Tag Info

My experience with Palo Alto is limited so please take what I say with a grain of salt (and I'm sure people here can correct me as necessary)... Palo Alto is a completely different firewall paradigm than Check Point, Juniper, or almost any other firewall. A traditional firewall defines traffic flow based on source IP, destination IP, and port (or IP ...

I'd say that the PCI compliance aspect is going to complicate things more than a little bit and that you should really speak to your QSA about requirements. Whilst I'm not a QSA it would seem to me that if you backup card data then that backup service would effectively become part of your cardholder data environment. Apart from that one thing I always look ...

In no particular order and off the top of my head: Single vendor: easier and faster relationships (usually) better integration of different products, provided they're not rebranded kits simpler to "pass the buck" if products A and B don't see eye to eye - they're both the same vendor's responsibility. Multiple vendors: less risk of vendor lock-in more ...

This may sound a bit of a cop-out, but at the end of the day it is down to what assurances you need from the provider so you should ask both of them the same questions - and these should be specifically on what you need to feel confidence that using the provider doesn't expose you to more risk than you can accept. Have a look at this question about EC2 ...

Let me state up front, that I am a partner of Palo Alto Networks as well as Check Point and Juniper. Over the years we have had a lot of success with all three manufacturers. Palo Alto Networks has built a network security device that is technically different from everything else on the market. If you clear away the marketing BS, there is no denying it. My ...

Trying to cut the code review up into multiple pieces suffers from two problems. The first is the infamous and ever present problem of enumerating badness, and the second is the overhead of recruiting and managing the remote freelancers. Going for an open ended review will avoid the issues of splitting it up, but you will need to take care ensuring that ...

While I don't have any experience hiring someone from a freelance site to do code reviews, thinking about the question I believe that you are really looking for someone who can just be another eye to catch some omission. Sounds like a 'duh moment I know. But, if what you are asking if you can slap something together then just get a secure code editor to ...

Summary: Go with a big bank with a good password policy. MFA is a huge plus, but I wouldn't go to a small bank ever. Unfortunately if you are in the US, MFA is not very prevalent in the banking industry (at least for large banks). If you can find it, I would look there. And if you find that in a big bank (top 10), please let me know. =) Having ...

If you want a secure account look at yourself not the bank. Banks rely on insurance to secure deposits, their security is there to keep the premiums low and the insurance will take care of anything that gets past. However if someone gets into your account via identity theft then the insurance will not cover the stolen funds. Therefore if you want a secure ...

One of the things I would look at is what the bank says about their security. That doesn't mean they are actually doing anything about it, but if they are talking about it at least they know it is important to their customers. I would research the security accreditations that the bank has, and the level of certification of its it staff if the information ...

I don't explicitly know the answer to your sourcing problem, but I do know a bit about the cards and their internals. That being said, I'm pretty sure GIS manufactures them. There are two classes of card internals: Discrete small pitch surface-mount components embedded inside the plastic. Custom chip-on-board encased in epoxy, again embedded in the ...

First if they claim to be PCI Compliant ask for the latest version of a filled out questionnaire and their current quarters scan results. Based on the depth of how they filled out the questionnaire you should have some understanding of how competant they are. Also press if they have external audits? Do they employ external companies to do manual pentests ...