The Payment Card Industry Data Security Standard (PCI DSS) is a worldwide security standard that was formed with the support of credit card companies to align their security standards.

learn more… | top users | synonyms

2
votes
5answers
895 views

Failed PCI Compliance - The remote SMTP server is vulnerable to a buffer overflow

Hey guys, I have tried allowing the scanners IP to be accepted through IPTABLES into the SMTP port, but the scan still fails. This is the error: The remote SMTP server is vulnerable to a buffer ...
0
votes
2answers
184 views

Single solution for website datacenter networking

I am looking at different solution for datacenter need of a web application. Below is my requirement. I would first like to have a solution which offers it all in one box to have it as simple as ...
1
vote
2answers
590 views

PCI-DSS check failing on 'IP Address in HTTP Headers' in IIS 7.0?

My client is having their website validated in order to accept card payments on the site, and one of the failures is that we are leaking the internal IP address, yet we are using IIS 7.0 which I ...
5
votes
5answers
5k views

Do we have to be PCI compliant to store Social Security Numbers in our hosted database?

Do we have to be PCI compliant to store Social Security Numbers in our hosted database? We are hosting a CRM database for nonprofits in South Carolina.
2
votes
1answer
168 views

Things IT needs to do for compliance in a private company? [closed]

My company is a private, family owned business. The company is head quartered in USA and also runs businesses in several countries including Mexico, UK, Canada, Carribean islands and few other ...
3
votes
2answers
3k views

How secure is Virtualmin? [closed]

How secure is Virtualmin? How does it compare to cPanel or other web hosting control panels? Will using Virtualmin prevent me from being PCI compliant?
2
votes
1answer
296 views

What fields need to be included when configuring IIS web logging according to PCI compliance regulations?

From what little I know about PCI compliance I need to be logging all web site activity and keeping said logs online for at least 3 months. What I have not been able to get a straight answer on, ...
5
votes
8answers
6k views

What is the best Web Application Firewall for IIS? [closed]

What is the best Web Application Firewall(WAF) for IIS? What makes it better than the others? How useful is it at blocking attacks against poorly written code, otherwise known as an Intrusion ...
2
votes
1answer
855 views

How do I get SMTP Port 25 to be PCI Compliant on OS X 10.6 Server?

When running PCI security scans on this server it fails on port 25 with: SSL Server Supports Weak Encryption nCircle ID: 6174 Port: 25 CVSS Score: 5.8 Not Compliant Description The SSL (Secure ...
7
votes
3answers
1k views

pci compliance on IIS 6.0

I have a website that has just failed a PCI Compliance check - The report said that the site supported weak ciphers. I thought I'd already disabled that by turning off SSL 2.0 on the webservers. (It ...
2
votes
6answers
1k views

what's the difference between PCI and SAS 70 compliance when I am shopping for a hosting company to stick my servers in?

I am looking for hosting, ec2 is SAS 70 compliant (almost) and I would have gone straight for PCI compliant and tier 4 only but I'm considering SAS 70. What are the differences or similarities?
1
vote
2answers
1k views

What is the best solution for PCI-DSS compliance?

I'm comparing different solutions for PCI-DSS compliance, reading a lot of white papers and brochures regarding RSA enVision, Splunk, LogRhythm, SenSage, ArcSight and OSSEC. Unfortunately, ...
4
votes
4answers
2k views

Options for PCI-DSS 11.5 - Deploy file integrity monitoring software [closed]

I'm looking for options to be compliant with PCI-DSS section 11.5 for some servers I manage at the datacenter. There are several servers (less than 20) and they are mostly CentOS5, but there are some ...
3
votes
4answers
2k views

PCI Compliant hosting? (able to take credit cards)

I've been using 1and1 hosting for a while now and overall I am satisfied with their level of support and the ease of use of their admin panel. However, I'm going to be branching out from just doing ...
4
votes
5answers
12k views

Timeout ssh sessions after inactivity?

PCI-DSS 3.0 requirement 8.1.8 states: "If a session has been idle for more than 15 minutes, require the user to re-authenticate to re-activate the terminal or session." Same was in PCI-DSS 2.0 ...
1
vote
2answers
583 views

How do I get an OS X 10.5 box PCI compliant when the OS X 10.5.7 PHP and Kerberos versions are considered 'Vulnerabilities'

I have just upgraded a server to the latest OS X version 10.5.7 and my compliance scan tells me that these OS-installed components are causing vulnerabilities. I can't see where I can download higher ...
1
vote
2answers
938 views

Anyone know where I can download a copy of Sun Java System Active Server Pages 4.0.3 for Solaris

I've contacted Sun regarding this and they have told me that the download is no longer available as Active Server Pages 4.0.3 is now End Of Life. We need to upgrade our server to 4.0.3 to acheive ...