Tag Info

New answers tagged

1

Im not very talented at coding but used the basics of creating a shell script and printing out outputs to check for configuration standards and write them to a text file. Ive tried to show expected/desired output and then what the output is. You can get the document from CIS here or you may need to fill in a form to get it ...


2

In general, DISA STIGs are more stringent than CIS Benchmarks. Keep in mind that with STIGs, what exact configurations are required depends on the classification of the system based on Mission Assurance Catagory (I-III) and Confidentiality Level (Public-Classified), giving you 9 different possible combinations of config requirements. CIS usually have a Level ...


5

Storing CVV is not allowed: There are a few things to consider: You assume booking.com is storing CVV You're assuming a CVV is needed to process a transaction. On 1) - there can be no way to confirm whether booking.com, Expedia are storing unless you work there. They would have to answer to a QSA. Now, as far as the CVV that is stored, that is CVV2 ...


2

Here are some important considerations: What is the reason that you're hardening against a given benchmark or guideline? Are you going to be audited? Is there a preferred route or route the your auditors are more familiar with? What tools will you use for self auditing? Do those tools have polices or plugins to audit your system against a given ...


2

One difference is the ease to find a reliable and automated tool to check for compliance. I believe Nessus has templates available for most of the ones you have listed, but some are dated. In any case, I'd choose one that makes it as easy as possible for you to check and stay in compliance.



Top 50 recent answers are included