Questions tagged [compliance]
Aspects of compliance with regulations, standards, laws, and policies.
249
questions
0
votes
1answer
37 views
Is sending an Email without any PHI violates HIPAA privacy rule?
I am evaluating options to choose email providers for a HIPAA compliant web application. I understand that, if the email contains any form of PHI, it would be violating the HIPAA rule especially if ...
0
votes
1answer
38 views
Is it legal to post card data from an ecommerce checkout to a PCI compliant 'store'
Let's say I want to charge a user's credit card with their permission after a sale takes place. But, I don't want to have to ask them their credit card a second time.
Is it legal to store the credit ...
9
votes
1answer
1k views
Does SOC-2 compliance require password rotation
For convenience and security I find password rotation requirements harmful.
Our SOC 2 auditor seems to still require them. Does SOC 2 actually require password rotation in 2020?
I would think(hope) ...
2
votes
1answer
78 views
Can an indie apps developer get fined if they unintentionally didn't protect users' data from hackers? [closed]
I'm currently developing an app, which the users will store sensitive data in, and this data will be stored in the internet (I'll use Firebase or a similar service).
I'll try to secure the data as ...
0
votes
1answer
64 views
GDPR data flow mapping and inventory
Anybody can share some tips on how to create a nice GDPR data flow mapping and inventory?
Any sample diagrams? What diagrams types are best to be used here?
Would you show high level diagram and sub-...
0
votes
1answer
82 views
What are security best practices and compliance areas in Agile Software Development process
How do you ensure on a high level that developed software is secure and compliant.
We want to introduce a service checklist that will list each item, including "Security and Compliance" section.
It ...
4
votes
2answers
1k views
InfoSec certifications for global startup
I am working in a global startup. Recently we have undergone several InfoSec processes with potential large corporate customers.
All of them asked for:
SOC
ISO 27k
Which makes sense for large ...
2
votes
1answer
70 views
What are the FEDRAMP “complementary controls”?
Quoting the FedRAMP official FAQ:
FedRAMP requirements include additional controls above the standard NIST baseline controls in NIST SP 800-53 Revision 4. These additional controls address the ...
0
votes
0answers
55 views
Returning Social Security Number After Validation Checks on Web Based Form
I have a web based application form that is used to gather personal information for web based users. One of the fields is an SSN. My question is simple, in terms of security compliance (in general, ...
2
votes
2answers
125 views
User passwords printed on paperwork at a dental office?
My dental office just printed my user-defined password (not a first or one-time password) to their portal on some checkout paperwork.
I asked on Law.stackexchange and it doesn't sound like this is a ...
2
votes
1answer
110 views
Where to start preparing for SOC 2 type 2?
We are a small US-based startup with most of the employees working remotely from other countries (less than 10 people in total) and currently are building a SaaS web platform for banks (everything is ...
1
vote
1answer
241 views
Active Directory GDPR classification
GDPR classifies data into Non-personal, Personal and Sensitive personal. Sensitive personal is further broken down to Genetic and biometric, Racial and ethnical, Religion and Philosophical etc.
...
1
vote
1answer
137 views
How does a merger formally impact an ISO 27001 certification?
Organization A has a service that is ISO 27001 certified. It is acquired by Organization B which does not have any certification.
What are the formal impacts of the acquisition on the ISO 27001 ...
0
votes
1answer
52 views
If one user sees an email of another user, is it DSGVO conform?
I want to give a logged in user the ability to search for other users by their exact email. The search input is passed asynchronously by Javascript so the email would remain in server logs and so on. ...
3
votes
2answers
94 views
Is SQL auth over windows auth a red flag?
I'm working on something where using windows authentication to SQL server is difficult if not impossible. My team member is adamant that using SQL auth is much more difficult to manage and is a major ...
1
vote
1answer
73 views
Is there a PCI Requirement for shuffling digits while accepting PIN?
The following image shows a PIN entry device which shuffles the digits.
. via twitter
I've seen this question, but it doesn't cover why companies are still doing this.
I looked at the POS PIN Entry ...
