2022 Developer Survey is open! Take survey.

Questions tagged [compliance]

Aspects of compliance with regulations, standards, laws, and policies.

Filter by
Sorted by
Tagged with
1 vote
0 answers
7 views

Projects similar to SCAP Security Guide

Are there any other projects similar to what SCAP Security Guide (SSG) is doing? Automated security policy compliance using Ansible playbooks and Bash scripts. I'm trying to put my systems in ...
user avatar
  • 11
2 votes
1 answer
72 views

Security requirements for small tax software business

I have a client who does payroll and taxes and is looking for a web app to easily communicate and transfer tax related documents for clients. I would assume that the IRS or someone would have some ...
user avatar
2 votes
3 answers
144 views

How to exclude my attack box from the security compliance audit

We have a tactical red team in-house. For the company compliance audit (SOC 2 and/or ISO 27001), we are forced to install the compliance check agent. With almost all the malware and hacking tools, how ...
user avatar
  • 29
-3 votes
1 answer
87 views

Is Windows 10 Insider Build usable within SOC 2 compliance? [closed]

Or Windows 11 pre-release, just cause I'm curious? (By employees if that wasn't implicit.)
user avatar
0 votes
3 answers
115 views

How do you monitor the security control compliance for third party providers? [closed]

I wonder what a small startup would typically do concerning third-party compliance? Are you expected to send third-party vendors a security questionnaire? Do you need to do that regularly?
user avatar
  • 101
1 vote
0 answers
89 views

How do we reconcile a requirement to keep backups, with a requirement that we be able to purge data on request? [closed]

As part of SOC 2 preparation (and just general operational best-practice) we take regular PostgreSQL backups and keep them for up to a year. One of our partners has a requirement that we be able to ...
user avatar
0 votes
1 answer
97 views

Do the organisational policies need to have ownership to ensure accountability?

Policies are the high-level statement from Senior Management. It's a philosophy for the management to be guided by, and management has the direction to plan, build, run and monitor the activities to ...
user avatar
1 vote
0 answers
154 views

You are in charge of the security of a very small company. What steps would you follow to achieve a good security level? [closed]

first of all, I would like to admit that I belong to the offensive side of security (Penetration Testing) and this is not my common area of expertise. Last week I was thinking about how the market ...
user avatar
  • 540
0 votes
0 answers
95 views

SCAP Implementation In Industrial Setting

I work in an industry that uses manufacturing equipment that typically run on Windows or unix-like OS. An industry body is developing security standards and plans to require the use of Security ...
user avatar
  • 1
1 vote
0 answers
77 views

Get original text of Common Criteria protection profile [closed]

In translated from an English profile, combined from a couple of profiles (I found that one is Protection Profile for Application Software v1.2 of NIAP) I have something like "TOE security ...
user avatar
0 votes
1 answer
74 views

What is the NIST/FIPS publication process? How long does it usually take for drafts to become final?

I'm specifically concerned with EdDSA being made FIPS compliant, which I realize might take longer with the concerns raised with ECDSA, but I'm curious what the process actually is. Is it all internal ...
user avatar
1 vote
0 answers
75 views

Security Team and Security in a small-medium organization/startup [closed]

How should one structure and how should a Security Team work in an agile organization (100 devs). Found this article: https://kislayverma.com/organizations/independence-autonomy-and-too-many-small-...
user avatar
  • 937
0 votes
1 answer
112 views

Software update process (dependencies) in organization

Wondering how other organizations manage software update process. We are a startup, were we try to define components owners, which should update them (security updates etc). This does not to seem to ...
user avatar
  • 937
1 vote
2 answers
496 views

HIPAA data encryption - Is database level encryption is enough?

If the database has a built in encryption possible such as Azure SQL Server's, Transparent Data Encryption (TDE) would this be enough for getting the HIPAA compliance ? Or even before storing any data ...
user avatar
2 votes
1 answer
141 views

Does OWASP's top 10 list cover the majority of potential web application vulnerabilities?

I ask this question because there is a common compliance argument that performing an "OWASP Top 10" scan provides enough coverage to consider it an "in-depth" scan. Is this the case, or are ...
user avatar
9 votes
8 answers
7k views

Can a large corporation make a believable promise

Say there is a secret encryption key that a third party has to handle. The third party is supposed to destroy the secret key when they are done, and tell everyone else it was destroyed and therefore ...
user avatar
  • 236
0 votes
1 answer
89 views

Is sending an Email without any PHI violates HIPAA privacy rule?

