Questions tagged [compliance]
Aspects of compliance with regulations, standards, laws, and policies.
-3
votes
2answers
144 views
Is PCI compliance required by law?
Is PCI compliance required by law?
We are creating a website where we will accept customer card data and pass it to merchant API.
Everywhere on the internet you will find PCI is required. But what ...
1
vote
0answers
49 views
Building upon SOC 2 Compliance of hosting provider
We are looking at becoming SOC 2 compliant and I was curious if it is possible to leverage the compliance of a hosting provider as part of our attestation? More specifically, our product is fully ...
2
votes
1answer
70 views
How to use CIS Benchmarks without being a CIS member
I am trying to audit my Linux systems with the CIS security benchmarks. There are OS tools like OpenSCAP or Lynis that can do security-related benchmarks, and come with some benchmarks which might be ...
3
votes
1answer
78 views
SOX Compliance - Is Running EOL Equipment Considered a Violation?
Let's say I have some networking equipment that will no longer receive vulnerability patches after 2019.
This equipment makes up the spine of the company infrastructure.
Let's say it's definitely ...
0
votes
0answers
25 views
Privacy consequences of not being able to log out of Microsoft Forms
I am facing some frustrations trying to adopt the Microsoft Forms product within Office 365 and its lack of support for logging out when taking a quiz (a type of form within the application). I am ...
3
votes
2answers
91 views
How do I measure compliance to Information security policies?
I work in an organisation with 3 levels as far as information security is concerned. I'm sitting at level two where we develop policies and also assist with the standards. One of the most difficult ...
1
vote
2answers
58 views
Storing customer data securely (compliance)
I came a cross this data breach where developers of an organization stored some customer PII data on their github account. Common sense tells me that this is obviously stupid and careless thing to do.
...
0
votes
1answer
47 views
HIPAA non-business associate for contract work
I have been asked by the sole owner/employee of a blood testing business to make her a web site. This web site would simply be used to schedule appointments for her patients. For this reason ...
114
votes
19answers
26k views
Is it common to allow local admin access for developers in organizations?
I work at a company with a staff of about 1000+. We currently have programming development staff that work on web based projects (approx 50 people).
Recently due to security concerns our IT and ...
1
vote
0answers
17 views
OpenVPN Invalid Logins lock with PAM
We are getting dinged on a federal audit because OpenVPN does not appear to support invalid login restrictions (i.e., only 3 before the account is locked).
Has anyone else experienced this? We are ...
0
votes
1answer
84 views
Is Aria2 downloads detectable by web servers?
A couple of months ago I signed up for a paid online course. Their terms of service indicate that these video lectures are for streamed viewing and not to be downloaded. There's a 2 hour commute from ...
0
votes
0answers
31 views
SQL RLS for NIST compliance
Is there specific NIST documentation advising about implementing MS SQL Row-Level security for 800-53 compliance?
1
vote
1answer
194 views
Will Enabling TLS 1.2 and disabling older protocols on Windows Servers have any impact on desktops?
I want to know what the impact would be if I were to enable TLS 1.2 on Windows Servers and disabled older protocols. I enabled TLS 1.2 on my Windows 7 Laptop manually running the Microsoft Fix It ...
6
votes
3answers
302 views
If I'm PCI-DSS compliant, do I need to worry about GDPR?
Next month, the EU's General Data Protection Regulation (GDPR) takes effect.
Our organization is already PCI-DSS compliant.
Do we need to do anything additional to make sure we are consistent with ...
0
votes
0answers
73 views
Admin asking for domain password: SOC-2 compliance issue?
We've already established elsewhere on this site that an admin asking for your password is not acceptable. Security concerns abound. S/he could impersonate you, or you could do something malicious and ...
2
votes
2answers
107 views
Any frameworks that outline the requirement or recommendation of a Security Operations Center?
We can all agree it's best practice to implement a SOC within an organization, but are there any frameworks or compliance requirements that specifically call it out?
0
votes
1answer
63 views
How to run FCS_TLSS tests of for common criteria evaluation? [closed]
So we are working on making a product of one of our clients common criteria compliant. We are using tls-cc-tools for running FCS_TLSC tests but we are unable to run FCS_TLSS_EXT.1.1 test 5. Please ...
