Questions tagged [compliance]
Aspects of compliance with regulations, standards, laws, and policies.
263
questions
1
vote
0
answers
7
views
Projects similar to SCAP Security Guide
Are there any other projects similar to what SCAP Security Guide (SSG) is doing? Automated security policy compliance using Ansible playbooks and Bash scripts.
I'm trying to put my systems in ...
- 11
2
votes
1
answer
72
views
Security requirements for small tax software business
I have a client who does payroll and taxes and is looking for a web app to easily communicate and transfer tax related documents for clients. I would assume that the IRS or someone would have some ...
- 23
2
votes
3
answers
144
views
How to exclude my attack box from the security compliance audit
We have a tactical red team in-house. For the company compliance audit (SOC 2 and/or ISO 27001), we are forced to install the compliance check agent. With almost all the malware and hacking tools, how ...
- 29
-3
votes
1
answer
87
views
Is Windows 10 Insider Build usable within SOC 2 compliance? [closed]
Or Windows 11 pre-release, just cause I'm curious?
(By employees if that wasn't implicit.)
0
votes
3
answers
115
views
How do you monitor the security control compliance for third party providers? [closed]
I wonder what a small startup would typically do concerning third-party compliance?
Are you expected to send third-party vendors a security questionnaire? Do you need to do that regularly?
- 101
1
vote
0
answers
89
views
How do we reconcile a requirement to keep backups, with a requirement that we be able to purge data on request? [closed]
As part of SOC 2 preparation (and just general operational best-practice) we take regular PostgreSQL backups and keep them for up to a year. One of our partners has a requirement that we be able to ...
- 11
0
votes
1
answer
97
views
Do the organisational policies need to have ownership to ensure accountability?
Policies are the high-level statement from Senior Management. It's a philosophy for the management to be guided by, and management has the direction to plan, build, run and monitor the activities to ...
- 13
1
vote
0
answers
154
views
You are in charge of the security of a very small company. What steps would you follow to achieve a good security level? [closed]
first of all, I would like to admit that I belong to the offensive side of security (Penetration Testing) and this is not my common area of expertise.
Last week I was thinking about how the market ...
- 540
0
votes
0
answers
95
views
SCAP Implementation In Industrial Setting
I work in an industry that uses manufacturing equipment that typically run on Windows or unix-like OS.
An industry body is developing security standards and plans to require the use of Security ...
- 1
1
vote
0
answers
77
views
Get original text of Common Criteria protection profile [closed]
In translated from an English profile, combined from a couple of profiles (I found that one is Protection Profile for Application Software v1.2 of NIAP) I have something like
"TOE security ...
- 11
0
votes
1
answer
74
views
What is the NIST/FIPS publication process? How long does it usually take for drafts to become final?
I'm specifically concerned with EdDSA being made FIPS compliant, which I realize might take longer with the concerns raised with ECDSA, but I'm curious what the process actually is.
Is it all internal ...
- 111
1
vote
0
answers
75
views
Security Team and Security in a small-medium organization/startup [closed]
How should one structure and how should a Security Team work in an agile organization (100 devs).
Found this article:
https://kislayverma.com/organizations/independence-autonomy-and-too-many-small-...
- 937
0
votes
1
answer
112
views
Software update process (dependencies) in organization
Wondering how other organizations manage software update process.
We are a startup, were we try to define components owners, which should update them (security updates etc).
This does not to seem to ...
- 937
1
vote
2
answers
496
views
HIPAA data encryption - Is database level encryption is enough?
If the database has a built in encryption possible such as Azure SQL Server's, Transparent Data Encryption (TDE) would this be enough for getting the HIPAA compliance ? Or even before storing any data ...
- 111
2
votes
1
answer
141
views
Does OWASP's top 10 list cover the majority of potential web application vulnerabilities?
I ask this question because there is a common compliance argument that performing an "OWASP Top 10" scan provides enough coverage to consider it an "in-depth" scan. Is this the case, or are ...
- 23
9
votes
8
answers
7k
views
Can a large corporation make a believable promise
Say there is a secret encryption key that a third party has to handle. The third party is supposed to destroy the secret key when they are done, and tell everyone else it was destroyed and therefore ...
- 236
0
votes
1
answer
89
views
Is sending an Email without any PHI violates HIPAA privacy rule?
