Questions tagged [compliance]
Aspects of compliance with regulations, standards, laws, and policies.
273
questions
1
vote
1
answer
77
views
Is Google Drive compliant with control A.8.15 in ISO 27001:2022?
Is Google Drive compliant with control A.8.15 in ISO 27001:2022?
As ISO 27001 requirements for logging and monitoring, are Event logging, Log storage, Protection of logs, and Analysis of logs, could I ...
- 111
0
votes
0
answers
69
views
Fluid Attacks SATS Scan Taking a Very Long Time
I'm doing a CASA Tier 2 security self-assessment for an app as required by Google, since the app requests permission from users to access sensitive data from their Google account via OAuth. I'm using ...
- 101
0
votes
1
answer
97
views
HIPAA Compliance for Frontend Hosting
I am using a non-HIPAA-compliant vendor (Vercel) for the hosting of my site. This includes serverless functions on Vercel's infrastructure that serve HTML/CSS/JS. However, the entire backend/database ...
- 143
0
votes
2
answers
162
views
Restricting Developers access to Production in DevOps?
In a devops context, how do you approach seperating development from production environments (which is an ISO27001:2022 Annex A control) ? Is granting developers access to production a necessary evil ...
- 1,978
0
votes
0
answers
18
views
AML information on the beneficial owner for clients of a custodian
A custodian bank has a client which is an investment arranger.
The funds of the investment arranger's clients are held at the custodian.
The custodian has flagged one of the investment arranger's ...
1
vote
1
answer
805
views
Microsoft Purview Sensitivity labels, best practices for setup?
Background
There have been more than a handful of recent security breaches at my company, involving social engineering and spoofed emails.
A malicious actor fraudulently spoofing one of our customers, ...
- 111
1
vote
1
answer
120
views
Is using an existing personal GitHub account for professional work not SOC compliant?
My manager is asking me to create a new, separate GitHub personal account for work, using my company email address. This comes with setup complications for me.
I have worked with big, governmental ...
- 13
0
votes
0
answers
57
views
Which documents may be used to demonstrate compliance with requirement 12.8.2 of PCI DSS 3.2.1?
Does a PCI AoC substitute the written agreement that the PCI DSS requirement 12.8.2 requests?
If not, what is the best way to comply?
1
vote
3
answers
500
views
Sharing internal security policies with potential customers?
We have a set of ISMS documents like master security policy, supplier relations etc. classified as INTERNAL according to data classification policy.
Now a potential customers infosec department is ...
- 115
-1
votes
1
answer
97
views
How to configure CDN GCP bucket access privileges
We use GCP Cloud Storage and Cloud CDN to deliver some static assets (html/css/js/.jpg/.png). The buckets used to store those are public with anonymous access (i.e. allUsers in GCP terms).
On one hand ...
- 99
1
vote
0
answers
16
views
Projects similar to SCAP Security Guide
Are there any other projects similar to what SCAP Security Guide (SSG) is doing? Automated security policy compliance using Ansible playbooks and Bash scripts.
I'm trying to put my systems in ...
- 11
2
votes
1
answer
84
views
Security requirements for small tax software business
I have a client who does payroll and taxes and is looking for a web app to easily communicate and transfer tax related documents for clients. I would assume that the IRS or someone would have some ...
- 23
2
votes
3
answers
155
views
How to exclude my attack box from the security compliance audit
We have a tactical red team in-house. For the company compliance audit (SOC 2 and/or ISO 27001), we are forced to install the compliance check agent. With almost all the malware and hacking tools, how ...
- 29
-3
votes
1
answer
103
views
Is Windows 10 Insider Build usable within SOC 2 compliance? [closed]
Or Windows 11 pre-release, just cause I'm curious?
(By employees if that wasn't implicit.)
0
votes
3
answers
134
views
How do you monitor the security control compliance for third party providers? [closed]
I wonder what a small startup would typically do concerning third-party compliance?
Are you expected to send third-party vendors a security questionnaire? Do you need to do that regularly?
- 111
1
vote
0
answers
101
views
How do we reconcile a requirement to keep backups, with a requirement that we be able to purge data on request? [closed]
As part of SOC 2 preparation (and just general operational best-practice) we take regular PostgreSQL backups and keep them for up to a year. One of our partners has a requirement that we be able to ...
- 11
0
votes
1
answer
118
views
Do the organisational policies need to have ownership to ensure accountability?
