• AWS: PCI DSS – file integrity monitoring

    I have to deploy some file integrity monitoring  / intrusion detection software on our AWS instances. We wanted to use OSSEC but we realized it doesn't work well in our environment (our servers auto deploy and shut down based on load). What should we use that covers PCI DSS on AWS (hopefully it's...

    ITKE364,045 pointsBadges:
  • Timeout SSH sessions after inactivity for PCI compliance

    For PCI DSS requirements, if a session is idle for more than 15 minutes, the user will have to re-authenticate to re-activate the terminal or session. So, because of this, we had to deal with SSH sessions that are idling at the bash prompt by enforcing a global $TMOUT of 900. But we realized that...

    ITKE364,045 pointsBadges:
  • Is there a payment gateway that doesn’t require PCI compliance?

    Recently, I've been looking to use Authorize.NET (CIM and DPM solutions). However, we can't reference a CIM profile in the DPM. Basically, I need to become PCI compliant because this handles credit cards. Here's my question: Is there something similar to Authorize.NET that allows our site to never...

    ITKE364,045 pointsBadges:
  • Apache SSLCipherSuite continues to fail in PCI compliance scan

    We have a Fedora server that's running on Apache to pass a PCI DSS compliance scan by McAfee. Here's what we used for the default SSLCipherSuite and SSLProtocol. SSLProtocol ALL -SSLv2 SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP So it failed because of weak ciphers. We changed it...

    ITKE364,045 pointsBadges:
  • PCI compliance: Disable AUTH on Port 25

    Due to PCI compliance, we have to disable plaintext authentication. We were able to do this through encapsulating communications between our mail server and clients with TLS on port 465. Here's where the problem is: Port 25 has to remain open / unencrypted for us to receive mail, but it shouldn't...

    ITKE364,045 pointsBadges:
  • Should I worry about my POS system terminal for PCI compliance?

    I've been getting into PCI DSS lately (because my organization asked me too). Our company accepts payments using a POS terminal that's connected to the Internet though the office LAN. Our terminal isn't integrated with any payment processing apps, just paper receipts. Should I worry about PCI...

    ITKE364,045 pointsBadges:
  • PCI DSS: Enforce password management for ASP.NET

    I've been working on our PCI DSS assessment. I already know that passwords must be changed every 90 days / different than previous passwords. But I'm not sure if this is for access to the server or to the app we provide to users on the server. If it's the second part, can we enforce this in ASP.NET...

    ITKE364,045 pointsBadges:
  • Is there a non-US PCI compliant service that stores credit card info?

    We're working on a website that would allow our users to pay with their credit cards. We're outside of the country so we can't use a normal merchant account (like Braintree). Does anyone happen to know of a credit card service that would allow us to store credit card info and access them through an...

    ITKE364,045 pointsBadges:
  • Storing a shipping address for PCI compliance

    From what I understand, storing a shipping address would be okay for PCI compliance right? Do configuration standards include requirements for a firewall at each Internet connection? Is there a process for approving and testing all external network connections? I'm leaning towards no but I need to...

    ITKE364,045 pointsBadges:
  • How to use payment gateway integration to avoid PCI compliance

    My client has an e-commerce which accepts payments through a payment gateway integration that transfers the control to payment gateways. But it knows that it needs to be PCI compliant for accepting credit card information. Instead, could our client use stripe payment gateway / integration that it...

    ITKE364,045 pointsBadges:
  • Cross-site scripting issue for PCI compliance

    For one of our client's websites, they're trying to pass PCI compliance test but the testing company notified us of a vulnerability that we can't figure out. Here's what they told us: The issue here is a cross-site scripting vulnerability that is commonly associated with e-commerce applications....

    ITKE364,045 pointsBadges:
  • Best solution for PCI DSS compliance

    We're currently comparing solutions for PCI DSS compliance including: Splunk, RSA enVision, ArcSight, etc. But we're not sure what to do with. Has anyone had any experience with these programs? Our PCI system is a small segmented network with 5 hosts and our machines will be running Linux. Thanks!

    ITKE364,045 pointsBadges:
  • SQL Server rotation of keys for PCI compliance

    I understand that PCI compliance requires annual rotation of keys. So, I have 16 databases across 3 servers (with multiple tables in each database). And it's going to get bigger. If I did this manually, it would make my data unreadable. Is there a software to do this?

    ITKE364,045 pointsBadges:
  • What’s a good open source static source code analysis tool?

    My department needs an open source static source code analysis tool that's going to be used for security testing on an Android app. We need to make sure the app is PCI compliant. Anyone know of a software that we can use for this?

    ITKE364,045 pointsBadges:
  • Should we turn off expose_php off for PCI compliance?

    We have been told by one of our clients that having expose_php = on in our php.ini is a big security issue and not PCI compliant. But we did some research that it's low risk. Does anyone know if this is a major problem? Thanks!

    ITKE364,045 pointsBadges:
  • What credit card info can I store while being PCI compliant?

    Would anyone happen to know what credit card information I'm allowed to store while still being PCI compliant if I'm relying on braintree for payment processing? Are we allowed to store this information: Last 4 digits of credit cards Card type Cardholder name Thanks!

    ITKE364,045 pointsBadges:
  • How to secure CFID for PCI compliance

    For the past few weeks, our PCI scans keep failing because ColdFusion has predictable CFIDs. This is what we get as the failure: Predictable Cookie Session IDs. Our CFID is still predictable and unaffected by any changes in CF Admin. We don't understand why it's a threat but we have to fix it. What...

    ITKE364,045 pointsBadges:
  • DDoS mitigation for Windows Server 2008 R2

    We are doing our PCI compliance scans and our Windows Server 2008 R2 was hit by a Nessus Plugin ID. Should I be worried? It has DDoS in the title so that scares me. Here's what it says: Plugin ID: 35450 Name: DNS Server Spoofed Request Amplification DDoS Synopsis: The remote DNS server could be...

    ITKE364,045 pointsBadges:
  • Apache configuration to become PCI compliant

    For Apache, we need to make sure of PCI compliance by limiting mod_ssl to SSLv3 and TLSv1 (and also ensuring long keys). We've tried the below configuration but combos of the SSLv2 are still valid. SSLCipherSuite HIGH:MEDIUM:!aNULL:+SHA1:+MD5:+HIGH:+MEDIUM Is there a way completely disable the...

    ITKE364,045 pointsBadges:
  • Upgrade PHP and Apache versions for PCI compliance

    We're currently running Ubuntu for our LAMP environment. For the past week, we've been trying to become PCI compliant so we can pass CC information into our server. When doing the scans, we keep getting these errors regarding our PHP and Apache versions. The PHP version is about 10 versions less...

    ITKE364,045 pointsBadges:

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to:

To follow this tag...

There was an error processing your information. Please try again later.

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Thanks! We'll email you when relevant content is added and updated.

Following