700 reputation
311
bio website aerissecure.com
location Phoenix, AZ
age
visits member for 3 years, 3 months
seen 2 days ago

Information security specialist, Python programmer, all things computer hobbyist.


Apr
14
awarded  Editor
Apr
14
revised Heartbleed: OpenSSL v 0.9.8o and OpenVPN v 2.1.3 Reporting Vulnerable
added 84 characters in body
Apr
14
comment Heartbleed: OpenSSL v 0.9.8o and OpenVPN v 2.1.3 Reporting Vulnerable
Of the tools you listed, I would trust Qualys SSL Labs or the python PoC. Qualys because of their reputation and incentives and the python PoC because of its auditability.
Apr
14
answered Heartbleed: OpenSSL v 0.9.8o and OpenVPN v 2.1.3 Reporting Vulnerable
Mar
29
awarded  Nice Question
Mar
25
awarded  Commentator
Mar
25
comment Risk management with software code analysis
PCI doesn't endorse or require the use of any specific tools and as such, has no list. If you are using a tool to help you meet section 6, you will want to compare the capabilities of the tool against the list of vulnerabilities you need to be mitigating according to PCI: requirements 6.5.1-6.5.10. These include injection flaws, buffer overflow, insecure cryptographic storage, insecure communications, insecure error handling, and all of the typical web application vulnerabilities (if applicable).
Feb
22
answered Risk management with software code analysis
Feb
5
comment PCI DSS - only one primary function per server
+1 for discussing how the requirement can be negotiable. There is definitely a sliding scale. Functions that listen on the network should be closely evaluated.
Jan
21
awarded  Yearling
Nov
27
comment PCI Compliance Distibution
The versions reported by the backports are definitely the issue. Trustwave should have some method for disputing false positive vulnerabilities by supplying evidence. The same evidence will apply for all future scans so while the process can be annoying and time consuming, it should be straight forward.
Feb
6
answered PCI-DSS for VX570 and POS on same network
Jan
30
answered What should I have prepared for a PCI compliance onsite assessment?
Jan
21
awarded  Yearling
Dec
15
answered Precedent for an in-house cardholder information server?
Sep
21
answered PCI Policy Management software?
Sep
17
awarded  Nice Answer
Sep
10
answered Which PCI DSS SAQ applies when you don't store store but transmit CHD?
Sep
7
comment Minimum requrements for storing last 4 digits of credit card number?
@AndreyBotalov Req 3.3 governs how much of a PAN you can display if you are storing the whole thing. You can freely display the portions that aren't sensitive (first six, last four) just as you can store the parts that aren't sensitive without being required to meet the DSS requirements.
Sep
7
answered Minimum requrements for storing last 4 digits of credit card number?