Questions tagged [compliance]
Aspects of compliance with regulations, standards, laws, and policies.
234
questions
0
votes
0answers
34 views
CIS 2.3.4.1 (L1) Ensure 'Devices: Allowed to format and eject removable media' is set to 'Administrators and Interactive Users'
I am implementing CIS on Windows 10 1803 and I cannot work out this control.
Description:
This policy setting determines who is allowed to format and eject removable NTFS media. You can use this ...
7
votes
1answer
99 views
Which self assessment questionairre should I use for PCI DSS compliance
My system is passed card data securely over HTTPS from an upstream system. The upstream system captures information via telephone input. This telephone input is sent to us, to invoke payments via ...
0
votes
1answer
110 views
Email under GDPR [closed]
I am aware that email is considered as PII and should be used and stored under strict security guidelines as per GDPR. If we use email in any our communications and in what cases it might not be ...
0
votes
0answers
26 views
Personal file separation in office workstation
Background:
The company I work for is SOC2 and some other Compliant. So to comply with that regulatory compliance they asked us to install SolarWinds RMM agent in our workstations (Not production ...
2
votes
1answer
30 views
Personal Information / Compliance in SaaS for US-based customers
What compliance issues should any B2B SaaS provider worry about when saving user information to its databases such as Name, DOB, Gender, Emergency Contact Information (Name, Phone, Address), etc.
...
5
votes
1answer
70 views
does the SOC 2 audit specification require credentialing?
If we need to present a SOC 2 audit report to a 3rd party, can we just hire some guy to conduct a review of our software and processes specified by our guidance, or use an internal resource, or does ...
3
votes
1answer
181 views
PCI DSS minimum password strength equivalent in passphrase
The PCI DSS requirement 8.2.3 says:
Passwords/passphrases must meet the following:
Require a minimum length of at least seven characters.
Contain both numeric and alphabetic characters.
...
3
votes
3answers
147 views
What level of compliance do I need as a software vendor?
I am having a bit a difficult time trying to assess to what level my business needs to be PCI compliant.
My business is developing eCommerce websites that are hosted by the client. The websites have ...
0
votes
0answers
73 views
Is sFTP as a technology acceptable in FedRAMP compliant projects?
I seem to recall that there was some problem with using sFTP in some government environments, but now I need to know if it poses a risk on a FedRAMP-compliant project.
0
votes
0answers
45 views
IBM warns to move data out of insecure encryption schemes, but where to? [duplicate]
I'm currently using GnuPG (RSA 4096), Encryption-based DLP, SSL, SSL-VPN, Password Manager and other apps considered insecure by the IBM research team, who favor Lattice encryption over the standard ...
0
votes
0answers
43 views
HIPAA : Writing Policies and Process For Workstation Surroundings
I am writing policies that the company will follow and I am going through the HIPAA compliance check list as a guide. I am trying to make sense of this item though. To me a lot of these seem vague and ...
0
votes
1answer
164 views
Signing and timestamping implementation
I am writing a software that records and stores data files.
I want to digitally sign and time stamp these files so that I can assure that it's Contemporaneous and Attributable (to comply with 21 CFR ...
-3
votes
2answers
296 views
Is PCI compliance required by law?
Is PCI compliance required by law?
We are creating a website where we will accept customer card data and pass it to merchant API.
Everywhere on the internet you will find PCI is required. But what ...
1
vote
0answers
88 views
Building upon SOC 2 Compliance of hosting provider
We are looking at becoming SOC 2 compliant and I was curious if it is possible to leverage the compliance of a hosting provider as part of our attestation? More specifically, our product is fully ...
2
votes
1answer
639 views
How to use CIS Benchmarks without being a CIS member
I am trying to audit my Linux systems with the CIS security benchmarks. There are OS tools like OpenSCAP or Lynis that can do security-related benchmarks, and come with some benchmarks which might be ...
3
votes
1answer
91 views
SOX Compliance - Is Running EOL Equipment Considered a Violation?
Let's say I have some networking equipment that will no longer receive vulnerability patches after 2019.
This equipment makes up the spine of the company infrastructure.
Let's say it's definitely ...