0
votes
0answers
111 views
CIS 2.3.4.1 (L1) Ensure 'Devices: Allowed to format and eject removable media' is set to 'Administrators and Interactive Users'
I am implementing CIS on Windows 10 1803 and I cannot work out this control.
Description:
This policy setting determines who is allowed to format and eject removable NTFS media. You can use this ...
7
votes
1answer
122 views
Which self assessment questionairre should I use for PCI DSS compliance
My system is passed card data securely over HTTPS from an upstream system. The upstream system captures information via telephone input. This telephone input is sent to us, to invoke payments via ...
1
vote
1answer
132 views
Email under GDPR [closed]
I am aware that email is considered as PII and should be used and stored under strict security guidelines as per GDPR. If we use email in any our communications and in what cases it might not be ...
0
votes
0answers
26 views
Personal file separation in office workstation
Background:
The company I work for is SOC2 and some other Compliant. So to comply with that regulatory compliance they asked us to install SolarWinds RMM agent in our workstations (Not production ...
3
votes
1answer
49 views
Personal Information / Compliance in SaaS for US-based customers
What compliance issues should any B2B SaaS provider worry about when saving user information to its databases such as Name, DOB, Gender, Emergency Contact Information (Name, Phone, Address), etc.
...
5
votes
1answer
95 views
does the SOC 2 audit specification require credentialing?
If we need to present a SOC 2 audit report to a 3rd party, can we just hire some guy to conduct a review of our software and processes specified by our guidance, or use an internal resource, or does ...
3
votes
1answer
365 views
PCI DSS minimum password strength equivalent in passphrase
The PCI DSS requirement 8.2.3 says:
Passwords/passphrases must meet the following:
Require a minimum length of at least seven characters.
Contain both numeric and alphabetic characters.
...
4
votes
3answers
461 views
What level of compliance do I need as a software vendor?
I am having a bit a difficult time trying to assess to what level my business needs to be PCI compliant.
My business is developing eCommerce websites that are hosted by the client. The websites have ...
0
votes
0answers
124 views
Is sFTP as a technology acceptable in FedRAMP compliant projects?
I seem to recall that there was some problem with using sFTP in some government environments, but now I need to know if it poses a risk on a FedRAMP-compliant project.
0
votes
0answers
47 views
IBM warns to move data out of insecure encryption schemes, but where to? [duplicate]
I'm currently using GnuPG (RSA 4096), Encryption-based DLP, SSL, SSL-VPN, Password Manager and other apps considered insecure by the IBM research team, who favor Lattice encryption over the standard ...
0
votes
1answer
333 views
Signing and timestamping implementation
I am writing a software that records and stores data files.
I want to digitally sign and time stamp these files so that I can assure that it's Contemporaneous and Attributable (to comply with 21 CFR ...
-2
votes
2answers
622 views
Is PCI compliance required by law?
Is PCI compliance required by law?
We are creating a website where we will accept customer card data and pass it to merchant API.
Everywhere on the internet you will find PCI is required. But what ...
1
vote
0answers
105 views
Building upon SOC 2 Compliance of hosting provider
We are looking at becoming SOC 2 compliant and I was curious if it is possible to leverage the compliance of a hosting provider as part of our attestation? More specifically, our product is fully ...
4
votes
1answer
2k views
How to use CIS Benchmarks without being a CIS member
I am trying to audit my Linux systems with the CIS security benchmarks. There are OS tools like OpenSCAP or Lynis that can do security-related benchmarks, and come with some benchmarks which might be ...
3
votes
1answer
104 views
SOX Compliance - Is Running EOL Equipment Considered a Violation?
Let's say I have some networking equipment that will no longer receive vulnerability patches after 2019.
This equipment makes up the spine of the company infrastructure.
Let's say it's definitely ...
4
votes
2answers
559 views
How do I measure compliance to Information security policies?
I work in an organisation with 3 levels as far as information security is concerned. I'm sitting at level two where we develop policies and also assist with the standards. One of the most difficult ...
1
vote
2answers
111 views
Storing customer data securely (compliance)
I came a cross this data breach where developers of an organization stored some customer PII data on their github account. Common sense tells me that this is obviously stupid and careless thing to do.
...
