Nimbuz

83 reputation

bio	website
	location
	age
visits	member for	5 months
	seen	Mar 23 at 8:28
stats	profile views	13

	83 reputation	bio	website		visits	member for	5 months
7 badges		location			seen	Mar 23 at 8:28

summary answers questions tags badges favorites bounties reputation activity

23 Actions

suggestions reviews revisions comments badges posts accepts all

Dec 21	awarded	Benefactor
Dec 19	awarded	Scholar
Dec 19	accepted	PCI compliance can prevent fines?
Dec 18	comment	Key management scheme in PHP that is compliant with NIST SP 800-57 We emailed townsendsecurity but havent heard back from them yet. Can you give an idea how much does a key manager cost/m or annually?
Dec 18	comment	PCI compliance can prevent fines? I'd love to use Stripe, but their fee structure is not suitable for micropayments, which is deal breakers for us. As for taking responsibility to make sure data is safe, looks like I haven't been able to express myself clearly probably because english is not my primary lang.. what I mean even if do our best but there are still chances that maybe some internal person (datacenter guys, developer etc..) gets the master key file somehow. not likely but still possible, I'm just afraid of that.
Dec 18	awarded	Commentator
Dec 17	comment	PCI compliance can prevent fines? Whoops, just read your bio and now I feel stupid to have asked for an authoritative reference. :) But still, a PCI compliance still paying fines doesn't make sense at all.
Dec 17	comment	PCI compliance can prevent fines? Using a payment service provider is the easiest but not always the best solution. We have to store cards for a reason otherwise we wouldn't be spending time and money on this PCI mess. Not sure about others but assuming we do put in appropriate controls and are rightly PCI compliant, it would be ridiculous to still pay fines! Or are you implying that if someone is PCI compliant, that means there is absolutely NO WAY they could their security could be compromised and Sony wasn't PCI compliant?
Dec 17	awarded	Editor
Dec 17	revised	PCI compliance can prevent fines? added 10 characters in body
Dec 17	comment	PCI compliance can prevent fines? Thats exactly what we're trying to do, but as I said, if companies like Sony with all their money, resources and expertise still can't prevent such incidents, there is a chance no matter how small that we could also be hacked. Anyhow, it seems really unfair that you spend so much time effort and money on PCI compliance and you'd still be fined if you get hacked! Would like to see an authoritative reference if possible? I couldn't find anything on the PCI website.
Dec 17	comment	PCI compliance can prevent fines? Ok, but still I wanted to know the general rule. I always wondered why the companies were fined millions although they were (I assume) PCI compliant. btw, our company is US based.
Dec 17	comment	Key management scheme in PHP that is compliant with NIST SP 800-57 Thanks for the answer. Are you saying that NIST is more of a policy and organizational based, rather than technology based specification? The specification does reference AES, and phpAES is FIPS 197 compliant. It also says that "The approved algorithms for encryption/decryption are symmetric key algorithms: AES and TDEA". So, AES sounds like an acceptable cipher for this specification.
Dec 17	asked	PCI compliance can prevent fines?
Dec 16	comment	Key Management for PCI and Payment automation Ah, I just let out a biggest sigh! :) So what if we didn't store the keys at all and just manually entered them on application startup? btw, some authoritative reference if possible would be great.
Dec 15	asked	Key Management for PCI and Payment automation
Dec 15	awarded	Promoter
Dec 10	awarded	Student
Dec 10	asked	Key management scheme in PHP that is compliant with NIST SP 800-57
Dec 10	comment	How does Amazon bill me wihout the CVC / CVV / CVV2? Not true, rate is the same wether or not you provide the CVV, braintree recently confirmed that.