Questions tagged [compliance]
Aspects of compliance with regulations, standards, laws, and policies.
3
votes
1answer
55 views
PCI DSS minimum password strength equivalent in passphrase
The PCI DSS requirement 8.2.3 says:
Passwords/passphrases must meet the following:
Require a minimum length of at least seven characters.
Contain both numeric and alphabetic characters.
...
3
votes
3answers
106 views
What level of compliance do I need as a software vendor?
I am having a bit a difficult time trying to assess to what level my business needs to be PCI compliant.
My business is developing eCommerce websites that are hosted by the client. The websites have ...
0
votes
1answer
46 views
Is sFTP as a technology acceptable in FedRAMP compliant projects?
I seem to recall that there was some problem with using sFTP in some government environments, but now I need to know if it poses a risk on a FedRAMP-compliant project.
0
votes
0answers
44 views
IBM warns to move data out of insecure encryption schemes, but where to? [duplicate]
I'm currently using GnuPG (RSA 4096), Encryption-based DLP, SSL, SSL-VPN, Password Manager and other apps considered insecure by the IBM research team, who favor Lattice encryption over the standard ...
0
votes
0answers
21 views
HIPAA : Writing Policies and Process For Workstation Surroundings
I am writing policies that the company will follow and I am going through the HIPAA compliance check list as a guide. I am trying to make sense of this item though. To me a lot of these seem vague and ...
0
votes
1answer
121 views
Signing and timestamping implementation
I am writing a software that records and stores data files.
I want to digitally sign and time stamp these files so that I can assure that it's Contemporaneous and Attributable (to comply with 21 CFR ...
-3
votes
2answers
187 views
Is PCI compliance required by law?
Is PCI compliance required by law?
We are creating a website where we will accept customer card data and pass it to merchant API.
Everywhere on the internet you will find PCI is required. But what ...
1
vote
0answers
68 views
Building upon SOC 2 Compliance of hosting provider
We are looking at becoming SOC 2 compliant and I was curious if it is possible to leverage the compliance of a hosting provider as part of our attestation? More specifically, our product is fully ...
2
votes
1answer
233 views
How to use CIS Benchmarks without being a CIS member
I am trying to audit my Linux systems with the CIS security benchmarks. There are OS tools like OpenSCAP or Lynis that can do security-related benchmarks, and come with some benchmarks which might be ...
3
votes
1answer
81 views
SOX Compliance - Is Running EOL Equipment Considered a Violation?
Let's say I have some networking equipment that will no longer receive vulnerability patches after 2019.
This equipment makes up the spine of the company infrastructure.
Let's say it's definitely ...
3
votes
2answers
114 views
How do I measure compliance to Information security policies?
I work in an organisation with 3 levels as far as information security is concerned. I'm sitting at level two where we develop policies and also assist with the standards. One of the most difficult ...
1
vote
2answers
62 views
Storing customer data securely (compliance)
I came a cross this data breach where developers of an organization stored some customer PII data on their github account. Common sense tells me that this is obviously stupid and careless thing to do.
...
0
votes
1answer
49 views
HIPAA non-business associate for contract work
I have been asked by the sole owner/employee of a blood testing business to make her a web site. This web site would simply be used to schedule appointments for her patients. For this reason ...
117
votes
19answers
29k views
Is it common to allow local admin access for developers in organizations?
I work at a company with a staff of about 1000+. We currently have programming development staff that work on web based projects (approx 50 people).
Recently due to security concerns our IT and ...
1
vote
0answers
20 views
OpenVPN Invalid Logins lock with PAM
We are getting dinged on a federal audit because OpenVPN does not appear to support invalid login restrictions (i.e., only 3 before the account is locked).
Has anyone else experienced this? We are ...
0
votes
1answer
96 views
Is Aria2 downloads detectable by web servers?
A couple of months ago I signed up for a paid online course. Their terms of service indicate that these video lectures are for streamed viewing and not to be downloaded. There's a 2 hour commute from ...
0
votes
0answers
36 views
SQL RLS for NIST compliance
Is there specific NIST documentation advising about implementing MS SQL Row-Level security for 800-53 compliance?