Policies are the high-level statement from Senior Management. It's a philosophy for the management to be guided by, and management has the direction to plan, build, run and monitor the activities to ...
- 13
1
vote
0
answers
164
views
You are in charge of the security of a very small company. What steps would you follow to achieve a good security level? [closed]
first of all, I would like to admit that I belong to the offensive side of security (Penetration Testing) and this is not my common area of expertise.
Last week I was thinking about how the market ...
- 560
0
votes
0
answers
105
views
SCAP Implementation In Industrial Setting
I work in an industry that uses manufacturing equipment that typically run on Windows or unix-like OS.
An industry body is developing security standards and plans to require the use of Security ...
- 1
1
vote
0
answers
93
views
Get original text of Common Criteria protection profile [closed]
In translated from an English profile, combined from a couple of profiles (I found that one is Protection Profile for Application Software v1.2 of NIAP) I have something like
"TOE security ...
- 11
0
votes
1
answer
80
views
What is the NIST/FIPS publication process? How long does it usually take for drafts to become final?
I'm specifically concerned with EdDSA being made FIPS compliant, which I realize might take longer with the concerns raised with ECDSA, but I'm curious what the process actually is.
Is it all internal ...
- 111
1
vote
0
answers
84
views
Security Team and Security in a small-medium organization/startup [closed]
How should one structure and how should a Security Team work in an agile organization (100 devs).
Found this article:
https://kislayverma.com/organizations/independence-autonomy-and-too-many-small-...
- 977
0
votes
1
answer
123
views
Software update process (dependencies) in organization
Wondering how other organizations manage software update process.
We are a startup, were we try to define components owners, which should update them (security updates etc).
This does not to seem to ...
- 977
2
votes
2
answers
861
views
HIPAA data encryption - Is database level encryption is enough?
If the database has a built in encryption possible such as Azure SQL Server's, Transparent Data Encryption (TDE) would this be enough for getting the HIPAA compliance ? Or even before storing any data ...
- 121
2
votes
1
answer
149
views
Does OWASP's top 10 list cover the majority of potential web application vulnerabilities?
I ask this question because there is a common compliance argument that performing an "OWASP Top 10" scan provides enough coverage to consider it an "in-depth" scan. Is this the case, or are ...
- 23
9
votes
8
answers
7k
views
Can a large corporation make a believable promise
Say there is a secret encryption key that a third party has to handle. The third party is supposed to destroy the secret key when they are done, and tell everyone else it was destroyed and therefore ...
- 236
0
votes
1
answer
99
views
Is sending an Email without any PHI violates HIPAA privacy rule?
I am evaluating options to choose email providers for a HIPAA compliant web application. I understand that, if the email contains any form of PHI, it would be violating the HIPAA rule especially if ...
- 121
0
votes
1
answer
97
views
Is it legal to post card data from an ecommerce checkout to a PCI compliant 'store'
Let's say I want to charge a user's credit card with their permission after a sale takes place. But, I don't want to have to ask them their credit card a second time.
Is it legal to store the credit ...
- 105
12
votes
1
answer
4k
views
Does SOC-2 compliance require password rotation
For convenience and security I find password rotation requirements harmful.
Our SOC 2 auditor seems to still require them. Does SOC 2 actually require password rotation in 2020?
I would think(hope) ...
- 1,682
2
votes
1
answer
128
views
Can an indie apps developer get fined if they unintentionally didn't protect users' data from hackers? [closed]
I'm currently developing an app, which the users will store sensitive data in, and this data will be stored in the internet (I'll use Firebase or a similar service).
I'll try to secure the data as ...
0
votes
1
answer
212
views
GDPR data flow mapping and inventory
Anybody can share some tips on how to create a nice GDPR data flow mapping and inventory?
Any sample diagrams? What diagrams types are best to be used here?
Would you show high level diagram and sub-...
- 977
0
votes
1
answer
299
views
What are security best practices and compliance areas in Agile Software Development process
How do you ensure on a high level that developed software is secure and compliant.
We want to introduce a service checklist that will list each item, including "Security and Compliance" section.
It ...
- 977
4
votes
2
answers
1k
views
InfoSec certifications for global startup
I am working in a global startup. Recently we have undergone several InfoSec processes with potential large corporate customers.
All of them asked for:
SOC
ISO 27k
Which makes sense for large ...