I am evaluating options to choose email providers for a HIPAA compliant web application. I understand that, if the email contains any form of PHI, it would be violating the HIPAA rule especially if ...
user avatar
0 votes
1 answer
92 views

Is it legal to post card data from an ecommerce checkout to a PCI compliant 'store'

Let's say I want to charge a user's credit card with their permission after a sale takes place. But, I don't want to have to ask them their credit card a second time. Is it legal to store the credit ...
user avatar
  • 105
11 votes
1 answer
3k views

Does SOC-2 compliance require password rotation

For convenience and security I find password rotation requirements harmful. Our SOC 2 auditor seems to still require them. Does SOC 2 actually require password rotation in 2020? I would think(hope) ...
user avatar
  • 1,642
2 votes
1 answer
122 views

Can an indie apps developer get fined if they unintentionally didn't protect users' data from hackers? [closed]

I'm currently developing an app, which the users will store sensitive data in, and this data will be stored in the internet (I'll use Firebase or a similar service). I'll try to secure the data as ...
user avatar
0 votes
1 answer
199 views

GDPR data flow mapping and inventory

Anybody can share some tips on how to create a nice GDPR data flow mapping and inventory? Any sample diagrams? What diagrams types are best to be used here? Would you show high level diagram and sub-...
user avatar
  • 937
0 votes
1 answer
275 views

What are security best practices and compliance areas in Agile Software Development process

How do you ensure on a high level that developed software is secure and compliant. We want to introduce a service checklist that will list each item, including "Security and Compliance" section. It ...
user avatar
  • 937
4 votes
2 answers
1k views

InfoSec certifications for global startup

I am working in a global startup. Recently we have undergone several InfoSec processes with potential large corporate customers. All of them asked for: SOC ISO 27k Which makes sense for large ...
user avatar
  • 937
2 votes
1 answer
122 views

What are the FEDRAMP "complementary controls"?

Quoting the FedRAMP official FAQ: FedRAMP requirements include additional controls above the standard NIST baseline controls in NIST SP 800-53 Revision 4. These additional controls address the ...
user avatar
  • 1,577
0 votes
0 answers
105 views

Returning Social Security Number After Validation Checks on Web Based Form

I have a web based application form that is used to gather personal information for web based users. One of the fields is an SSN. My question is simple, in terms of security compliance (in general, ...
user avatar
  • 1,309
2 votes
2 answers
166 views

User passwords printed on paperwork at a dental office?

My dental office just printed my user-defined password (not a first or one-time password) to their portal on some checkout paperwork. I asked on Law.stackexchange and it doesn't sound like this is a ...
user avatar
  • 21
2 votes
1 answer
176 views

Where to start preparing for SOC 2 type 2?

We are a small US-based startup with most of the employees working remotely from other countries (less than 10 people in total) and currently are building a SaaS web platform for banks (everything is ...
user avatar
1 vote
1 answer
738 views

Active Directory GDPR classification

GDPR classifies data into Non-personal, Personal and Sensitive personal. Sensitive personal is further broken down to Genetic and biometric, Racial and ethnical, Religion and Philosophical etc. ...
user avatar
  • 73
1 vote
1 answer
609 views

How does a merger formally impact an ISO 27001 certification?

Organization A has a service that is ISO 27001 certified. It is acquired by Organization B which does not have any certification. What are the formal impacts of the acquisition on the ISO 27001 ...
user avatar
  • 8,923
0 votes
1 answer
98 views

If one user sees an email of another user, is it DSGVO conform?

I want to give a logged in user the ability to search for other users by their exact email. The search input is passed asynchronously by Javascript so the email would remain in server logs and so on. ...
user avatar
3 votes
2 answers
140 views

Is SQL auth over windows auth a red flag?

I'm working on something where using windows authentication to SQL server is difficult if not impossible. My team member is adamant that using SQL auth is much more difficult to manage and is a major ...
user avatar
1 vote
1 answer
221 views

Is there a PCI Requirement for shuffling digits while accepting PIN?

