Questions tagged [compliance]
Aspects of compliance with regulations, standards, laws, and policies.
244
questions
2
votes
1answer
63 views
What are the FEDRAMP “complementary controls”?
Quoting the FedRAMP official FAQ:
FedRAMP requirements include additional controls above the standard NIST baseline controls in NIST SP 800-53 Revision 4. These additional controls address the ...
0
votes
0answers
42 views
Can a PKCS12 keystore be FIPS compliant?
Is it possible to generate a PKCS12 keystore that will be FIPS compliant? In regular mode, I'm using "1.2.840.113549.1.12.1.3" - pbeWithSHAAnd3-KeyTripleDES-CBC(3) algorithm to encrypt private keys, ...
0
votes
0answers
52 views
Returning Social Security Number After Validation Checks on Web Based Form
I have a web based application form that is used to gather personal information for web based users. One of the fields is an SSN. My question is simple, in terms of security compliance (in general, ...
2
votes
2answers
123 views
User passwords printed on paperwork at a dental office?
My dental office just printed my user-defined password (not a first or one-time password) to their portal on some checkout paperwork.
I asked on Law.stackexchange and it doesn't sound like this is a ...
2
votes
1answer
76 views
Where to start preparing for SOC 2 type 2?
We are a small US-based startup with most of the employees working remotely from other countries (less than 10 people in total) and currently are building a SaaS web platform for banks (everything is ...
1
vote
1answer
111 views
Active Directory GDPR classification
GDPR classifies data into Non-personal, Personal and Sensitive personal. Sensitive personal is further broken down to Genetic and biometric, Racial and ethnical, Religion and Philosophical etc.
...
1
vote
1answer
100 views
How does a merger formally impact an ISO 27001 certification?
Organization A has a service that is ISO 27001 certified. It is acquired by Organization B which does not have any certification.
What are the formal impacts of the acquisition on the ISO 27001 ...
0
votes
1answer
51 views
If one user sees an email of another user, is it DSGVO conform?
I want to give a logged in user the ability to search for other users by their exact email. The search input is passed asynchronously by Javascript so the email would remain in server logs and so on. ...
3
votes
2answers
93 views
Is SQL auth over windows auth a red flag?
I'm working on something where using windows authentication to SQL server is difficult if not impossible. My team member is adamant that using SQL auth is much more difficult to manage and is a major ...
1
vote
0answers
58 views
Is there a PCI Requirement for shuffling digits while accepting PIN?
The following image shows a PIN entry device which shuffles the digits.
. via twitter
I've seen this question, but it doesn't cover why companies are still doing this.
I looked at the POS PIN Entry ...
0
votes
0answers
74 views
CIS 2.3.4.1 (L1) Ensure 'Devices: Allowed to format and eject removable media' is set to 'Administrators and Interactive Users'
I am implementing CIS on Windows 10 1803 and I cannot work out this control.
Description:
This policy setting determines who is allowed to format and eject removable NTFS media. You can use this ...
7
votes
1answer
120 views
Which self assessment questionairre should I use for PCI DSS compliance
My system is passed card data securely over HTTPS from an upstream system. The upstream system captures information via telephone input. This telephone input is sent to us, to invoke payments via ...
0
votes
1answer
122 views
Email under GDPR [closed]
I am aware that email is considered as PII and should be used and stored under strict security guidelines as per GDPR. If we use email in any our communications and in what cases it might not be ...
0
votes
0answers
26 views
Personal file separation in office workstation
Background:
The company I work for is SOC2 and some other Compliant. So to comply with that regulatory compliance they asked us to install SolarWinds RMM agent in our workstations (Not production ...
2
votes
1answer
45 views
Personal Information / Compliance in SaaS for US-based customers
What compliance issues should any B2B SaaS provider worry about when saving user information to its databases such as Name, DOB, Gender, Emergency Contact Information (Name, Phone, Address), etc.
...
5
votes
1answer
80 views
does the SOC 2 audit specification require credentialing?
If we need to present a SOC 2 audit report to a 3rd party, can we just hire some guy to conduct a review of our software and processes specified by our guidance, or use an internal resource, or does ...
