The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
0answers
12 views

Medical Device - FDA compliance [closed]

what are industry best practices to secure servers and IT infrastructure within a medical device industry ? Looking to compare what we have to the industry standard or compliance body.
0
votes
1answer
54 views

PDF encryption anomaly; version 1.5 using AES

I'm not sure if this is the correct forum to ask this question so please accept my apologies in advance if this is the wrong place. (I have already posted this in the Programmers section but I've yet ...
11
votes
7answers
242 views

What risk rating models are used for calculating risk scores of web vulnerabilities?

What risk rating methods, models, assessments or methodologies are used for calculating or estimating a risk score of vulnerabilities (for example, like described in the OWASP top 10) and which of ...
0
votes
2answers
69 views

Certifying software as secure

What security certifications do major banks in the US expect an external software vendor to comply with? The software might form part of their payment processing system. ISO/IEC 27001 would apply to ...
3
votes
0answers
38 views

Protocols for transfering access control data

The company I am working for has decided to create an API for a few of the products we create here (we create physical access control solutions, card readers, key storage, intelligent door locks and ...
4
votes
1answer
76 views

How relevant is OWASP ASVS? [closed]

How relevant is the OWASP application security verification standard? Have you had it as a requirement made by business? What other application security standards relevant to business are there? I did ...
1
vote
0answers
42 views

How should I authenticate a third party's users on my platform?

I'm having trouble finding implementation ideas / guidance / examples for an authentication system that has the following properties: Allows a third party to carry out actions on our platform on ...
3
votes
2answers
100 views

Cybersecurity Server Stack references

I hear a lot of best practices saying that you should have 2 vSphere server stacks: One for Production One for Cybersecurity For example, your enterprise might have a vSphere environment stack that ...
8
votes
2answers
165 views

What is the current EU standard for data destruction?

I have been hunting around for a couple of weeks trying to find what the current standards for sensitive data destruction in the EU/UK are. If you look at the destruction companies they have several ...
0
votes
1answer
17 views

Are there Secure Coding Standards other that CERT? [closed]

I am familiar with the CERT Secure Coding Standart. Are there also any other secure coding standarts other than the CERT ones?
1
vote
1answer
24 views

History of the CERT secure coding standards? [closed]

My question is when and why did researchers decide to create the CERT secure coding standards? Is there anything about the history of this standards? I can't find anything about this.
21
votes
5answers
2k views

Policy mandate dilemma

When writing security policies do you take into consideration user's (could be vendors) ability/capability to fulfil certain mandates in the policies or do you strictly want them to enforce, no matter ...