1
vote
1answer
225 views
Will Enabling TLS 1.2 and disabling older protocols on Windows Servers have any impact on desktops?
I want to know what the impact would be if I were to enable TLS 1.2 on Windows Servers and disabled older protocols. I enabled TLS 1.2 on my Windows 7 Laptop manually running the Microsoft Fix It ...
6
votes
3answers
322 views
If I'm PCI-DSS compliant, do I need to worry about GDPR?
Next month, the EU's General Data Protection Regulation (GDPR) takes effect.
Our organization is already PCI-DSS compliant.
Do we need to do anything additional to make sure we are consistent with ...
0
votes
0answers
84 views
Admin asking for domain password: SOC-2 compliance issue?
We've already established elsewhere on this site that an admin asking for your password is not acceptable. Security concerns abound. S/he could impersonate you, or you could do something malicious and ...
2
votes
2answers
107 views
Any frameworks that outline the requirement or recommendation of a Security Operations Center?
We can all agree it's best practice to implement a SOC within an organization, but are there any frameworks or compliance requirements that specifically call it out?
0
votes
1answer
77 views
How to run FCS_TLSS tests of for common criteria evaluation? [closed]
So we are working on making a product of one of our clients common criteria compliant. We are using tls-cc-tools for running FCS_TLSC tests but we are unable to run FCS_TLSS_EXT.1.1 test 5. Please ...
19
votes
4answers
6k views
The non-compliance of the EU cookie law as a finding in a penetration test report?
I recently noticed a penetration test report wherein the non-compliance of the European Union (EU) cookie law was stated as a finding under an "other" category. I consider this more of a legal, ...
3
votes
1answer
70 views
Are there regulations that govern how social security numbers are stored and viewed?
I'm working for a client that keeps records of social security numbers in their databases, numbers pulled from screenings and automatically captured from companies and other financial data. A few ...
6
votes
2answers
196 views
How Should a Midsized Startup Approach Information Security and Compliance?
The situation:
An established SaaS startup with <100 employees, a large development team and several self taught networks engineers. Our business involves handling both PII and payment data.
As we'...
2
votes
3answers
163 views
PCI Compliance question from a merchant
I'm a new business that conducts online auctions for estate sales. When searching for software to use, I had no idea about PCI Compliance. My merchant account told me it was easy. It would be if the ...
1
vote
2answers
77 views
Developers VS HIPAA
I am trying to bring a company up to HIPAA standards and help them secure their customer health information. A question that sometimes comes up is that developers want to take databases of customer's ...
4
votes
2answers
444 views
PIN delivery: do PCI DSS requirements prevent sending the PIN to an end-user's mobile phone?
Do PCI DSS requirements prevent processors from sending to endusers' mobile phones the PIN?
I went through many PCI documents, such as the PCI security requirements 2.0 and this isn't mentioned. I'm ...
1
vote
1answer
44 views
Do cloud service providers offer insights on their security issues?
Should someone want a highly secured cloud environment, having the whole infrastructure managed by a third party could be quite stressful I guess.
There are things you can't manage yourself in a ...
1
vote
2answers
529 views
How to timestamp a document without electronic signature under eIDAS
I need to timestamp a file to prove data integrity, not authorship. I will use a RFC3161 qualified timestamping service.
From the EU Regulation Section 6, Article 41, I understand that I can use a ...
0
votes
1answer
179 views
Good book on PCI DSS? [closed]
I need to upgrade my skills on PCI DSS Compliance. I'm looking for a couple of combo: one to cover everything in an extensive way (a sort on encyclopedia to keep as a reference) and a quick guide to ...
6
votes
3answers
548 views
How to handle personally identifiable information (PII) as a startup?
My startup is finally faced with the potential responsibility of handling PII, and we're concerned with doing it properly from a risk perspective but also so that we're doing this correctly.
What ...
1
vote
1answer
267 views
Required security for storing bank transactions, but not credentials
If I'm using an external bank data aggregation service to get user credit and banking transactions, but the external service itself is handling the process of collecting and managing banking ...
