Tag Info

New answers tagged

1

Yes, in certain situations. https://www.pcicomplianceguide.org/pci-faqs-2/#11 Q: Do I need vulnerability scanning to validate compliance? A: If you qualify for certain Self-Assessment Questionnaires (SAQs) or you electronically store cardholder data post authorization, then a quarterly scan by a PCI SSC Approved Scanning Vendor (ASV) is ...


1

If you are in a position whereby you can self-assess, you could lie an respond that all requirements are fully in place. Typically, your acquirer will request a copy of your SAQ and the signed Attestation of Compliance. It is unlikely that additional evidence will be required. A self-assessment is just that; an internal review of your own processes and ...


5

If you don't provide documentation of your compliance (either an SAQ or your AoC and RoC) to your processor/acquirer, they stop processing transactions for you, which is sort of like a fine in that you start losing money and customers. To quote the overview to the PCI DSS Self-Assessment Questionnaire (SAQ), you may be required to share [your SAQ] ...


2

this happens over HTTP and once the keys are shared and algorithms are decided further data will be encrypted but since in HSTS all data goes encrypted from the first request itself , so the client and server are using the algorithms and keys as decided in previous HTTPS session or how it works, how can the first request be encrypted without sharing the ...


3

This is not to prevent double quotes, single quotes or spaces from breaking out of the attribute context, as this is covered by "Aggressive HTML Entity Encoding". For background, an attack like this is possible: <body background="javascript:alert('XSS')"> For id and name, these attributes are frequently used as reference points in the DOM. If an ...


0

The text is saying that you need to validate untrusted input when used as any attribute. It is just a restatement of rule 2. Characters such as " could cause big problems.


3

Yes, I have seen this tool as one of the dependencies before going to production in an enterprise level organisation. I have to say that it's not flawless and requires quite the attention due to false positives. These false positives can be placed in an ignore file. However, I think it's a nice "extra" to have before releasing a product to production.



Top 50 recent answers are included