MD5 of the file content and encrypt the MD5 result ...
7
votes
1answer
316 views

Enterprise standard for securing servers.

This must be the most broad question to ask, but through the years, i've come up with my own list of things I so to secure my servers, I follow the obvious steps I could gather online such as, ...
21
votes
5answers
2k views

Is it common practice to log rejected passwords?

While selecting unique passwords for each purpose is a great idea, in practice this rarely happens. Therefore many select passwords from a personal pool of passwords that are easily remembered. When ...
10
votes
4answers
1k views

PCI-DSS - one application per server?

How do I interpret the 2.2.1 point for PCI-DSS? Is "application server" 'one primary function' or does it need to be "program x server", "program y server" etc? I have a collection of applications ...
4
votes
3answers
329 views

Does GOOD Dynamics Proxy comply with EU data legislation?

My client is excited about GOOD technology; it allows them to have controlled access to business applications & email from BYOD (bring your own devices) and will enable a more mobile workforce. ...
8
votes
2answers
171 views

Cloud-specific standards and regulations

Not specific to any particular industry or requirements, but in general - are there currently commonly accepted standards regarding cloud-based applications? I* am developing a system that will be ...
3
votes
3answers
108 views

If I host a web form which submits CC details to a provider, are there PCI implications form host?

I'm wondering if anyone has any thoughts on a specific question I have. I read a lot about systems that 'store, process, submit' CC data requiring compliance. If I host a form on my website which ...