3
votes
2answers
160 views
How do I measure compliance to Information security policies?
I work in an organisation with 3 levels as far as information security is concerned. I'm sitting at level two where we develop policies and also assist with the standards. One of the most difficult ...
1
vote
2answers
75 views
Storing customer data securely (compliance)
I came a cross this data breach where developers of an organization stored some customer PII data on their github account. Common sense tells me that this is obviously stupid and careless thing to do.
...
0
votes
1answer
54 views
HIPAA non-business associate for contract work
I have been asked by the sole owner/employee of a blood testing business to make her a web site. This web site would simply be used to schedule appointments for her patients. For this reason ...
119
votes
19answers
32k views
Is it common to allow local desktop admin access and rights for developers in organizations?
I work at a company with a staff of about 1000+. We currently have programming development staff that work on web based projects (approx 50 people).
Recently due to security concerns our IT and ...
1
vote
0answers
22 views
OpenVPN Invalid Logins lock with PAM
We are getting dinged on a federal audit because OpenVPN does not appear to support invalid login restrictions (i.e., only 3 before the account is locked).
Has anyone else experienced this? We are ...
0
votes
1answer
106 views
Is Aria2 downloads detectable by web servers?
A couple of months ago I signed up for a paid online course. Their terms of service indicate that these video lectures are for streamed viewing and not to be downloaded. There's a 2 hour commute from ...
0
votes
0answers
43 views
SQL RLS for NIST compliance
Is there specific NIST documentation advising about implementing MS SQL Row-Level security for 800-53 compliance?
1
vote
1answer
266 views
Will Enabling TLS 1.2 and disabling older protocols on Windows Servers have any impact on desktops?
I want to know what the impact would be if I were to enable TLS 1.2 on Windows Servers and disabled older protocols. I enabled TLS 1.2 on my Windows 7 Laptop manually running the Microsoft Fix It ...
6
votes
3answers
335 views
If I'm PCI-DSS compliant, do I need to worry about GDPR?
Next month, the EU's General Data Protection Regulation (GDPR) takes effect.
Our organization is already PCI-DSS compliant.
Do we need to do anything additional to make sure we are consistent with ...
2
votes
2answers
108 views
Any frameworks that outline the requirement or recommendation of a Security Operations Center?
We can all agree it's best practice to implement a SOC within an organization, but are there any frameworks or compliance requirements that specifically call it out?
0
votes
1answer
97 views
How to run FCS_TLSS tests of for common criteria evaluation? [closed]
So we are working on making a product of one of our clients common criteria compliant. We are using tls-cc-tools for running FCS_TLSC tests but we are unable to run FCS_TLSS_EXT.1.1 test 5. Please ...
19
votes
4answers
6k views
The non-compliance of the EU cookie law as a finding in a penetration test report?
I recently noticed a penetration test report wherein the non-compliance of the European Union (EU) cookie law was stated as a finding under an "other" category. I consider this more of a legal, ...
4
votes
1answer
128 views
Are there regulations that govern how social security numbers are stored and viewed?
I'm working for a client that keeps records of social security numbers in their databases, numbers pulled from screenings and automatically captured from companies and other financial data. A few ...
6
votes
2answers
215 views
How Should a Midsized Startup Approach Information Security and Compliance?
The situation:
An established SaaS startup with <100 employees, a large development team and several self taught networks engineers. Our business involves handling both PII and payment data.
As we'...
2
votes
3answers
171 views
PCI Compliance question from a merchant
I'm a new business that conducts online auctions for estate sales. When searching for software to use, I had no idea about PCI Compliance. My merchant account told me it was easy. It would be if the ...
1
vote
2answers
78 views
Developers VS HIPAA
I am trying to bring a company up to HIPAA standards and help them secure their customer health information. A question that sometimes comes up is that developers want to take databases of customer's ...
4
votes
2answers
633 views
PIN delivery: do PCI DSS requirements prevent sending the PIN to an end-user's mobile phone?
Do PCI DSS requirements prevent processors from sending to endusers' mobile phones the PIN?
I went through many PCI documents, such as the PCI security requirements 2.0 and this isn't mentioned. I'm ...
