up vote -2 down vote favorite
share [g+] share [fb]

We received an alert that we need to correct some issues with PCI compliance.

Is there a service we can use to quickly resolve these issues?

The auditing firm issuing the alert provides uninformative messages and instructions on how to correct the errors.

For instance, we got flagged on this security violation, "Description: Cross-site scripting vulnerability in category parameter to URL X."

But there was no help whatsoever.

link|improve this question
25% accept rate
feedback

2 Answers

up vote 2 down vote

Searching with the search phrase "information security firm" should get you started in the right direction.

link|improve this answer
thanks, but we're not looking to engage a consulting firm. are there any free resources or web tools we can use to help narrow PCI compliance? – Crashalot May 26 '11 at 19:14
for instance, this is one area we got flagged on: "Description: Cross-site scripting vulnerability in category parameter to URL X." – Crashalot May 26 '11 at 19:17
@Crashalot, what do you suppose a "service we can use to quickly resolve these issues" is? What exactly are you looking for if you weren't looking for some security firm to help you? For your XSS vulnerability, you should pass that information on to the programmer who built whatever script is at that URL. – Brad May 26 '11 at 19:24
Crashalot, in that case, the actual test descriptions/condition would serve as the road-map against addressing the findings. The tools and resources will most likely vary based on each specific test condition. There may be some tools (whether free or otherwise) which might try to capture a snapshot of the tests, but their mileage will vary based on how current they stay up to date with any changes across time. – user48838 May 27 '11 at 19:42
feedback
up vote 0 down vote

Well, that actually should be enough to identify the application and route that is causing an XSS vulnerability. Your devs should be able to identify the code path that causes that and fix it. If it's not an internal application you are going to need to engage the vendor to get it resolved. This is assuming that they are giving you a real URL and not just 'X' if they are passing you just 'X' then you need to ask for clarification from the auditing firm.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.