19
votes
4answers
6k views
The non-compliance of the EU cookie law as a finding in a penetration test report?
I recently noticed a penetration test report wherein the non-compliance of the European Union (EU) cookie law was stated as a finding under an "other" category. I consider this more of a legal, ...
2
votes
1answer
53 views
Are there regulations that govern how social security numbers are stored and viewed?
I'm working for a client that keeps records of social security numbers in their databases, numbers pulled from screenings and automatically captured from companies and other financial data. A few ...
6
votes
2answers
184 views
How Should a Midsized Startup Approach Information Security and Compliance?
The situation:
An established SaaS startup with <100 employees, a large development team and several self taught networks engineers. Our business involves handling both PII and payment data.
As we'...
2
votes
3answers
156 views
PCI Compliance question from a merchant
I'm a new business that conducts online auctions for estate sales. When searching for software to use, I had no idea about PCI Compliance. My merchant account told me it was easy. It would be if the ...
1
vote
2answers
76 views
Developers VS HIPAA
I am trying to bring a company up to HIPAA standards and help them secure their customer health information. A question that sometimes comes up is that developers want to take databases of customer's ...
4
votes
2answers
306 views
PIN delivery: do PCI DSS requirements prevent sending the PIN to an end-user's mobile phone?
Do PCI DSS requirements prevent processors from sending to endusers' mobile phones the PIN?
I went through many PCI documents, such as the PCI security requirements 2.0 and this isn't mentioned. I'm ...
1
vote
1answer
44 views
Do cloud service providers offer insights on their security issues?
Should someone want a highly secured cloud environment, having the whole infrastructure managed by a third party could be quite stressful I guess.
There are things you can't manage yourself in a ...
1
vote
2answers
451 views
How to timestamp a document without electronic signature under eIDAS
I need to timestamp a file to prove data integrity, not authorship. I will use a RFC3161 qualified timestamping service.
From the EU Regulation Section 6, Article 41, I understand that I can use a ...
0
votes
1answer
143 views
Good book on PCI DSS? [closed]
I need to upgrade my skills on PCI DSS Compliance. I'm looking for a couple of combo: one to cover everything in an extensive way (a sort on encyclopedia to keep as a reference) and a quick guide to ...
6
votes
3answers
435 views
How to handle personally identifiable information (PII) as a startup?
My startup is finally faced with the potential responsibility of handling PII, and we're concerned with doing it properly from a risk perspective but also so that we're doing this correctly.
What ...
1
vote
1answer
231 views
Required security for storing bank transactions, but not credentials
If I'm using an external bank data aggregation service to get user credit and banking transactions, but the external service itself is handling the process of collecting and managing banking ...
0
votes
1answer
280 views
Requirments for a PCI Compliant Sales Receipts
I work with a software development company and we have a client that is asking us to change the coding in our software that allows for the signers name to print on the customers receipt. They are ...
4
votes
2answers
111 views
Can an HTML-based patient report be HIPAA-compiliant?
Assume I am creating an application that generates a report of health recommendations based on input patient diagnostics.
My application receives no identifying information about the patient. It ...
2
votes
2answers
356 views
PCI DSS compliance on shopify using the client's payment processor
I'm developing an e-commerce website for a client on Shopify, usually shopify integrates with many gateways, but for this instance, the client asked us create a custom checkout that integrates with a ...
3
votes
1answer
958 views
I need assistance in properly understanding the IA-7 control in NIST SP 800-53
I've recently been working on a number of A&A tasks for the RMF for a US Government entity, and I'm having a hard time properly understanding the IA-7 control of NIST SP 800-53 and the supplement ...
0
votes
1answer
256 views
What compliance does my mobile application need?
We are going to develop an application for payment gateway which is already PCI DSS compliant,
This application will be handling the payment through the API.
My questions is is the application needs ...
3
votes
1answer
254 views
Does passing encrypted card data through a server mean that the server must be PCI compliant?
I am attempting to setup a network of web applications that all provide some kind of purchasing system. In an effort to avoid having to run vulnerability scans on each web application's server, I ...
