13,944 reputation
22950
bio website
location
age
visits member for 3 years, 3 months
seen 8 hours ago

Security, Unix, and Networking jack-of-all-trades, master-of-some.


8h
awarded  Nice Answer
8h
revised Is it fundamentally possible to validate that an unmodified version of your client connects to your server?
The 'Yes' had the opposite effect intended when compared to question.
14h
answered Is it fundamentally possible to validate that an unmodified version of your client connects to your server?
21h
comment What stops a developer from accessing credit card details and other secret data from a company
@PeriataBreatta, no, but for a business that develops their own software for card processing purposes, it might be. That's a very small minority of DSS businesses! Bear in mind that the PCI DSS scales from the most minor merchant to the largest payment processor - you may want to see how the various SAQs fine-tune it's impact on differently organized businesses.
1d
awarded  Nice Answer
1d
comment What stops a developer from accessing credit card details and other secret data from a company
It's very difficult to do on a shoestring operation, because the key ingredient is separation - separation of duties, separation of access, separation of oversight. And a startup doesn't have the bodies to spare for separation. If your concern is other people impersonating you, consider enhanced authentication - 2-factor with time-based tokens, for example, they're unlikely to steal your laptop and your fob/phone and your PIN.
1d
revised What stops a developer from accessing credit card details and other secret data from a company
Expanded in response to comment feedback
1d
answered What stops a developer from accessing credit card details and other secret data from a company
1d
comment How safe is it to use older/unknown Encryption methods for plaintext?
No, it's not safe. See this example.
2d
reviewed Leave Open Will an ISP give out network/traffic info upon request?
2d
reviewed Leave Open Tools to check the firewall Configurations as per PCI standards
2d
reviewed Leave Open Clarification on the -h Flag for Makecert.exe
2d
reviewed Leave Open PCI prohibit direct outbound connections on EC2
2d
reviewed Leave Open How does https check md5, sha-1 and sha-2 fingerprints?
2d
answered Tools to check the firewall Configurations as per PCI standards
2d
comment PCI - prohibiting direct connections to the Cardholder Data Environment
I'm actually talking about a part of the DSS specification itself, not a supporting document - I've clarified the answer and added links.
2d
revised PCI - prohibiting direct connections to the Cardholder Data Environment
Updated to clarify provenance
Oct
29
answered PCI - prohibiting direct connections to the Cardholder Data Environment
Oct
28
comment ISPs are now adding unique header identifiers to web traffic. Can this be avoided? If so, how?
I wonder if their solution is smart enough to strip out any existing PrecisionID headers before inserting their own...
Oct
27
reviewed Close WireShark only showing broadcast packets