A rule of order having the force of law, prescribed by a superior or competent authority, relating to the actions of those under the authority's control.
12
votes
2answers
328 views
Which factors should I consider for devices that accept handwritten digital signatures?
These days many locations ask you to give your signature on a digital signature pad/device.
As I am situated in Europe, the EU directive 1999/93/EC seems to regulate it. From what I have found out ...
7
votes
2answers
152 views
Cloud-specific standards and regulations
Not specific to any particular industry or requirements, but in general - are there currently commonly accepted standards regarding cloud-based applications?
I* am developing a system that will be ...
7
votes
2answers
337 views
HIPAA compliance without PII
I have a web site where people fill medical syndrome questioners.
They can see how their condition changes during the time period.
I am not storing ANY PII information, just user name.
I can store in ...
6
votes
1answer
315 views
What governing body is responsible for the use of GSM SMS alphanumeric SenderID's?
Currently, I am writing a paper about GSM sender spoofing and how this flaw is possible with the use of different techniques and attack pattern in the GSM 2G implementation both technically and ...
5
votes
3answers
2k views
Regulations that specify password length?
I have read:
PCI DSS 1.2
SOX 404
AR 25-2
ISO 27001
But only PCI DSS specifies a minimum password length.
Are there any other regulations that dictate password lengths for any industry?
NIST ...
5
votes
2answers
672 views
What security standards and regulations are in place for bank ATM?
Are there any international or US mandated standards and regulations that apply to communications between automatic teller machines and bank's central office? Are banks or ATM operators subjected to ...
5
votes
1answer
161 views
What compliance problem does “Common Criteria Certification” solve?
It has been said Common Criteria solves a "Compliance problem, and not a security problem". Can someone explain where CC certification is required or benefits an industry?
Is it simply a marketing ...
5
votes
1answer
374 views
Is BitLocker on a virtual machine FIPS 140-2 security level 1 compliant?
BitLocker can be used as a cryptographic module to fulfill FIPS 140-2 security level 1 compliance.
What if the encrypted drive is on a virtual machine, is that still FIPS 140-2 compliant?
In one ...
4
votes
3answers
239 views
Are there any regulations against financial companies storing passwords in plaintext?
A bank that I use stores my password in cleartext or perhaps using reverisible encryption, which is just as bad.
I know this because when you click "Forgot your password?" (or similar) link, it ...
4
votes
2answers
502 views
What cryptographic module does Sql Server 2008 use to run in Fips 140-2 compliant mode by default?
One can configure Sql Server 2008 to run in FIPS 140-2 compliant mode, in the same manner as running Bitlocker in FIPS 140-2 compliant mode. Which is to activate FIPS 140-2 compliant mode in the ...
3
votes
1answer
186 views
HITECH : New United States Federal Act on Data Security
Has anyone heard of the new HITECH Federal Act? I understand that it is an underscore of the HIPAA Federal Act but am unclear of the requirements that they are requesting.
It targets companies that ...
2
votes
4answers
101 views
How do you build a secure web application that is also COPPA compliant?
If you are building a web application to be used by US schools, you will probably have to worry about COPPA compliance.
Children's Online Privacy Protection or COPPA is new to me, probably because ...
0
votes
2answers
82 views
Security in the breaking cloud? Storage Wars?
If access to a cloud server instance that stores personal/important information is lost or removed by the provider, is my data protected? Can the provider access my data and copy it, distribute, or ...
0
votes
1answer
151 views
What regulations *require* multi-factor authentication?
Just the straightforward question: What industries require multi-factor authentication?
Please include the following information
Country
Industry
Regulation name
Additional information as you ...