I am evaluating options to choose email providers for a HIPAA compliant web application. I understand that, if the email contains any form of PHI, it would be violating the HIPAA rule especially if ...
- 111
0
votes
1
answer
92
views
Is it legal to post card data from an ecommerce checkout to a PCI compliant 'store'
Let's say I want to charge a user's credit card with their permission after a sale takes place. But, I don't want to have to ask them their credit card a second time.
Is it legal to store the credit ...
- 105
11
votes
1
answer
3k
views
Does SOC-2 compliance require password rotation
For convenience and security I find password rotation requirements harmful.
Our SOC 2 auditor seems to still require them. Does SOC 2 actually require password rotation in 2020?
I would think(hope) ...
- 1,642
2
votes
1
answer
122
views
Can an indie apps developer get fined if they unintentionally didn't protect users' data from hackers? [closed]
I'm currently developing an app, which the users will store sensitive data in, and this data will be stored in the internet (I'll use Firebase or a similar service).
I'll try to secure the data as ...
0
votes
1
answer
199
views
GDPR data flow mapping and inventory
Anybody can share some tips on how to create a nice GDPR data flow mapping and inventory?
Any sample diagrams? What diagrams types are best to be used here?
Would you show high level diagram and sub-...
- 937
0
votes
1
answer
275
views
What are security best practices and compliance areas in Agile Software Development process
How do you ensure on a high level that developed software is secure and compliant.
We want to introduce a service checklist that will list each item, including "Security and Compliance" section.
It ...
- 937
4
votes
2
answers
1k
views
InfoSec certifications for global startup
I am working in a global startup. Recently we have undergone several InfoSec processes with potential large corporate customers.
All of them asked for:
SOC
ISO 27k
Which makes sense for large ...
- 937
2
votes
1
answer
122
views
What are the FEDRAMP "complementary controls"?
Quoting the FedRAMP official FAQ:
FedRAMP requirements include additional controls above the standard NIST baseline controls in NIST SP 800-53 Revision 4. These additional controls address the ...
- 1,577
0
votes
0
answers
105
views
Returning Social Security Number After Validation Checks on Web Based Form
I have a web based application form that is used to gather personal information for web based users. One of the fields is an SSN. My question is simple, in terms of security compliance (in general, ...
- 1,309
2
votes
2
answers
166
views
User passwords printed on paperwork at a dental office?
My dental office just printed my user-defined password (not a first or one-time password) to their portal on some checkout paperwork.
I asked on Law.stackexchange and it doesn't sound like this is a ...
- 21
2
votes
1
answer
176
views
Where to start preparing for SOC 2 type 2?
We are a small US-based startup with most of the employees working remotely from other countries (less than 10 people in total) and currently are building a SaaS web platform for banks (everything is ...
1
vote
1
answer
738
views
Active Directory GDPR classification
GDPR classifies data into Non-personal, Personal and Sensitive personal. Sensitive personal is further broken down to Genetic and biometric, Racial and ethnical, Religion and Philosophical etc.
...
- 73
1
vote
1
answer
609
views
How does a merger formally impact an ISO 27001 certification?
Organization A has a service that is ISO 27001 certified. It is acquired by Organization B which does not have any certification.
What are the formal impacts of the acquisition on the ISO 27001 ...
- 8,923
0
votes
1
answer
98
views
If one user sees an email of another user, is it DSGVO conform?
I want to give a logged in user the ability to search for other users by their exact email. The search input is passed asynchronously by Javascript so the email would remain in server logs and so on. ...
- 1
3
votes
2
answers
140
views
Is SQL auth over windows auth a red flag?
I'm working on something where using windows authentication to SQL server is difficult if not impossible. My team member is adamant that using SQL auth is much more difficult to manage and is a major ...
- 31
1
vote
1
answer
221
views
Is there a PCI Requirement for shuffling digits while accepting PIN?
The following image shows a PIN entry device which shuffles the digits.
. via twitter
I've seen this question, but it doesn't cover why companies are still doing this.
I looked at the POS PIN Entry ...
- 1,527
7
votes
1
answer
178
views
Which self assessment questionairre should I use for PCI DSS compliance
My system is passed card data securely over HTTPS from an upstream system. The upstream system captures information via telephone input. This telephone input is sent to us, to invoke payments via ...
