Tag Info

New answers tagged

2

This question verges upon opinion-based, but I'll try and provide some suggestions based on my experience (which is biased towards PCI but touches on others). It isn't specific to the cloud but I believe there's an equivalence. Some rules of thumb: Attestations / summaries are distributed, reports are generally not Policies are more likely shared than ...


2

dev/random is not even remotely the same as NIST SP 800-90A DRGB. If you want to claim compliance to NIST SP 800-90A DRGB then hire a test lab to test your DRBG and submit the results to NIST's Cryptographic Algorithm Validation Program (http://csrc.nist.gov/groups/STM/cavp/index.html) and then it will end up on this list: ...


3

If we take a look at the man page for random we get the following: The random number generator gathers environmental noise from device drivers and other sources into an entropy pool. The generator also keeps an estimate of the number of bits of noise in the entropy pool. From this entropy pool random numbers are created. At the bottom we see: ...


1

Emailing cardholder data over the internet is a violation of PCI DSS because email is not a secure form of communication. The practice of filling out the PDF form with your sensitive information and upload it via sFTP or fax, however, is NOT a violation of PCI. But here are the questions, what do they do and how do they handle that document once they get it? ...



Top 50 recent answers are included