• Best solution for PCI DSS compliance

    We're currently comparing solutions for PCI DSS compliance including: Splunk, RSA enVision, ArcSight, etc. But we're not sure what to do with. Has anyone had any experience with these programs? Our PCI system is a small segmented network with 5 hosts and our machines will be running Linux. Thanks!

    ITKE413,335 pointsBadges:
  • SQL Server rotation of keys for PCI compliance

    I understand that PCI compliance requires annual rotation of keys. So, I have 16 databases across 3 servers (with multiple tables in each database). And it's going to get bigger. If I did this manually, it would make my data unreadable. Is there a software to do this?

    ITKE413,335 pointsBadges:
  • What’s a good open source static source code analysis tool?

    My department needs an open source static source code analysis tool that's going to be used for security testing on an Android app. We need to make sure the app is PCI compliant. Anyone know of a software that we can use for this?

    ITKE413,335 pointsBadges:
  • Should we turn off expose_php off for PCI compliance?

    We have been told by one of our clients that having expose_php = on in our php.ini is a big security issue and not PCI compliant. But we did some research that it's low risk. Does anyone know if this is a major problem? Thanks!

    ITKE413,335 pointsBadges:
  • What credit card info can I store while being PCI compliant?

    Would anyone happen to know what credit card information I'm allowed to store while still being PCI compliant if I'm relying on braintree for payment processing? Are we allowed to store this information: Last 4 digits of credit cards Card type Cardholder name Thanks!

    ITKE413,335 pointsBadges:
  • How to secure CFID for PCI compliance

    For the past few weeks, our PCI scans keep failing because ColdFusion has predictable CFIDs. This is what we get as the failure: Predictable Cookie Session IDs. Our CFID is still predictable and unaffected by any changes in CF Admin. We don't understand why it's a threat but we have to fix it. What...

    ITKE413,335 pointsBadges:
  • Apache configuration to become PCI compliant

    For Apache, we need to make sure of PCI compliance by limiting mod_ssl to SSLv3 and TLSv1 (and also ensuring long keys). We've tried the below configuration but combos of the SSLv2 are still valid. SSLCipherSuite HIGH:MEDIUM:!aNULL:+SHA1:+MD5:+HIGH:+MEDIUM Is there a way completely disable the...

    ITKE413,335 pointsBadges:
  • Upgrade PHP and Apache versions for PCI compliance

    We're currently running Ubuntu for our LAMP environment. For the past week, we've been trying to become PCI compliant so we can pass CC information into our server. When doing the scans, we keep getting these errors regarding our PHP and Apache versions. The PHP version is about 10 versions less...

    ITKE413,335 pointsBadges:
  • PCI compliance for storing SSNs in a hosted database

    Do we have to be PCI compliant when it comes to storing SSNs in our hosted database? We're a nonprofit and it would be hosted in a CRM database. Thank you.

    ITKE413,335 pointsBadges:
  • Where to start for developing a payment gateway in PHP

    I'm trying to develop a payment gateway in PHP and I'm not sure where to start (when it comes to best practice for SSL and PCI DSS). Can anyone point me where to start my search? Books or blogs, perhaps?

    ITKE413,335 pointsBadges:
  • SSL/TLS cipher suites for PCI compliance

    I have a question when it comes to PCI DSS compliance and SSL/TLS cipher suites. What order / priority should I list the ciphers in? I already know which ones I need to use and disable, but my friend said there's a priority list too. This will be for Windows servers. Thank you.

    ITKE413,335 pointsBadges:
  • Would Rails 3.0 be PCI compliant?

    I apologize for the short question but would anyone happen to know if Rails 3.0 would pass a PCI compliance scan? Thanks!

    ITKE413,335 pointsBadges:
  • PCI compliance failure: Attempts some buffer overflows

    We were PCI compliant for several months straight and all of a sudden, we got this: Fail Serious Port: 21 Protocol: tcp Summary : attempts some buffer overflows CVSS Base Score : 10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C) CVSS Temporal Score : 8.3 (CVSS2#E:F/RL:OF/RC:C) Public Exploit Available : true...

    ITKE413,335 pointsBadges:
  • PCI compliance scan in IIS: Information disclosure vulnerability

    In our PCI compliance scan, we still have this vulnerability in our website: Synopsis : The remote web server is affected by an information disclosure vulnerability. Description : The remote host appears to be running a version of IIS which allows remote users to determine which authentication...

    ITKE413,335 pointsBadges:
  • Changes to the audit log for PCI compliance

    For PCI compliance reasons, we had to configure auditd. Because PCI states that existing logs can't get changed without an alert. So we tried doing this: -w /var/log/ -k Logs_Accessed -p rwxa But will the auditctl command work? Thank you for your help.

    ITKE413,335 pointsBadges:
  • Wireless analyzer that detects rogue AP’s on the LAN

    We need to fulfill a PCI compliance for our wireless analyzer that would detect the presence of rogue AP's on our internal LAN. What device would do this for us? This is for a Windows environment. Thanks!

    ITKE413,335 pointsBadges:
  • Does temporary storage of credit card info meet PCI DSS requirements?

    For our department, we need to make sure that our temporary storage of our user's credit card information meets PCI DSS requirements. We have to make sure that deletion is compliant DoD's security standards. We thought about using MySQL but we're not sure about the reliability. What should we do?

    ITKE413,335 pointsBadges:
  • Secure credit card information for PCI compliance

    Does anyone know if there's a company / software that offers to store data (particularly credit card information securely) in exchange for a token? Also, can we view the data by using authentication and providing a token back to them? That should be enough for PCI compliance, right? Thanks!

    ITKE413,335 pointsBadges:
  • How to purge database records for PCI compliance

    I have to store some credit card information. To be compliant with PCI DSS, we need to purge the data from our disks by not just deleting the file but writing over the bytes with a random sequence of data (because that would make it harder to recover the data). We would still like to leverage a...

    ITKE413,335 pointsBadges:
  • PCI compliance: Recommended encryption key management

    This question is in reference to PCI compliance. Does anyone know of any recommended encryption key management software? Would ezNCrypt be good to use? Thanks so much.

    ITKE413,335 pointsBadges:

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to:

To follow this tag...

There was an error processing your information. Please try again later.

Thanks! We'll email you when relevant content is added and updated.

Following