- 977
2
votes
1
answer
129
views
What are the FEDRAMP "complementary controls"?
Quoting the FedRAMP official FAQ:
FedRAMP requirements include additional controls above the standard NIST baseline controls in NIST SP 800-53 Revision 4. These additional controls address the ...
- 1,619
0
votes
0
answers
127
views
Returning Social Security Number After Validation Checks on Web Based Form
I have a web based application form that is used to gather personal information for web based users. One of the fields is an SSN. My question is simple, in terms of security compliance (in general, ...
- 1,349
2
votes
2
answers
171
views
User passwords printed on paperwork at a dental office?
My dental office just printed my user-defined password (not a first or one-time password) to their portal on some checkout paperwork.
I asked on Law.stackexchange and it doesn't sound like this is a ...
- 21
2
votes
1
answer
200
views
Where to start preparing for SOC 2 type 2?
We are a small US-based startup with most of the employees working remotely from other countries (less than 10 people in total) and currently are building a SaaS web platform for banks (everything is ...
1
vote
1
answer
913
views
Active Directory GDPR classification
GDPR classifies data into Non-personal, Personal and Sensitive personal. Sensitive personal is further broken down to Genetic and biometric, Racial and ethnical, Religion and Philosophical etc.
...
- 83
1
vote
1
answer
1k
views
How does a merger formally impact an ISO 27001 certification?
Organization A has a service that is ISO 27001 certified. It is acquired by Organization B which does not have any certification.
What are the formal impacts of the acquisition on the ISO 27001 ...
- 9,008
0
votes
1
answer
108
views
If one user sees an email of another user, is it DSGVO conform?
I want to give a logged in user the ability to search for other users by their exact email. The search input is passed asynchronously by Javascript so the email would remain in server logs and so on. ...
- 1
3
votes
2
answers
152
views
Is SQL auth over windows auth a red flag?
I'm working on something where using windows authentication to SQL server is difficult if not impossible. My team member is adamant that using SQL auth is much more difficult to manage and is a major ...
- 31
1
vote
1
answer
228
views
Is there a PCI Requirement for shuffling digits while accepting PIN?
The following image shows a PIN entry device which shuffles the digits.
. via twitter
I've seen this question, but it doesn't cover why companies are still doing this.
I looked at the POS PIN Entry ...
- 1,657
7
votes
1
answer
190
views
Which self assessment questionairre should I use for PCI DSS compliance
My system is passed card data securely over HTTPS from an upstream system. The upstream system captures information via telephone input. This telephone input is sent to us, to invoke payments via ...
- 173
1
vote
1
answer
275
views
Email under GDPR [closed]
I am aware that email is considered as PII and should be used and stored under strict security guidelines as per GDPR. If we use email in any our communications and in what cases it might not be ...
- 21
3
votes
1
answer
89
views
Personal Information / Compliance in SaaS for US-based customers
What compliance issues should any B2B SaaS provider worry about when saving user information to its databases such as Name, DOB, Gender, Emergency Contact Information (Name, Phone, Address), etc.
...
- 33
6
votes
1
answer
181
views
does the SOC 2 audit specification require credentialing?
If we need to present a SOC 2 audit report to a 3rd party, can we just hire some guy to conduct a review of our software and processes specified by our guidance, or use an internal resource, or does ...
- 161
3
votes
1
answer
539
views
PCI DSS minimum password strength equivalent in passphrase
The PCI DSS requirement 8.2.3 says:
Passwords/passphrases must meet the following:
Require a minimum length of at least seven characters.
Contain both numeric and alphabetic characters.
...
- 1,109
4
votes
3
answers
1k
views
What level of compliance do I need as a software vendor?
I am having a bit a difficult time trying to assess to what level my business needs to be PCI compliant.
My business is developing eCommerce websites that are hosted by the client. The websites have ...
- 141
0
votes
0
answers
349
views
Is sFTP as a technology acceptable in FedRAMP compliant projects?
I seem to recall that there was some problem with using sFTP in some government environments, but now I need to know if it poses a risk on a FedRAMP-compliant project.
0
votes
0
answers
50
views
IBM warns to move data out of insecure encryption schemes, but where to? [duplicate]
I'm currently using GnuPG (RSA 4096), Encryption-based DLP, SSL, SSL-VPN, Password Manager and other apps considered insecure by the IBM research team, who favor Lattice encryption over the standard ...