0
votes
1answer
357 views
Requirments for a PCI Compliant Sales Receipts
I work with a software development company and we have a client that is asking us to change the coding in our software that allows for the signers name to print on the customers receipt. They are ...
4
votes
2answers
112 views
Can an HTML-based patient report be HIPAA-compiliant?
Assume I am creating an application that generates a report of health recommendations based on input patient diagnostics.
My application receives no identifying information about the patient. It ...
2
votes
2answers
401 views
PCI DSS compliance on shopify using the client's payment processor
I'm developing an e-commerce website for a client on Shopify, usually shopify integrates with many gateways, but for this instance, the client asked us create a custom checkout that integrates with a ...
3
votes
1answer
1k views
I need assistance in properly understanding the IA-7 control in NIST SP 800-53
I've recently been working on a number of A&A tasks for the RMF for a US Government entity, and I'm having a hard time properly understanding the IA-7 control of NIST SP 800-53 and the supplement ...
0
votes
1answer
361 views
What compliance does my mobile application need?
We are going to develop an application for payment gateway which is already PCI DSS compliant,
This application will be handling the payment through the API.
My questions is is the application needs ...
3
votes
1answer
300 views
Does passing encrypted card data through a server mean that the server must be PCI compliant?
I am attempting to setup a network of web applications that all provide some kind of purchasing system. In an effort to avoid having to run vulnerability scans on each web application's server, I ...
2
votes
2answers
927 views
Is Segregation of Duties a Requirement?
In our environment. Developers have full rights and privileges in the dev, test, and production environments. This gives them the ability to create, manipulate, and promote code associated with ...
2
votes
0answers
66 views
Compliance/ FCA regulations
First of all, please accept my apology for being ingnorant to compliance/FCA regulations as I have been digging out everywhere to get the answer of a very specific question:
SCENARIO
I am planning ...
1
vote
2answers
299 views
PCI DSS 3.2 SAQ A and SAQ A-EP - 2 different web shops
I did a pre-assessment of 2 web shops of one company today.
One web shop uses Direct Post based forms to insert and forward cardholder data. Doing this means the company is eligible for an SAQ A-EP.
...
3
votes
1answer
481 views
Is HelloSign actually compliant with EU Regulation 910/2014 (eIDAS)? [closed]
EDIT
I added the full replies I got from HelloSign. These may perhaps help someone more expert than I am to determine if they actually provide an AdES signature. Please note that I also asked ...
1
vote
2answers
357 views
PCI DSS for web servers not storing credit card info
I plan on deploying our new company website to a dedicated server through a hosting provider. I will personally maintain the server with the exception of dealing with the physical hardware. The ...
0
votes
2answers
638 views
is Cryptpad safe for corporate use (logs which includes hostnames, IP and internal configuration) [closed]
We don't have an internal Gist for fast sharing snippets and logs extracts with co workers.
Is it safe to use this web service?
quote from GitHub site:
CryptPad is private, not anonymous. Privacy ...
3
votes
1answer
115 views
What is the minimal security standard needed for this type of software product
Actions described in security standards (like ISO 27002, PCI-DSS, HIPAA, Common Criteria) greatly vary according to the domain data that they store, process, transmit and report.
We have a product ...
3
votes
2answers
102 views
PCI-DSS requirements regarding long exposure to critical vulnerability (RCE)
Suppose we have an e-commerce website where payment is done via redirection to a payment provider, with no processing / storage of cardholder data at our site (I'll update if needed with exact PCI ...
2
votes
2answers
808 views
Data at Rest vs Data in Storage
I have a question about regulatory compliance. If I am required to have data at rest secured (encrypted), what are they looking for? Should my database files be encrypted, or is data at rest referring ...
3
votes
1answer
1k views
Steps to become SOC 2 compliant?
Are there any specific steps one must follow to achieve SOC 2 compliance? Or should one just get a checklist from a specialized auditor?
Some context:
We are a small company and need to become SOC 2 ...
7
votes
1answer
66 views
Is there a certification AICPA grants to qualified auditors?
We are in the process of hiring an auditor in order to become SOC 2 compliant and would like to know if there's some kind of official auditor listing available, or at least a certification or AICPA ...