- 173
1
vote
1
answer
209
views
Email under GDPR [closed]
I am aware that email is considered as PII and should be used and stored under strict security guidelines as per GDPR. If we use email in any our communications and in what cases it might not be ...
- 21
3
votes
1
answer
86
views
Personal Information / Compliance in SaaS for US-based customers
What compliance issues should any B2B SaaS provider worry about when saving user information to its databases such as Name, DOB, Gender, Emergency Contact Information (Name, Phone, Address), etc.
...
- 33
6
votes
1
answer
164
views
does the SOC 2 audit specification require credentialing?
If we need to present a SOC 2 audit report to a 3rd party, can we just hire some guy to conduct a review of our software and processes specified by our guidance, or use an internal resource, or does ...
- 161
3
votes
1
answer
505
views
PCI DSS minimum password strength equivalent in passphrase
The PCI DSS requirement 8.2.3 says:
Passwords/passphrases must meet the following:
Require a minimum length of at least seven characters.
Contain both numeric and alphabetic characters.
...
- 1,079
4
votes
3
answers
893
views
What level of compliance do I need as a software vendor?
I am having a bit a difficult time trying to assess to what level my business needs to be PCI compliant.
My business is developing eCommerce websites that are hosted by the client. The websites have ...
- 141
0
votes
0
answers
271
views
Is sFTP as a technology acceptable in FedRAMP compliant projects?
I seem to recall that there was some problem with using sFTP in some government environments, but now I need to know if it poses a risk on a FedRAMP-compliant project.
0
votes
0
answers
48
views
IBM warns to move data out of insecure encryption schemes, but where to? [duplicate]
I'm currently using GnuPG (RSA 4096), Encryption-based DLP, SSL, SSL-VPN, Password Manager and other apps considered insecure by the IBM research team, who favor Lattice encryption over the standard ...
0
votes
1
answer
737
views
Signing and timestamping implementation
I am writing a software that records and stores data files.
I want to digitally sign and time stamp these files so that I can assure that it's Contemporaneous and Attributable (to comply with 21 CFR ...
- 93
-2
votes
2
answers
866
views
Is PCI compliance required by law?
Is PCI compliance required by law?
We are creating a website where we will accept customer card data and pass it to merchant API.
Everywhere on the internet you will find PCI is required. But what ...
- 27
1
vote
0
answers
145
views
Building upon SOC 2 Compliance of hosting provider
We are looking at becoming SOC 2 compliant and I was curious if it is possible to leverage the compliance of a hosting provider as part of our attestation? More specifically, our product is fully ...
- 111
4
votes
1
answer
3k
views
How to use CIS Benchmarks without being a CIS member
I am trying to audit my Linux systems with the CIS security benchmarks. There are OS tools like OpenSCAP or Lynis that can do security-related benchmarks, and come with some benchmarks which might be ...
- 243
3
votes
1
answer
184
views
SOX Compliance - Is Running EOL Equipment Considered a Violation?
Let's say I have some networking equipment that will no longer receive vulnerability patches after 2019.
This equipment makes up the spine of the company infrastructure.
Let's say it's definitely ...
- 43
4
votes
2
answers
2k
views
How do I measure compliance to Information security policies?
I work in an organisation with 3 levels as far as information security is concerned. I'm sitting at level two where we develop policies and also assist with the standards. One of the most difficult ...
- 51
1
vote
2
answers
211
views
Storing customer data securely (compliance)
I came a cross this data breach where developers of an organization stored some customer PII data on their github account. Common sense tells me that this is obviously stupid and careless thing to do.
...
- 43
0
votes
1
answer
114
views
HIPAA non-business associate for contract work
I have been asked by the sole owner/employee of a blood testing business to make her a web site. This web site would simply be used to schedule appointments for her patients. For this reason ...
- 115
132
votes
19
answers
47k
views
Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?
I work at a company with a staff of about 1000+. We currently have programming development staff that work on web based projects (approx 50 people).
Recently due to security concerns our IT and ...
- 1,309
1
vote
0
answers
65
views
OpenVPN Invalid Logins lock with PAM
We are getting dinged on a federal audit because OpenVPN does not appear to support invalid login restrictions (i.e., only 3 before the account is locked).
Has anyone else experienced this? We are ...
- 41