1,815 reputation
923
bio website cfcausa.org
location Kansas City
age 30
visits member for 3 years, 1 month
seen 7 hours ago

Systems Security Engineer for Unbound, a non profit organization.

Want to help someone living in poverty? Check us out at www.unbound.org.

Want to get linkedin?


Jul
21
comment Using Free AV to meet PCI Requirement 5
@schroeder precisely my thought. :)
Jul
2
comment Industry average for security as a percentage of product budget?
The range is from 0-100%, depending on industry being sold to and the nature of the product. You are going to need a lot more detail if you want a more detailed response.
Jun
27
comment How to safely show some text on a webpage?
@AndrewHoffman true but that doesn't cover getting your authentication securely to the server... If someone gets your authentication token you now have someone else with access. I suppose I could have clarified that a bit.
Jun
12
comment How to store credit card information for repeated transactions and still be PCI compliant?
@Timee's disclaimer is just plain wrong. If the cardholder information isn't in RAM at some point it wasn't transmitted to the server in question. If a server doesn't transmit, store or process cardholder data it isn't in scope.
Jun
6
comment How to store credit card information for repeated transactions and still be PCI compliant?
@Ivan - a lot of businesses aren't interested until they see how stiff the peanalties are. See edit.
Jun
6
comment How to store credit card information for repeated transactions and still be PCI compliant?
@JulianKnight - true. We use a method very similar in house. I didn't want to confuse the matter with the 'they' possibly being a dedicated team in the office.. That's a whole ball of wax on its own.
Jun
6
comment Is there more risk in changing administrator password locally vs from a centralized location?
@longneck - it doesn't meet all my requirements.
May
19
comment Attacks to jump from SQL server to Web server, without direct network access?
Great input. I was thinking some kind of memory based attack against the app server. A client side attack against an admin user is a vector I had not considered.
Sep
5
comment Do we need to use separate IP ?
I hate to disagree but there are a lot of 'firewalls' that actually have level 7 inspection capability, especially for HTTPS. If that's the case and and the decrypted cardholder data is in memory the firewall is in scope. That is an easy point for folks to get confused on and it took a couple reads to get that from your post.
Aug
23
comment Encryption key exchange for Tor
@Adnan not the circuit building so much - the post I linked to does a good job with that - but some additional details on how the key exchange process works would be much appreciated.
Aug
20
comment Encryption key exchange for Tor
@DeerHunter thanks. I typed that up on my mobile.
Aug
6
comment Pre / post disk encryption wipe?
Thanks. This is helpful. I still don't see the difference about the wiping tool even if confidential data is already present. Once the data is encrypted and rewritten by the in place tool it's no longer free space. The OS knows this. Overwriting all the free space should still result in the entire drive being encrypted. Right?
Aug
5
comment Pre / post disk encryption wipe?
@enigma I came across that dame post before I asked. No answer. :)
Jul
8
comment How to detect eavesdropping by your ISP
That is just plain wrong.
Jun
14
comment Dual control / key encrypting key required?
@apsillers - that is a genius way of looking at it.
May
12
comment User Account Control and outside processes
@WChargin - correct
May
6
comment What does having an internal two-tier PKI protect against?
@MDMarra - even an online responder needs a source for the OCSP data. Once compromised you can't expect the online ca to provide it. Unless I'm mistaken that also needs to come from the offline CA being higher up the hierarchy.
Mar
22
comment How would you detect whether customer data has been leaked?
@D.W. - I saw a three year term for one of the vendors I looked at. Thought about actually marketing doing this as a support feature with a 1, 2, or 3 year term.
Mar
6
comment Normalizing Windows Advanced Firewall rules
The rules are based on security groups in Active Directory, not subnets. There isn't a way for a given IP (windows and joined to our domain or otherwise) to get access without successful authentication (by being a member of the approved group in AD).
Mar
5
comment Normalizing Windows Advanced Firewall rules
Once segmented only Windows systems would be part of the cardholder environment. By using Windows Advanced Firewall + IPSEC it isn't possible for non authenticated systems (my Linux and OSX boxes included) to access the cardholder environment.