720 reputation
311
bio website aerissecure.com
location Phoenix, AZ
age
visits member for 3 years, 6 months
seen 14 mins ago

Information security specialist, Python programmer, all things computer hobbyist.


Jun
24
comment Minimum requrements for storing last 4 digits of credit card number?
@AndreyBotalov, PCI only applies if you are the one doing the truncation, i.e. you receive full numbers and then discard a portion of them. PCI Applies if you store/process/transmit, so it is applicable because you are transmitting, not because you are storing the last 4. The last 4 is not cardholder data.
Jun
12
comment How to store credit card information for repeated transactions and still be PCI compliant?
The web server can absolutely be in scope, it is entirely dependent on the implementation. See the official guidance: pcissc.secure.force.com/faq/articles/Frequently_Asked_Question/…
Apr
14
awarded  Editor
Apr
14
revised Heartbleed: OpenSSL v 0.9.8o and OpenVPN v 2.1.3 Reporting Vulnerable
added 84 characters in body
Apr
14
comment Heartbleed: OpenSSL v 0.9.8o and OpenVPN v 2.1.3 Reporting Vulnerable
Of the tools you listed, I would trust Qualys SSL Labs or the python PoC. Qualys because of their reputation and incentives and the python PoC because of its auditability.
Apr
14
answered Heartbleed: OpenSSL v 0.9.8o and OpenVPN v 2.1.3 Reporting Vulnerable
Mar
29
awarded  Nice Question
Mar
25
awarded  Commentator
Mar
25
comment Risk management with software code analysis
PCI doesn't endorse or require the use of any specific tools and as such, has no list. If you are using a tool to help you meet section 6, you will want to compare the capabilities of the tool against the list of vulnerabilities you need to be mitigating according to PCI: requirements 6.5.1-6.5.10. These include injection flaws, buffer overflow, insecure cryptographic storage, insecure communications, insecure error handling, and all of the typical web application vulnerabilities (if applicable).
Feb
22
answered Risk management with software code analysis
Feb
5
comment PCI DSS - only one primary function per server
+1 for discussing how the requirement can be negotiable. There is definitely a sliding scale. Functions that listen on the network should be closely evaluated.
Jan
21
awarded  Yearling
Nov
27
comment PCI Compliance Distibution
The versions reported by the backports are definitely the issue. Trustwave should have some method for disputing false positive vulnerabilities by supplying evidence. The same evidence will apply for all future scans so while the process can be annoying and time consuming, it should be straight forward.
Feb
6
answered PCI-DSS for VX570 and POS on same network
Jan
30
answered What should I have prepared for a PCI compliance onsite assessment?
Jan
21
awarded  Yearling
Dec
15
answered Precedent for an in-house cardholder information server?
Sep
21
answered PCI Policy Management software?
Sep
17
awarded  Nice Answer
Sep
10
answered Which PCI DSS SAQ applies when you don't store store but transmit CHD?