The Payment Card Industry Data Security Standard (PCI DSS) is a worldwide security standard that was formed with the support of credit card companies to align their security standards.

learn more… | top users | synonyms

1
vote
1answer
1k views

Force screensaver lockout for multiple users on one Windows 7 PC

We have a single PC that requires the following accounts: 2x Admin accounts for each named responsible administrator (That's me and my boss). The accounts have to be associated with our names for ...
1
vote
1answer
619 views

Failed PCI Compliance - Port: 21 Protocol: tcp | Summary : attempts some buffer overflows

We have had PCI compliance for about 4 months straight then all of a sudden this comes up: Fail Serious Port: 21 Protocol: tcp Summary : attempts some buffer overflows CVSS Base Score : 10.0 (CVSS2#...
4
votes
3answers
929 views

With regards to Windows Updates, just how screwed are we?

We have a small "secured network" in our office. And by small I mean it's a Windows 7 PC connected to a firewall which connects to an internet connection. It's for processing card transactions in ...
0
votes
2answers
1k views

How can I stop SMB on Windows 7 null authenticating?

This is a nasty question to be asking but we're really desperate. By which I mean we have about four hours to fix this or dire consequences will follow. We have a PC for card processing in our office ...
0
votes
3answers
817 views

Rails 3.0 - PCI compliant?

Does anyone know if Rails 3.0 passes PCI compliance scans?
1
vote
2answers
787 views

Designing a Security Policy - Need Examples

We're creating a Security Policy for our company. I'm looking for examples I can use as a boiler plate for ours. Thanks
3
votes
3answers
749 views

Apache mod_ssl configuration for PCI compliance

I need to ensure PCI compliance by limiting mod_ssl to SSLv3 and TLSv1, and ensuring long keys. I've tried the following configuration, but certain combinations of SSLv2 seems to still be valid: ...
1
vote
1answer
2k views

IIS 6.0 PCI Compliance - “Information Disclosure Vulnerability”

We're trying to pass PCI compliance on a few of our websites. After an outside scan, we still have this vulnerability: Synopsis : The remote web server is affected by an information disclosure ...
1
vote
1answer
3k views

web server leaks a private IP address through its HTTP headers. how to fix?

I've already located this question on server fault: Server Fault Question But there is no answer. Does anyone have any advice on how to fix the issue? We're running 2003 Server R2 Ent, latest ...
2
votes
5answers
1k views

Failed PCI Compliance - The remote SMTP server is vulnerable to a buffer overflow

Hey guys, I have tried allowing the scanners IP to be accepted through IPTABLES into the SMTP port, but the scan still fails. This is the error: The remote SMTP server is vulnerable to a buffer ...
0
votes
2answers
184 views

Single solution for website datacenter networking

I am looking at different solution for datacenter need of a web application. Below is my requirement. I would first like to have a solution which offers it all in one box to have it as simple as ...
1
vote
2answers
643 views

PCI-DSS check failing on 'IP Address in HTTP Headers' in IIS 7.0?

My client is having their website validated in order to accept card payments on the site, and one of the failures is that we are leaking the internal IP address, yet we are using IIS 7.0 which I ...
6
votes
5answers
6k views

Do we have to be PCI compliant to store Social Security Numbers in our hosted database?

Do we have to be PCI compliant to store Social Security Numbers in our hosted database? We are hosting a CRM database for nonprofits in South Carolina.
2
votes
1answer
171 views

Things IT needs to do for compliance in a private company? [closed]

My company is a private, family owned business. The company is head quartered in USA and also runs businesses in several countries including Mexico, UK, Canada, Carribean islands and few other ...
3
votes
2answers
3k views

How secure is Virtualmin? [closed]

How secure is Virtualmin? How does it compare to cPanel or other web hosting control panels? Will using Virtualmin prevent me from being PCI compliant?
2
votes
1answer
321 views

What fields need to be included when configuring IIS web logging according to PCI compliance regulations?

From what little I know about PCI compliance I need to be logging all web site activity and keeping said logs online for at least 3 months. What I have not been able to get a straight answer on, ...
5
votes
8answers
7k views

What is the best Web Application Firewall for IIS? [closed]

What is the best Web Application Firewall(WAF) for IIS? What makes it better than the others? How useful is it at blocking attacks against poorly written code, otherwise known as an Intrusion ...
2
votes
1answer
962 views

How do I get SMTP Port 25 to be PCI Compliant on OS X 10.6 Server?

When running PCI security scans on this server it fails on port 25 with: SSL Server Supports Weak Encryption nCircle ID: 6174 Port: 25 CVSS Score: 5.8 Not Compliant Description The SSL (Secure ...
7
votes
3answers
1k views

pci compliance on IIS 6.0

I have a website that has just failed a PCI Compliance check - The report said that the site supported weak ciphers. I thought I'd already disabled that by turning off SSL 2.0 on the webservers. (It ...
2
votes
6answers
2k views

what's the difference between PCI and SAS 70 compliance when I am shopping for a hosting company to stick my servers in?

I am looking for hosting, ec2 is SAS 70 compliant (almost) and I would have gone straight for PCI compliant and tier 4 only but I'm considering SAS 70. What are the differences or similarities?
1
vote
2answers
2k views

What is the best solution for PCI-DSS compliance? [closed]

I'm comparing different solutions for PCI-DSS compliance, reading a lot of white papers and brochures regarding RSA enVision, Splunk, LogRhythm, SenSage, ArcSight and OSSEC. Unfortunately, ...
4
votes
4answers
2k views

Options for PCI-DSS 11.5 - Deploy file integrity monitoring software [closed]

I'm looking for options to be compliant with PCI-DSS section 11.5 for some servers I manage at the datacenter. There are several servers (less than 20) and they are mostly CentOS5, but there are some ...
3
votes
4answers
2k views

PCI Compliant hosting? (able to take credit cards)

I've been using 1and1 hosting for a while now and overall I am satisfied with their level of support and the ease of use of their admin panel. However, I'm going to be branching out from just doing ...
4
votes
5answers
15k views

Timeout ssh sessions after inactivity?

PCI-DSS 3.0 requirement 8.1.8 states: "If a session has been idle for more than 15 minutes, require the user to re-authenticate to re-activate the terminal or session." Same was in PCI-DSS 2.0 ...
1
vote
2answers
589 views

How do I get an OS X 10.5 box PCI compliant when the OS X 10.5.7 PHP and Kerberos versions are considered 'Vulnerabilities'

I have just upgraded a server to the latest OS X version 10.5.7 and my compliance scan tells me that these OS-installed components are causing vulnerabilities. I can't see where I can download higher ...
1
vote
2answers
972 views

Anyone know where I can download a copy of Sun Java System Active Server Pages 4.0.3 for Solaris

I've contacted Sun regarding this and they have told me that the download is no longer available as Active Server Pages 4.0.3 is now End Of Life. We need to upgrade our server to 4.0.3 to acheive PCI-...