The Payment Card Industry Data Security Standard (PCI DSS) is a worldwide security standard that was formed with the support of credit card companies to align their security standards.

learn more… | top users | synonyms

5
votes
8answers
6k views

What is the best Web Application Firewall for IIS? [closed]

What is the best Web Application Firewall(WAF) for IIS? What makes it better than the others? How useful is it at blocking attacks against poorly written code, otherwise known as an Intrusion ...
2
votes
1answer
832 views

How do I get SMTP Port 25 to be PCI Compliant on OS X 10.6 Server?

When running PCI security scans on this server it fails on port 25 with: SSL Server Supports Weak Encryption nCircle ID: 6174 Port: 25 CVSS Score: 5.8 Not Compliant Description The SSL (Secure ...
7
votes
3answers
1k views

pci compliance on IIS 6.0

I have a website that has just failed a PCI Compliance check - The report said that the site supported weak ciphers. I thought I'd already disabled that by turning off SSL 2.0 on the webservers. (It ...
2
votes
6answers
1k views

what's the difference between PCI and SAS 70 compliance when I am shopping for a hosting company to stick my servers in?

I am looking for hosting, ec2 is SAS 70 compliant (almost) and I would have gone straight for PCI compliant and tier 4 only but I'm considering SAS 70. What are the differences or similarities?
1
vote
2answers
1k views

What is the best solution for PCI-DSS compliance?

I'm comparing different solutions for PCI-DSS compliance, reading a lot of white papers and brochures regarding RSA enVision, Splunk, LogRhythm, SenSage, ArcSight and OSSEC. Unfortunately, ...
4
votes
4answers
2k views

Options for PCI-DSS 11.5 - Deploy file integrity monitoring software [closed]

I'm looking for options to be compliant with PCI-DSS section 11.5 for some servers I manage at the datacenter. There are several servers (less than 20) and they are mostly CentOS5, but there are some ...
3
votes
4answers
2k views

PCI Compliant hosting? (able to take credit cards)

I've been using 1and1 hosting for a while now and overall I am satisfied with their level of support and the ease of use of their admin panel. However, I'm going to be branching out from just doing ...
4
votes
5answers
11k views

Timeout ssh sessions after inactivity?

PCI-DSS 3.0 requirement 8.1.8 states: "If a session has been idle for more than 15 minutes, require the user to re-authenticate to re-activate the terminal or session." Same was in PCI-DSS 2.0 ...
1
vote
2answers
573 views

How do I get an OS X 10.5 box PCI compliant when the OS X 10.5.7 PHP and Kerberos versions are considered 'Vulnerabilities'

I have just upgraded a server to the latest OS X version 10.5.7 and my compliance scan tells me that these OS-installed components are causing vulnerabilities. I can't see where I can download higher ...
1
vote
2answers
919 views

Anyone know where I can download a copy of Sun Java System Active Server Pages 4.0.3 for Solaris

I've contacted Sun regarding this and they have told me that the download is no longer available as Active Server Pages 4.0.3 is now End Of Life. We need to upgrade our server to 4.0.3 to acheive ...