Tag Info

Hot answers tagged

25

Logging the value of a failed password attempt (cleartext or otherwise) seems like a security anti-pattern. I've never seen a web app that does this, and I'm not aware of any default system services such as SSH that do either. As pointed out by @tylerl below, most systems simply log meta-information about an access attempt (e.g. username, time, perhaps IP ...


22

In a formal review of an application's security, all libraries should be vetted for security defects. However, this is not the point of OWASP-2013 A9. The core of OWASP-2013 A9 is about having a policies in place to ensure that an application isn't compromised due to negligence. OWASP states the following: Identify all components and the versions you ...


21

Another good question, but perhaps you should phrase it "Does PCI harm security". To answer both questions, I would differentiate very roughly between two types of organizations (even though most fall in between these two extremes): Security-conscious organizations, that routinely perform business-risk based analysis, have a comprehensive SDL in place, ...


18

Well, first, what is written is the following: payment card companies are requiring merchants to be PCI-DSS compliant. PCI-DSS does not apply to anybody who doesn't process credit card transactions. The DSS requirements specify access control, logging, etc. None of this is applicable to a cardholder. Clients do not have the same contracts as merchants. ...


17

There are lots of different ways in which PCI impacts what you do; I'd point out the data security standards (PCI-DSS). Among many other things, they require strong authentication for anyone accessing the system remotely, and have a wide variety of restrictions on what kind of data you can keep. Don't even think about storing credit cards without ...


17

First, IANAL. Secondly, this is entirely dependant on your local laws and regulations. PCI-DSS is a guideline, but adherence to the guideline may be a requirement as part of certain laws. I'm not aware of any countries that do this, but in such a case you could be prosecuted if you violate a law that makes PCI-DSS adherence mandatory. The more common case ...


16

Cardholder name, 4 last digits of CC number and its expiration date are all NOT sensitive data. The cardholder name and expiration date only require protection if you are storing them with the full primary account number, not the truncated 4 digit number. If you are storing, processing, or transmitting cardholder data then you must meet all of the other PCI ...


15

Taking into consideration the fact that you are doing these scans in the context of PCI-DSS compliance, your value-add in relation to compliance can be summed up by my personal favorite saying: AviD's Law of Regulatory Compliance: "PCI compliance reduces the risk of the penalties of non-compliance". In other words - the value-add of having an ...


14

You may be getting zero value-add. I suggest finding a new vendor. And when soliciting potential new PCI ASVs, ask them what they do, questions like: Which vulnerability scanners will you use to assess our systems? Do you use the commercial or free versions of the vulnerability scanners? We use Nessus internally, what more will you do to bring ...


14

The most common reason that you need to be FIPS compliant is your company is required to by law or for other compliance reasons. FIPS compliant just means that your encryption has been validated by an authoritative body and there are no inherent flaws. There are also no discovered flaws in a lot of other encryption libraries like bouncycastle. The ...


14

Amazon does have a Type II SAS 70 report. Requesting a detailed copy of that should show all the controls they have in place. It may that people are asking Amazon the wrong questions. As a quick note, the SAS 70 testing in the future will be referred to as an SOC -- one of those accounting industry quirks. Especially with an Amazon-sized company, one looks ...


13

Standards are general and consist of high level principles. Guides focus on practical security. Checklists are the most detailed documents. There are multiple agencies that produce security standards. One of the most widely used security standards today is ISO/IEC 27002 which started in 1995. This standard consists of three basic parts, BS 7799 part 1, ...


12

This is a classic scoping problem with compliance standards. Hold the merchant fully accountable -- but completely negate all of their efforts if the merchant's customer didn't protect their browsers. However, what does remain questionable for scoping is if the merchant has CSR reps or employees/contractors/consultants of any kind (back-office, via business ...


12

Good question! But there's not a solid answer I'm afraid. As with most of these cases, it depends case by case, but there are a few things to consider. First of all if there has been some for of negligence than an individual can be personally liable. However I don't think that an HIPAA Security officer is any different than any other person responsible ...


11

Nessus is very good at what it does, but a 'proper' security scanning vendor would not just deliver you a Nessus report. At the very least, you need to go through the report and validate to remove false positives - you probably do this internally anyway, but unless you request it a vendor may not. There is a major disconnect in what customers expect and ...


