New answers tagged

0

Using an https iframe in an http webpage only protect against passive attackers. It is not a good solution because: - It doesn't protect against active attacker (they can rewrite the url of the iframe. see sslstrip) - The browser can't display a padlock for https (because the main page is not secure) The only way to handle securely data is with https on ...


0

You're missing the concept of ASV. It is not about the tool, it is about the results. The goal for ASV's isn't to perform full blown extensive penetration tests, it is to look for common problems (known CVEs). The core of 11.2.2 (PCI) are: (copied from Qualys) Your documented PCI scope (cardholder dataenvironment) Your documented risk ranking process Your ...


3

I will take a different approach to this answer. Gowenfawr, and SilverlightFox provided excellent answers from the textbook/guideline perspective, so I will tackle answering your "John and Doe equate to personally identifiable information since there could be several thousand John Does" portion. Many portions of current PII laws, come from inference attacks. ...


5

I am attempting to ascertain the boundaries of personally identifiable information. That is a legal question, and varies by jurisdiction. Perhaps the best known is California: (a) The term “personally identifiable information” means individually identifiable information about an individual consumer collected online by the operator from that ...


1

From Wikipedia: [PII] is information that can be used on its own or with other information to identify, contact, or locate a single person, or to identify an individual in context. Therefore I'd agree with your premise of PII being defined as having enough information in order to uniquely identify someone. Under PCI-DSS everything is looked at in ...


2

I worked for a QSA company for 2 years, so here is one ex-assessor vision of your case. It is absolutely fine to use configuration management (CM) tools from the PCI DSS perspective. In short, to be OK with the standard compliance you must make this system PCI DSS compliant itself and align your configuration management and support processes with PCI DSS ...



Top 50 recent answers are included