Tag Info

Hot answers tagged

29

Logging the value of a failed password attempt (cleartext or otherwise) seems like a security anti-pattern. I've never seen a web app that does this, and I'm not aware of any default system services such as SSH that do either. As pointed out by @tylerl below, most systems simply log meta-information about an access attempt (e.g. username, time, perhaps IP ...


25

In a formal review of an application's security, all libraries should be vetted for security defects. However, this is not the point of OWASP-2013 A9. The core of OWASP-2013 A9 is about having a policies in place to ensure that an application isn't compromised due to negligence. OWASP states the following: Identify all components and the versions you ...


22

Another good question, but perhaps you should phrase it "Does PCI harm security". To answer both questions, I would differentiate very roughly between two types of organizations (even though most fall in between these two extremes): Security-conscious organizations, that routinely perform business-risk based analysis, have a comprehensive SDL in place, ...


20

Cardholder name, 4 last digits of CC number and its expiration date are all NOT sensitive data. The cardholder name and expiration date only require protection if you are storing them with the full primary account number, not the truncated 4 digit number. If you are storing, processing, or transmitting cardholder data then you must meet all of the other PCI ...


18

Well, first, what is written is the following: payment card companies are requiring merchants to be PCI-DSS compliant. PCI-DSS does not apply to anybody who doesn't process credit card transactions. The DSS requirements specify access control, logging, etc. None of this is applicable to a cardholder. Clients do not have the same contracts as merchants. ...


17

First, IANAL. Secondly, this is entirely dependant on your local laws and regulations. PCI-DSS is a guideline, but adherence to the guideline may be a requirement as part of certain laws. I'm not aware of any countries that do this, but in such a case you could be prosecuted if you violate a law that makes PCI-DSS adherence mandatory. The more common case ...


17

There are lots of different ways in which PCI impacts what you do; I'd point out the data security standards (PCI-DSS). Among many other things, they require strong authentication for anyone accessing the system remotely, and have a wide variety of restrictions on what kind of data you can keep. Don't even think about storing credit cards without ...


16

Taking into consideration the fact that you are doing these scans in the context of PCI-DSS compliance, your value-add in relation to compliance can be summed up by my personal favorite saying: AviD's Law of Regulatory Compliance: "PCI compliance reduces the risk of the penalties of non-compliance". In other words - the value-add of having an ...


15

You may be getting zero value-add. I suggest finding a new vendor. And when soliciting potential new PCI ASVs, ask them what they do, questions like: Which vulnerability scanners will you use to assess our systems? Do you use the commercial or free versions of the vulnerability scanners? We use Nessus internally, what more will you do to bring ...


14

Amazon does have a Type II SAS 70 report. Requesting a detailed copy of that should show all the controls they have in place. It may that people are asking Amazon the wrong questions. As a quick note, the SAS 70 testing in the future will be referred to as an SOC -- one of those accounting industry quirks. Especially with an Amazon-sized company, one looks ...


14

The most common reason that you need to be FIPS compliant is your company is required to by law or for other compliance reasons. FIPS compliant just means that your encryption has been validated by an authoritative body and there are no inherent flaws. There are also no discovered flaws in a lot of other encryption libraries like bouncycastle. The ...


13

Standards are general and consist of high level principles. Guides focus on practical security. Checklists are the most detailed documents. There are multiple agencies that produce security standards. One of the most widely used security standards today is ISO/IEC 27002 which started in 1995. This standard consists of three basic parts, BS 7799 part 1, ...


12

Nessus is very good at what it does, but a 'proper' security scanning vendor would not just deliver you a Nessus report. At the very least, you need to go through the report and validate to remove false positives - you probably do this internally anyway, but unless you request it a vendor may not. There is a major disconnect in what customers expect and ...


12

Good question! But there's not a solid answer I'm afraid. As with most of these cases, it depends case by case, but there are a few things to consider. First of all if there has been some for of negligence than an individual can be personally liable. However I don't think that an HIPAA Security officer is any different than any other person responsible ...


12

This is a classic scoping problem with compliance standards. Hold the merchant fully accountable -- but completely negate all of their efforts if the merchant's customer didn't protect their browsers. However, what does remain questionable for scoping is if the merchant has CSR reps or employees/contractors/consultants of any kind (back-office, via business ...


