750 reputation
312
bio website aerissecure.com
location Phoenix, AZ
age
visits member for 3 years, 10 months
seen Nov 17 at 18:08

Information security specialist, Python programmer, all things computer hobbyist.


Nov
13
answered PCI DSS - mask PAN and log individual access to PAN
Oct
25
comment Shared Database and PCI Compliance
Unfortunately, segmentation means isolation for PCI, i.e. no connectivity. Timee is right that the DB will be an issue. But since the shared DB is "in scope" but not "in the CDE" things that are connected to it are not brought into scope.
Oct
3
comment masking credit cards PAN with zeros
@Polynomial When an auditor does a scan of your systems and finds you're storing full card numbers, that will open up unnecessary discussions at the least. I think what Timee is trying to say is that if your masking function produces real card numbers, in a very small number of cases the input card equals the output card. That seems like a bad masking function at least and a non-compliant one at worst.
Sep
24
awarded  Autobiographer
Aug
1
comment Using a Public-Key-Encryption browser side to avoid PCI compliance
Up vote for Braintree!
Jun
24
comment Minimum requrements for storing last 4 digits of credit card number?
@AndreyBotalov, PCI only applies if you are the one doing the truncation, i.e. you receive full numbers and then discard a portion of them. PCI Applies if you store/process/transmit, so it is applicable because you are transmitting, not because you are storing the last 4. The last 4 is not cardholder data.
Jun
12
comment How to store credit card information for repeated transactions and still be PCI compliant?
The web server can absolutely be in scope, it is entirely dependent on the implementation. See the official guidance: pcissc.secure.force.com/faq/articles/Frequently_Asked_Question/…
Apr
14
awarded  Editor
Apr
14
revised Heartbleed: OpenSSL v 0.9.8o and OpenVPN v 2.1.3 Reporting Vulnerable
added 84 characters in body
Apr
14
comment Heartbleed: OpenSSL v 0.9.8o and OpenVPN v 2.1.3 Reporting Vulnerable
Of the tools you listed, I would trust Qualys SSL Labs or the python PoC. Qualys because of their reputation and incentives and the python PoC because of its auditability.
Apr
14
answered Heartbleed: OpenSSL v 0.9.8o and OpenVPN v 2.1.3 Reporting Vulnerable
Mar
29
awarded  Nice Question
Mar
25
awarded  Commentator
Mar
25
comment Risk management with software code analysis
PCI doesn't endorse or require the use of any specific tools and as such, has no list. If you are using a tool to help you meet section 6, you will want to compare the capabilities of the tool against the list of vulnerabilities you need to be mitigating according to PCI: requirements 6.5.1-6.5.10. These include injection flaws, buffer overflow, insecure cryptographic storage, insecure communications, insecure error handling, and all of the typical web application vulnerabilities (if applicable).
Feb
22
answered Risk management with software code analysis
Feb
5
comment PCI DSS - only one primary function per server
+1 for discussing how the requirement can be negotiable. There is definitely a sliding scale. Functions that listen on the network should be closely evaluated.
Jan
21
awarded  Yearling
Nov
27
comment PCI Compliance Distibution
The versions reported by the backports are definitely the issue. Trustwave should have some method for disputing false positive vulnerabilities by supplying evidence. The same evidence will apply for all future scans so while the process can be annoying and time consuming, it should be straight forward.
Feb
6
answered PCI-DSS for VX570 and POS on same network
Jan
30
answered What should I have prepared for a PCI compliance onsite assessment?