11

Core questions you need to ask - and these are covered by some of the answers in the questions @AviD has linked to and at high level by @Beth: Are you handling payment card data? If so, PCI-DSS Are you handling medical info? If so HIPAA in the US, DPA in UK Are you handling personal info? If so DPA in the UK Are you a financial org? GLBA in the US, FSA ...


11

For a software library, I would agree with @Lizbeth - FIPS 140-2 Level 1 is for software libraries like Bouncy Castle, Sun Java, and NSS (Java library this is FIPS certified). The difference is just that a FIPS compliant software library has been independently tested to meet a set of security requirements. Some industries have laws that require a certain ...


10

As mentioned the two main laws in the US are Sarbanes-Oxley Act (SOx) and the Gramm-Leach-Bliley Act (GLB). If you are on the Banking side of the Financial Services sector then a must read is the Federal Financial Institutions Examination Council (FFIEC) Information Security Booklet dated July 2006. The handbook references NIST, ISO, and COBIT. NIST's 800 ...


10

Both answers above are bang on the money, but I'd just like to add the following caveat. I run a regulatory services company and I got us certified to ISO 27001. The one thing I would communicate to anybody thinking of becoming certified is to remember that being certified to a standard is not like acquiring a magic talisman that wards off all evil (and ...


10

If your compliance or regulatory body is perceived as PCI, you are incorrect. They make the rules and guidelines, but in this situation it is your companies' acquiring bank (the bank that issued your merchant number and processes your payments). What is the volume of cardholder data that is being taken off premises or thrown away without shredding? From ...


10

The initial commit for this code already includes the "80 bits" secret key length. It was not changed afterwards. Now let's analyze things more critically. HOTP is specified in RFC 4226. Authentication uses a "shared secret", which is the value that we are talking about. What does RFC 4226 says about it ? Essentially, there is a a requirement in section 4: ...


9

You are expected to log: All individual accesses to cardholder data All actions taken by any individual with root or administrative privileges Access to all audit trails Invalid logical access attempts Use of identification and authentication mechanisms Initialization of the audit logs Creation and deletion of system-level objects These must be logged ...


9

Issue 1 : You mention password encryption. Firstly why are passwords rather than salted hashes of passwords used? As for key rotation/expiration, I've seen (and coded for) policies like that. The longer a key is in use (and the more times it is used) the higher the risk it may become comprised/discovered. Some systems, for example Windows DPAPI automatically ...


9

PCI DSS v2, Requirement 7: "Implement Strong Access Control Measures" is the pertinent section. This section details access control primarily for non-consumers that will be accessing cardholder data for business purposes, though there are a couple requirements that seem applicable to consumers as well as non-consumers: 8.1 Assign all users a unique ID ...


9

The basic principle of SOX (I can't speak to the Japanese version, but I'd put my bet that it carries over) is that the officers of the company must attest that they are aware of the company's action and are responsible for those actions. This is usually done by having a consultant come in and document what the company is doing. The focus of SOX is on ...


9

There's no legitimate purpose to log plaintext passwords for any application; especially for an incorrect login. It may be logged by chance--I've casually looked at auth.log for other purposes, and seen an user accidentally type their password into the login field (and I do record the login fields to see what accounts are attempted to be logged in) -- ...


9

So basically what the requirement is saying is that you need to assign one primary function per server. The server you've described sounds like it runs a few applications for production users to utilize. This would be classified as an "application" server. However, you've also mentioned that there are multiple applications on that server, some touch the CDE ...


8

You say your application takes credit card data in to pass on to another application? This means you are handling it - I would class what you are doing as transmitting CC data according to PA guidance (relevant parts in bold): The scope of the PA-DSS review should include the following: Coverage of all payment application functionality, including but ...


8

So, do we need to be since we are not storing, transmitting or processing the credit card data. We are transmitting the credit card information only from RAM to an API call. Your second statement is contradicting the first, and more importantly, holds the answer to your question. PCI DSS v2 states the following, PCI DSS applies wherever ...



Only top voted, non community-wiki answers of a minimum length are eligible