Tag Info

New answers tagged

0

PCI compliance is required if you fall under it's provisions. The provisions apply, at varying levels, if you handle payment card information in any way. This includes not only processing and storing the information, but also transferring the information across your servers. If, for example, you took in the payment card information (to your server) and ...


2

First of all SSL without a certificate is not possible, don't try to roll your own security because you will fail at it. You might think "hey how would you not know that I'm actually a very good crypto expert" well because you wouldn't be making such statements. PCI-DSS is only mandatory if you are processing credit card data. This means that if you accept ...


4

Certification companies like SGS, TÜV Rheinland or BSI are accredited by accreditation entities to issue ISO 27001 certificates. For example, SGS and BSI are accredited by UKAS and TÜV Rheinland is accredited by DAR. Accreditation entities perform audits of the certification companies they accredit in order to guarantee that they conform to their ...


0

The ISO27001 is a standard against which an organization is audited. It is not a pen test or a code review, it is focused primarily on management, policies, etc. It's a third party providing reasonable assurance about the operating effectiveness, controls, etc. at the company. e.g., If an org has been certified, you still would have legal agreements, ...


1

Ultimately it's down to trust. Who trusts you to audit against ISO27001? In the case of BSi, they've established themselves as part of the process (indeed BS7799 which was a BSi developed standard predated ISO27001 and IIRC got effectively turned into ISO27001 when it was first created). So as part of creating a standard you have to create and manage an ...


2

Who are you defending against? No, really, because remember, with SSD, there are sectors that go bad that are no longer writable. With ATA Secure Erase, the drive is also supposed to erase the mapped-out bad blocks, but if the blocks are actually no longer writable, it cannot succeed. You can't blame a vendor for not doing the impossible. A custom ...



Top 50 recent answers are included