The following image shows a PIN entry device which shuffles the digits. . via twitter I've seen this question, but it doesn't cover why companies are still doing this. I looked at the POS PIN Entry ...
user avatar
  • 1,527
7 votes
1 answer
178 views

Which self assessment questionairre should I use for PCI DSS compliance

My system is passed card data securely over HTTPS from an upstream system. The upstream system captures information via telephone input. This telephone input is sent to us, to invoke payments via ...
user avatar
  • 173
1 vote
1 answer
209 views

Email under GDPR [closed]

I am aware that email is considered as PII and should be used and stored under strict security guidelines as per GDPR. If we use email in any our communications and in what cases it might not be ...
user avatar
3 votes
1 answer
86 views

Personal Information / Compliance in SaaS for US-based customers

What compliance issues should any B2B SaaS provider worry about when saving user information to its databases such as Name, DOB, Gender, Emergency Contact Information (Name, Phone, Address), etc. ...
user avatar
  • 33
6 votes
1 answer
164 views

does the SOC 2 audit specification require credentialing?

If we need to present a SOC 2 audit report to a 3rd party, can we just hire some guy to conduct a review of our software and processes specified by our guidance, or use an internal resource, or does ...
user avatar
3 votes
1 answer
505 views

PCI DSS minimum password strength equivalent in passphrase

The PCI DSS requirement 8.2.3 says: Passwords/passphrases must meet the following: Require a minimum length of at least seven characters. Contain both numeric and alphabetic characters. ...
user avatar
  • 1,079
4 votes
3 answers
893 views

What level of compliance do I need as a software vendor?

I am having a bit a difficult time trying to assess to what level my business needs to be PCI compliant. My business is developing eCommerce websites that are hosted by the client. The websites have ...
user avatar
0 votes
0 answers
271 views

Is sFTP as a technology acceptable in FedRAMP compliant projects?

I seem to recall that there was some problem with using sFTP in some government environments, but now I need to know if it poses a risk on a FedRAMP-compliant project.
user avatar
0 votes
0 answers
48 views

IBM warns to move data out of insecure encryption schemes, but where to? [duplicate]

I'm currently using GnuPG (RSA 4096), Encryption-based DLP, SSL, SSL-VPN, Password Manager and other apps considered insecure by the IBM research team, who favor Lattice encryption over the standard ...
user avatar
0 votes
1 answer
737 views

Signing and timestamping implementation

I am writing a software that records and stores data files. I want to digitally sign and time stamp these files so that I can assure that it's Contemporaneous and Attributable (to comply with 21 CFR ...
user avatar
  • 93
-2 votes
2 answers
866 views

Is PCI compliance required by law?

Is PCI compliance required by law? We are creating a website where we will accept customer card data and pass it to merchant API. Everywhere on the internet you will find PCI is required. But what ...
user avatar
1 vote
0 answers
145 views

Building upon SOC 2 Compliance of hosting provider

We are looking at becoming SOC 2 compliant and I was curious if it is possible to leverage the compliance of a hosting provider as part of our attestation? More specifically, our product is fully ...
user avatar
  • 111
4 votes
1 answer
3k views

How to use CIS Benchmarks without being a CIS member

I am trying to audit my Linux systems with the CIS security benchmarks. There are OS tools like OpenSCAP or Lynis that can do security-related benchmarks, and come with some benchmarks which might be ...
user avatar
  • 243
3 votes
1 answer
184 views

SOX Compliance - Is Running EOL Equipment Considered a Violation?

Let's say I have some networking equipment that will no longer receive vulnerability patches after 2019. This equipment makes up the spine of the company infrastructure. Let's say it's definitely ...
user avatar
4 votes
2 answers
2k views

How do I measure compliance to Information security policies?

I work in an organisation with 3 levels as far as information security is concerned. I'm sitting at level two where we develop policies and also assist with the standards. One of the most difficult ...
user avatar
1 vote
2 answers
211 views

Storing customer data securely (compliance)

I came a cross this data breach where developers of an organization stored some customer PII data on their github account. Common sense tells me that this is obviously stupid and careless thing to do. ...
user avatar
0 votes
1 answer
114 views

HIPAA non-business associate for contract work

I have been asked by the sole owner/employee of a blood testing business to make her a web site. This web site would simply be used to schedule appointments for her patients. For this reason ...
user avatar
132 votes
19 answers
47k views

Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?

I work at a company with a staff of about 1000+. We currently have programming development staff that work on web based projects (approx 50 people). Recently due to security concerns our IT and ...
user avatar
  • 1,309
1 vote
0 answers
65 views

OpenVPN Invalid Logins lock with PAM

We are getting dinged on a federal audit because OpenVPN does not appear to support invalid login restrictions (i.e., only 3 before the account is locked). Has anyone else experienced this? We are ...
user avatar
  • 41

1
2 3 4 5 6