790 reputation
312
bio website aerissecure.com
location Phoenix, AZ
age
visits member for 4 years, 4 months
seen May 18 at 3:35

Information security specialist, Python programmer, all things computer hobbyist.


May
5
comment What is the difference between SSL vs SSH? Which is more secure?
@jpillora I merely meant that I don't think the SSH transport layer protocol is what most people would mean given the phrasing of the question. However, given the answer that was accepted as correct, it must have been what OP was asking.
May
4
comment What is the difference between SSL vs SSH? Which is more secure?
+1 @jpillora while I agree it does make sense to compare the two, the term SSH is not typically used to refer to the subset of the SSH protocol that handles transport layer security that would be directly comparable to SSL/TLS. It is almost exclusively used in reference to the application layer protocol which differs from SSL/TLS in the manner described in this answer.
May
4
comment How valid is this statement “SSL sit between application layer and network layer”
TLS stands for Transport Layer Security. In the OSI model this layer is responsible for end-to-end connections and reliability and is between application and network layers.
Jan
21
comment Whats the difference between MAC vs hash
As you mentioned, a hash function can form the basis for a MAC. Block ciphers are the other building block of MACs and are called a CBC-MAC. The blocker cipher used in these functions can differ between implementations--DES, AES, etc.
Jan
6
comment Can Amazon's AWS Identity and Access Management (IAM) be used to manage server access?
A default SSH key doesn't necessarily violate PCI DSS as long as the key is assigned to a specific user and only that user has the corresponding private key.
Nov
13
answered PCI DSS - mask PAN and log individual access to PAN
Oct
25
comment Shared Database and PCI Compliance
Unfortunately, segmentation means isolation for PCI, i.e. no connectivity. Timee is right that the DB will be an issue. But since the shared DB is "in scope" but not "in the CDE" things that are connected to it are not brought into scope.
Oct
3
comment masking credit cards PAN with zeros
@Polynomial When an auditor does a scan of your systems and finds you're storing full card numbers, that will open up unnecessary discussions at the least. I think what Timee is trying to say is that if your masking function produces real card numbers, in a very small number of cases the input card equals the output card. That seems like a bad masking function at least and a non-compliant one at worst.
Sep
24
awarded  Autobiographer
Aug
1
comment Using a Public-Key-Encryption browser side to avoid PCI compliance
Up vote for Braintree!
Jun
24
comment Minimum requrements for storing last 4 digits of credit card number?
@AndreyBotalov, PCI only applies if you are the one doing the truncation, i.e. you receive full numbers and then discard a portion of them. PCI Applies if you store/process/transmit, so it is applicable because you are transmitting, not because you are storing the last 4. The last 4 is not cardholder data.
Jun
12
comment How to store credit card information for repeated transactions and still be PCI compliant?
The web server can absolutely be in scope, it is entirely dependent on the implementation. See the official guidance: pcissc.secure.force.com/faq/articles/Frequently_Asked_Question/…
Apr
14
awarded  Editor
Apr
14
revised Heartbleed: OpenSSL v 0.9.8o and OpenVPN v 2.1.3 Reporting Vulnerable
added 84 characters in body
Apr
14
comment Heartbleed: OpenSSL v 0.9.8o and OpenVPN v 2.1.3 Reporting Vulnerable
Of the tools you listed, I would trust Qualys SSL Labs or the python PoC. Qualys because of their reputation and incentives and the python PoC because of its auditability.
Apr
14
answered Heartbleed: OpenSSL v 0.9.8o and OpenVPN v 2.1.3 Reporting Vulnerable
Mar
29
awarded  Nice Question
Mar
25
awarded  Commentator
Mar
25
comment Risk management with software code analysis
PCI doesn't endorse or require the use of any specific tools and as such, has no list. If you are using a tool to help you meet section 6, you will want to compare the capabilities of the tool against the list of vulnerabilities you need to be mitigating according to PCI: requirements 6.5.1-6.5.10. These include injection flaws, buffer overflow, insecure cryptographic storage, insecure communications, insecure error handling, and all of the typical web application vulnerabilities (if applicable).
Feb
22
answered Risk management with software code analysis