3
votes
1answer
296 views
PCI DSS minimum password strength equivalent in passphrase
The PCI DSS requirement 8.2.3 says:
Passwords/passphrases must meet the following:
Require a minimum length of at least seven characters.
Contain both numeric and alphabetic characters.
...
4
votes
3answers
315 views
What level of compliance do I need as a software vendor?
I am having a bit a difficult time trying to assess to what level my business needs to be PCI compliant.
My business is developing eCommerce websites that are hosted by the client. The websites have ...
0
votes
0answers
106 views
Is sFTP as a technology acceptable in FedRAMP compliant projects?
I seem to recall that there was some problem with using sFTP in some government environments, but now I need to know if it poses a risk on a FedRAMP-compliant project.
0
votes
0answers
47 views
IBM warns to move data out of insecure encryption schemes, but where to? [duplicate]
I'm currently using GnuPG (RSA 4096), Encryption-based DLP, SSL, SSL-VPN, Password Manager and other apps considered insecure by the IBM research team, who favor Lattice encryption over the standard ...
0
votes
0answers
47 views
HIPAA : Writing Policies and Process For Workstation Surroundings
I am writing policies that the company will follow and I am going through the HIPAA compliance check list as a guide. I am trying to make sense of this item though. To me a lot of these seem vague and ...
0
votes
1answer
276 views
Signing and timestamping implementation
I am writing a software that records and stores data files.
I want to digitally sign and time stamp these files so that I can assure that it's Contemporaneous and Attributable (to comply with 21 CFR ...
-3
votes
2answers
530 views
Is PCI compliance required by law?
Is PCI compliance required by law?
We are creating a website where we will accept customer card data and pass it to merchant API.
Everywhere on the internet you will find PCI is required. But what ...
1
vote
0answers
103 views
Building upon SOC 2 Compliance of hosting provider
We are looking at becoming SOC 2 compliant and I was curious if it is possible to leverage the compliance of a hosting provider as part of our attestation? More specifically, our product is fully ...
3
votes
1answer
1k views
How to use CIS Benchmarks without being a CIS member
I am trying to audit my Linux systems with the CIS security benchmarks. There are OS tools like OpenSCAP or Lynis that can do security-related benchmarks, and come with some benchmarks which might be ...
3
votes
1answer
95 views
SOX Compliance - Is Running EOL Equipment Considered a Violation?
Let's say I have some networking equipment that will no longer receive vulnerability patches after 2019.
This equipment makes up the spine of the company infrastructure.
Let's say it's definitely ...
3
votes
2answers
394 views
How do I measure compliance to Information security policies?
I work in an organisation with 3 levels as far as information security is concerned. I'm sitting at level two where we develop policies and also assist with the standards. One of the most difficult ...
1
vote
2answers
88 views
Storing customer data securely (compliance)
I came a cross this data breach where developers of an organization stored some customer PII data on their github account. Common sense tells me that this is obviously stupid and careless thing to do.
...
0
votes
1answer
63 views
HIPAA non-business associate for contract work
I have been asked by the sole owner/employee of a blood testing business to make her a web site. This web site would simply be used to schedule appointments for her patients. For this reason ...
122
votes
19answers
37k views
Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?
I work at a company with a staff of about 1000+. We currently have programming development staff that work on web based projects (approx 50 people).
Recently due to security concerns our IT and ...
1
vote
0answers
26 views
OpenVPN Invalid Logins lock with PAM
We are getting dinged on a federal audit because OpenVPN does not appear to support invalid login restrictions (i.e., only 3 before the account is locked).
Has anyone else experienced this? We are ...
0
votes
1answer
114 views
Is Aria2 downloads detectable by web servers?
A couple of months ago I signed up for a paid online course. Their terms of service indicate that these video lectures are for streamed viewing and not to be downloaded. There's a 2 hour commute from ...
0
votes
0answers
53 views
SQL RLS for NIST compliance
Is there specific NIST documentation advising about implementing MS SQL Row-Level security for 800-53 compliance?
1
vote
1answer
310 views
Will Enabling TLS 1.2 and disabling older protocols on Windows Servers have any impact on desktops?