0
votes
1answer
63 views
HIPAA non-business associate for contract work
I have been asked by the sole owner/employee of a blood testing business to make her a web site. This web site would simply be used to schedule appointments for her patients. For this reason ...
123
votes
19answers
39k views
Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?
I work at a company with a staff of about 1000+. We currently have programming development staff that work on web based projects (approx 50 people).
Recently due to security concerns our IT and ...
1
vote
0answers
28 views
OpenVPN Invalid Logins lock with PAM
We are getting dinged on a federal audit because OpenVPN does not appear to support invalid login restrictions (i.e., only 3 before the account is locked).
Has anyone else experienced this? We are ...
0
votes
1answer
117 views
Is Aria2 downloads detectable by web servers?
A couple of months ago I signed up for a paid online course. Their terms of service indicate that these video lectures are for streamed viewing and not to be downloaded. There's a 2 hour commute from ...
0
votes
0answers
56 views
SQL RLS for NIST compliance
Is there specific NIST documentation advising about implementing MS SQL Row-Level security for 800-53 compliance?
1
vote
1answer
361 views
Will Enabling TLS 1.2 and disabling older protocols on Windows Servers have any impact on desktops?
I want to know what the impact would be if I were to enable TLS 1.2 on Windows Servers and disabled older protocols. I enabled TLS 1.2 on my Windows 7 Laptop manually running the Microsoft Fix It ...
6
votes
3answers
357 views
If I'm PCI-DSS compliant, do I need to worry about GDPR?
Next month, the EU's General Data Protection Regulation (GDPR) takes effect.
Our organization is already PCI-DSS compliant.
Do we need to do anything additional to make sure we are consistent with ...
2
votes
2answers
112 views
Any frameworks that outline the requirement or recommendation of a Security Operations Center?
We can all agree it's best practice to implement a SOC within an organization, but are there any frameworks or compliance requirements that specifically call it out?
0
votes
1answer
118 views
How to run FCS_TLSS tests of for common criteria evaluation? [closed]
So we are working on making a product of one of our clients common criteria compliant. We are using tls-cc-tools for running FCS_TLSC tests but we are unable to run FCS_TLSS_EXT.1.1 test 5. Please ...
19
votes
4answers
6k views
The non-compliance of the EU cookie law as a finding in a penetration test report?
I recently noticed a penetration test report wherein the non-compliance of the European Union (EU) cookie law was stated as a finding under an "other" category. I consider this more of a legal, ...
6
votes
1answer
451 views
Are there regulations that govern how social security numbers are stored and viewed?
I'm working for a client that keeps records of social security numbers in their databases, numbers pulled from screenings and automatically captured from companies and other financial data. A few ...
6
votes
2answers
237 views
How Should a Midsized Startup Approach Information Security and Compliance?
The situation:
An established SaaS startup with <100 employees, a large development team and several self taught networks engineers. Our business involves handling both PII and payment data.
As we'...
2
votes
3answers
186 views
PCI Compliance question from a merchant
I'm a new business that conducts online auctions for estate sales. When searching for software to use, I had no idea about PCI Compliance. My merchant account told me it was easy. It would be if the ...
1
vote
2answers
83 views
Developers VS HIPAA
I am trying to bring a company up to HIPAA standards and help them secure their customer health information. A question that sometimes comes up is that developers want to take databases of customer's ...
4
votes
2answers
1k views
PIN delivery: do PCI DSS requirements prevent sending the PIN to an end-user's mobile phone?
Do PCI DSS requirements prevent processors from sending to endusers' mobile phones the PIN?
I went through many PCI documents, such as the PCI security requirements 2.0 and this isn't mentioned. I'm ...
1
vote
1answer
54 views
Do cloud service providers offer insights on their security issues?
Should someone want a highly secured cloud environment, having the whole infrastructure managed by a third party could be quite stressful I guess.
There are things you can't manage yourself in a ...
1
vote
2answers
843 views
How to timestamp a document without electronic signature under eIDAS
I need to timestamp a file to prove data integrity, not authorship. I will use a RFC3161 qualified timestamping service.
From the EU Regulation Section 6, Article 41, I understand that I can use a ...