1
vote
1answer
48 views
Do cloud service providers offer insights on their security issues?
Should someone want a highly secured cloud environment, having the whole infrastructure managed by a third party could be quite stressful I guess.
There are things you can't manage yourself in a ...
1
vote
2answers
641 views
How to timestamp a document without electronic signature under eIDAS
I need to timestamp a file to prove data integrity, not authorship. I will use a RFC3161 qualified timestamping service.
From the EU Regulation Section 6, Article 41, I understand that I can use a ...
0
votes
1answer
217 views
Good book on PCI DSS? [closed]
I need to upgrade my skills on PCI DSS Compliance. I'm looking for a couple of combo: one to cover everything in an extensive way (a sort on encyclopedia to keep as a reference) and a quick guide to ...
6
votes
3answers
653 views
How to handle personally identifiable information (PII) as a startup?
My startup is finally faced with the potential responsibility of handling PII, and we're concerned with doing it properly from a risk perspective but also so that we're doing this correctly.
What ...
1
vote
1answer
310 views
Required security for storing bank transactions, but not credentials
If I'm using an external bank data aggregation service to get user credit and banking transactions, but the external service itself is handling the process of collecting and managing banking ...
0
votes
1answer
459 views
Requirments for a PCI Compliant Sales Receipts
I work with a software development company and we have a client that is asking us to change the coding in our software that allows for the signers name to print on the customers receipt. They are ...
4
votes
2answers
113 views
Can an HTML-based patient report be HIPAA-compiliant?
Assume I am creating an application that generates a report of health recommendations based on input patient diagnostics.
My application receives no identifying information about the patient. It ...
2
votes
2answers
457 views
PCI DSS compliance on shopify using the client's payment processor
I'm developing an e-commerce website for a client on Shopify, usually shopify integrates with many gateways, but for this instance, the client asked us create a custom checkout that integrates with a ...
3
votes
1answer
1k views
I need assistance in properly understanding the IA-7 control in NIST SP 800-53
I've recently been working on a number of A&A tasks for the RMF for a US Government entity, and I'm having a hard time properly understanding the IA-7 control of NIST SP 800-53 and the supplement ...
0
votes
1answer
484 views
What compliance does my mobile application need?
We are going to develop an application for payment gateway which is already PCI DSS compliant,
This application will be handling the payment through the API.
My questions is is the application needs ...
2
votes
1answer
369 views
Does passing encrypted card data through a server mean that the server must be PCI compliant?
I am attempting to setup a network of web applications that all provide some kind of purchasing system. In an effort to avoid having to run vulnerability scans on each web application's server, I ...
2
votes
2answers
1k views
Is Segregation of Duties a Requirement?
In our environment. Developers have full rights and privileges in the dev, test, and production environments. This gives them the ability to create, manipulate, and promote code associated with ...
2
votes
0answers
77 views
Compliance/ FCA regulations
First of all, please accept my apology for being ingnorant to compliance/FCA regulations as I have been digging out everywhere to get the answer of a very specific question:
SCENARIO
I am planning ...
1
vote
2answers
322 views
PCI DSS 3.2 SAQ A and SAQ A-EP - 2 different web shops
I did a pre-assessment of 2 web shops of one company today.
One web shop uses Direct Post based forms to insert and forward cardholder data. Doing this means the company is eligible for an SAQ A-EP.
...
3
votes
1answer
557 views
Is HelloSign actually compliant with EU Regulation 910/2014 (eIDAS)? [closed]
EDIT
I added the full replies I got from HelloSign. These may perhaps help someone more expert than I am to determine if they actually provide an AdES signature. Please note that I also asked ...
1
vote
2answers
420 views
PCI DSS for web servers not storing credit card info
I plan on deploying our new company website to a dedicated server through a hosting provider. I will personally maintain the server with the exception of dealing with the physical hardware. The ...
0
votes
2answers
759 views
is Cryptpad safe for corporate use (logs which includes hostnames, IP and internal configuration) [closed]
We don't have an internal Gist for fast sharing snippets and logs extracts with co workers.
Is it safe to use this web service?
quote from GitHub site:
CryptPad is private, not anonymous. Privacy ...
