Tag Info

New answers tagged

0

It's been a while since I last worked closely with Lync server, but while you can exercise quite a bit of control over the content of the conversations, I don't believe that it directly allows for Activesync style encryption policies. I sadly no longer have a configured environment to go digging on to verify that though, so take this answer with a large ...


0

If you outsource all cardholder data to a third party and you require compliance yourself, then the applicable requirements for SAQ A are applicable to you. While the PCI DSS consists of a large number of requirements (i.e. SAQ D), the vast majority of these will not be applicable to you if you do not handle cardholder data. Depending on volumes you may not ...


0

If the CC data never touched your servers, you wouldn't be a (PCI) service provider, so no - the same level of compliance requirements do not apply in both cases. (That said, SAQ D covers the majority of cases, so yeah, it covers a broad range of involvement). Yes, your clients will need to have some level of PCI compliance as they're collecting the data. ...


3

You have to report on PCI compliance if you are a level 4 merchant. You need to complete a self assessment (SAQ). So to become compliant you need to: Complete the Self-Assessment Questionnaire according to the instructions it contains. Complete and obtain evidence of a passing vulnerability scan with a PCI SSC Approved Scanning Vendor (ASV). Note scanning ...


1

Im not very talented at coding but used the basics of creating a shell script and printing out outputs to check for configuration standards and write them to a text file. Ive tried to show expected/desired output and then what the output is. You can get the document from CIS here or you may need to fill in a form to get it ...


2

In general, DISA STIGs are more stringent than CIS Benchmarks. Keep in mind that with STIGs, what exact configurations are required depends on the classification of the system based on Mission Assurance Catagory (I-III) and Confidentiality Level (Public-Classified), giving you 9 different possible combinations of config requirements. CIS usually have a Level ...


5

Storing CVV is not allowed: There are a few things to consider: You assume booking.com is storing CVV You're assuming a CVV is needed to process a transaction. On 1) - there can be no way to confirm whether booking.com, Expedia are storing unless you work there. They would have to answer to a QSA. Now, as far as the CVV that is stored, that is CVV2 ...


2

Here are some important considerations: What is the reason that you're hardening against a given benchmark or guideline? Are you going to be audited? Is there a preferred route or route the your auditors are more familiar with? What tools will you use for self auditing? Do those tools have polices or plugins to audit your system against a given ...


2

One difference is the ease to find a reliable and automated tool to check for compliance. I believe Nessus has templates available for most of the ones you have listed, but some are dated. In any case, I'd choose one that makes it as easy as possible for you to check and stay in compliance.



Top 50 recent answers are included