88 reputation
7
bio website
location
age
visits member for 1 year, 4 months
seen Mar 23 '13 at 8:28

Dec
21
awarded  Benefactor
Dec
19
awarded  Scholar
Dec
19
accepted PCI compliance can prevent fines?
Dec
18
comment Key management scheme in PHP that is compliant with NIST SP 800-57
We emailed townsendsecurity but havent heard back from them yet. Can you give an idea how much does a key manager cost/m or annually?
Dec
18
comment PCI compliance can prevent fines?
I'd love to use Stripe, but their fee structure is not suitable for micropayments, which is deal breakers for us. As for taking responsibility to make sure data is safe, looks like I haven't been able to express myself clearly probably because english is not my primary lang.. what I mean even if do our best but there are still chances that maybe some internal person (datacenter guys, developer etc..) gets the master key file somehow. not likely but still possible, I'm just afraid of that.
Dec
18
awarded  Commentator
Dec
17
comment PCI compliance can prevent fines?
Whoops, just read your bio and now I feel stupid to have asked for an authoritative reference. :) But still, a PCI compliance still paying fines doesn't make sense at all.
Dec
17
comment PCI compliance can prevent fines?
Using a payment service provider is the easiest but not always the best solution. We have to store cards for a reason otherwise we wouldn't be spending time and money on this PCI mess. Not sure about others but assuming we do put in appropriate controls and are rightly PCI compliant, it would be ridiculous to still pay fines! Or are you implying that if someone is PCI compliant, that means there is absolutely NO WAY they could their security could be compromised and Sony wasn't PCI compliant?
Dec
17
awarded  Editor
Dec
17
revised PCI compliance can prevent fines?
added 10 characters in body
Dec
17
comment PCI compliance can prevent fines?
Thats exactly what we're trying to do, but as I said, if companies like Sony with all their money, resources and expertise still can't prevent such incidents, there is a chance no matter how small that we could also be hacked. Anyhow, it seems really unfair that you spend so much time effort and money on PCI compliance and you'd still be fined if you get hacked! Would like to see an authoritative reference if possible? I couldn't find anything on the PCI website.
Dec
17
comment PCI compliance can prevent fines?
Ok, but still I wanted to know the general rule. I always wondered why the companies were fined millions although they were (I assume) PCI compliant. btw, our company is US based.
Dec
17
comment Key management scheme in PHP that is compliant with NIST SP 800-57
Thanks for the answer. Are you saying that NIST is more of a policy and organizational based, rather than technology based specification? The specification does reference AES, and phpAES is FIPS 197 compliant. It also says that "The approved algorithms for encryption/decryption are symmetric key algorithms: AES and TDEA". So, AES sounds like an acceptable cipher for this specification.
Dec
17
asked PCI compliance can prevent fines?
Dec
16
comment Key Management for PCI and Payment automation
Ah, I just let out a biggest sigh! :) So what if we didn't store the keys at all and just manually entered them on application startup? btw, some authoritative reference if possible would be great.
Dec
15
asked Key Management for PCI and Payment automation
Dec
15
awarded  Promoter
Dec
10
awarded  Student
Dec
10
asked Key management scheme in PHP that is compliant with NIST SP 800-57
Dec
10
comment How does Amazon bill me without the CVC / CVV / CVV2?
Not true, rate is the same wether or not you provide the CVV, braintree recently confirmed that.