2
votes
2answers
658 views
Is Segregation of Duties a Requirement?
In our environment. Developers have full rights and privileges in the dev, test, and production environments. This gives them the ability to create, manipulate, and promote code associated with ...
2
votes
0answers
61 views
Compliance/ FCA regulations
First of all, please accept my apology for being ingnorant to compliance/FCA regulations as I have been digging out everywhere to get the answer of a very specific question:
SCENARIO
I am planning ...
1
vote
2answers
270 views
PCI DSS 3.2 SAQ A and SAQ A-EP - 2 different web shops
I did a pre-assessment of 2 web shops of one company today.
One web shop uses Direct Post based forms to insert and forward cardholder data. Doing this means the company is eligible for an SAQ A-EP.
...
3
votes
1answer
431 views
Is HelloSign actually compliant with EU Regulation 910/2014 (eIDAS)? [closed]
EDIT
I added the full replies I got from HelloSign. These may perhaps help someone more expert than I am to determine if they actually provide an AdES signature. Please note that I also asked ...
1
vote
2answers
336 views
PCI DSS for web servers not storing credit card info
I plan on deploying our new company website to a dedicated server through a hosting provider. I will personally maintain the server with the exception of dealing with the physical hardware. The ...
0
votes
2answers
491 views
is Cryptpad safe for corporate use (logs which includes hostnames, IP and internal configuration) [closed]
We don't have an internal Gist for fast sharing snippets and logs extracts with co workers.
Is it safe to use this web service?
quote from GitHub site:
CryptPad is private, not anonymous. Privacy ...
3
votes
1answer
110 views
What is the minimal security standard needed for this type of software product
Actions described in security standards (like ISO 27002, PCI-DSS, HIPAA, Common Criteria) greatly vary according to the domain data that they store, process, transmit and report.
We have a product ...
3
votes
2answers
95 views
PCI-DSS requirements regarding long exposure to critical vulnerability (RCE)
Suppose we have an e-commerce website where payment is done via redirection to a payment provider, with no processing / storage of cardholder data at our site (I'll update if needed with exact PCI ...
2
votes
2answers
714 views
Data at Rest vs Data in Storage
I have a question about regulatory compliance. If I am required to have data at rest secured (encrypted), what are they looking for? Should my database files be encrypted, or is data at rest referring ...
3
votes
1answer
865 views
Steps to become SOC 2 compliant?
Are there any specific steps one must follow to achieve SOC 2 compliance? Or should one just get a checklist from a specialized auditor?
Some context:
We are a small company and need to become SOC 2 ...
7
votes
1answer
60 views
Is there a certification AICPA grants to qualified auditors?
We are in the process of hiring an auditor in order to become SOC 2 compliant and would like to know if there's some kind of official auditor listing available, or at least a certification or AICPA ...
7
votes
1answer
231 views
Is KernelCare kernel patching recognized as a valid method of patching kernels by 3rd party auditors and pen testers?
This is probably more of a compliance question, so if there is a better place to ask, please let me know.
Background:
It is a long complex story, but we can't easily update our linux kernels due to ...
3
votes
2answers
1k views
Does unpatched software comply with PCI DSS 3.1?
Can some one help me to confirm that unpatched software complies with PCI DSS 3.1 or not?
The software developer has already released the security patches to fix the vulnerabilities but the ...
2
votes
2answers
80 views
Are CCE's used anymore?
Obviously CVE's are used extensively for referring to specific vulnerabilities. However, I don't see CCE's referenced very much in regards to configurations. I understand that configuration settings ...
0
votes
1answer
78 views
PCI DSS or PCI Standard - Standards | Requirement | Implementation
I have done ISO 27001 implementation and auditin. I want to get a clear idea of PCIDSS standard.
What is PCI DSS (I know the abbreviation)
What are all the materials and sites to refer?
What are all ...
4
votes
1answer
1k views
Will A SOC 2 Audit Typically Require Penetration Testing?
I work for a small firm beginning to explore having a SOC 2 (Security, Availability, Confidentiality) audit performed. The auditor we're working with believes we will need to have penetration testing ...