11

Core questions you need to ask - and these are covered by some of the answers in the questions @AviD has linked to and at high level by @Beth: Are you handling payment card data? If so, PCI-DSS Are you handling medical info? If so HIPAA in the US, DPA in UK Are you handling personal info? If so DPA in the UK Are you a financial org? GLBA in the US, FSA ...


11

For a software library, I would agree with @Lizbeth - FIPS 140-2 Level 1 is for software libraries like Bouncy Castle, Sun Java, and NSS (Java library this is FIPS certified). The difference is just that a FIPS compliant software library has been independently tested to meet a set of security requirements. Some industries have laws that require a certain ...


11

The initial commit for this code already includes the "80 bits" secret key length. It was not changed afterwards. Now let's analyze things more critically. HOTP is specified in RFC 4226. Authentication uses a "shared secret", which is the value that we are talking about. What does RFC 4226 says about it ? Essentially, there is a a requirement in section 4: ...


10

It is, of course, always wisest to accept the judgements of your QSA when making judgement calls, however during your own in-house compliance work I recommend checking out the Navigating PCI-DSS: Understanding the Intent of the Requirements document whenever confused by a requirement. Looking at page 32 of that document we see the following write up ...


10

As mentioned the two main laws in the US are Sarbanes-Oxley Act (SOx) and the Gramm-Leach-Bliley Act (GLB). If you are on the Banking side of the Financial Services sector then a must read is the Federal Financial Institutions Examination Council (FFIEC) Information Security Booklet dated July 2006. The handbook references NIST, ISO, and COBIT. NIST's 800 ...


10

If your compliance or regulatory body is perceived as PCI, you are incorrect. They make the rules and guidelines, but in this situation it is your companies' acquiring bank (the bank that issued your merchant number and processes your payments). What is the volume of cardholder data that is being taken off premises or thrown away without shredding? From ...


10

PCI DSS v2, Requirement 7: "Implement Strong Access Control Measures" is the pertinent section. This section details access control primarily for non-consumers that will be accessing cardholder data for business purposes, though there are a couple requirements that seem applicable to consumers as well as non-consumers: 8.1 Assign all users a unique ID ...


10

Both answers above are bang on the money, but I'd just like to add the following caveat. I run a regulatory services company and I got us certified to ISO 27001. The one thing I would communicate to anybody thinking of becoming certified is to remember that being certified to a standard is not like acquiring a magic talisman that wards off all evil (and ...


10

There's no legitimate purpose to log plaintext passwords for any application; especially for an incorrect login. It may be logged by chance--I've casually looked at auth.log for other purposes, and seen an user accidentally type their password into the login field (and I do record the login fields to see what accounts are attempted to be logged in) -- ...


9

Issue 1 : You mention password encryption. Firstly why are passwords rather than salted hashes of passwords used? As for key rotation/expiration, I've seen (and coded for) policies like that. The longer a key is in use (and the more times it is used) the higher the risk it may become comprised/discovered. Some systems, for example Windows DPAPI automatically ...


9

So basically what the requirement is saying is that you need to assign one primary function per server. The server you've described sounds like it runs a few applications for production users to utilize. This would be classified as an "application" server. However, you've also mentioned that there are multiple applications on that server, some touch the CDE ...


9

The basic principle of SOX (I can't speak to the Japanese version, but I'd put my bet that it carries over) is that the officers of the company must attest that they are aware of the company's action and are responsible for those actions. This is usually done by having a consultant come in and document what the company is doing. The focus of SOX is on ...


9

You are expected to log: All individual accesses to cardholder data All actions taken by any individual with root or administrative privileges Access to all audit trails Invalid logical access attempts Use of identification and authentication mechanisms Initialization of the audit logs Creation and deletion of system-level objects These must be logged ...


8

The one truism of PCI-DSS compliance is this: You are PCI-DSS compliant if your QSA says you are PSI-DSS compliant. I'm of the opinion that the PCI council did a pretty stinking good job of giving us a very clear and to the point standard to follow, at least as far as standards go. That being said, this is one of those interesting cases where the ...



Only top voted, non community-wiki answers of a minimum length are eligible