I want to know what the impact would be if I were to enable TLS 1.2 on Windows Servers and disabled older protocols. I enabled TLS 1.2 on my Windows 7 Laptop manually running the Microsoft Fix It ...
6
votes
3answers
351 views
If I'm PCI-DSS compliant, do I need to worry about GDPR?
Next month, the EU's General Data Protection Regulation (GDPR) takes effect.
Our organization is already PCI-DSS compliant.
Do we need to do anything additional to make sure we are consistent with ...
2
votes
2answers
110 views
Any frameworks that outline the requirement or recommendation of a Security Operations Center?
We can all agree it's best practice to implement a SOC within an organization, but are there any frameworks or compliance requirements that specifically call it out?
0
votes
1answer
110 views
How to run FCS_TLSS tests of for common criteria evaluation? [closed]
So we are working on making a product of one of our clients common criteria compliant. We are using tls-cc-tools for running FCS_TLSC tests but we are unable to run FCS_TLSS_EXT.1.1 test 5. Please ...
19
votes
4answers
6k views
The non-compliance of the EU cookie law as a finding in a penetration test report?
I recently noticed a penetration test report wherein the non-compliance of the European Union (EU) cookie law was stated as a finding under an "other" category. I consider this more of a legal, ...
6
votes
1answer
249 views
Are there regulations that govern how social security numbers are stored and viewed?
I'm working for a client that keeps records of social security numbers in their databases, numbers pulled from screenings and automatically captured from companies and other financial data. A few ...
6
votes
2answers
228 views
How Should a Midsized Startup Approach Information Security and Compliance?
The situation:
An established SaaS startup with <100 employees, a large development team and several self taught networks engineers. Our business involves handling both PII and payment data.
As we'...
2
votes
3answers
178 views
PCI Compliance question from a merchant
I'm a new business that conducts online auctions for estate sales. When searching for software to use, I had no idea about PCI Compliance. My merchant account told me it was easy. It would be if the ...
1
vote
2answers
80 views
Developers VS HIPAA
I am trying to bring a company up to HIPAA standards and help them secure their customer health information. A question that sometimes comes up is that developers want to take databases of customer's ...
4
votes
2answers
875 views
PIN delivery: do PCI DSS requirements prevent sending the PIN to an end-user's mobile phone?
Do PCI DSS requirements prevent processors from sending to endusers' mobile phones the PIN?
I went through many PCI documents, such as the PCI security requirements 2.0 and this isn't mentioned. I'm ...
1
vote
1answer
52 views
Do cloud service providers offer insights on their security issues?
Should someone want a highly secured cloud environment, having the whole infrastructure managed by a third party could be quite stressful I guess.
There are things you can't manage yourself in a ...
1
vote
2answers
763 views
How to timestamp a document without electronic signature under eIDAS
I need to timestamp a file to prove data integrity, not authorship. I will use a RFC3161 qualified timestamping service.
From the EU Regulation Section 6, Article 41, I understand that I can use a ...
0
votes
1answer
262 views
Good book on PCI DSS? [closed]
I need to upgrade my skills on PCI DSS Compliance. I'm looking for a couple of combo: one to cover everything in an extensive way (a sort on encyclopedia to keep as a reference) and a quick guide to ...
6
votes
3answers
794 views
How to handle personally identifiable information (PII) as a startup?
My startup is finally faced with the potential responsibility of handling PII, and we're concerned with doing it properly from a risk perspective but also so that we're doing this correctly.
What ...
1
vote
1answer
337 views
Required security for storing bank transactions, but not credentials
If I'm using an external bank data aggregation service to get user credit and banking transactions, but the external service itself is handling the process of collecting and managing banking ...
0
votes
1answer
597 views
Requirments for a PCI Compliant Sales Receipts
I work with a software development company and we have a client that is asking us to change the coding in our software that allows for the signers name to print on the customers receipt. They are ...
4
votes
2answers
116 views
Can an HTML-based patient report be HIPAA-compiliant?
Assume I am creating an application that generates a report of health recommendations based on input patient diagnostics.
My application receives no identifying information about the patient. It ...
