PCI Industry standard audit checklist




IT Compliance Institute just released PCI Industry standard audit checklist. It also include a self-assessment questionniare.


Comments

Post a Comment

Popular posts from this blog

MS 05-51 buggy patch

My computer did not show any network connection after I installed my computer with all 9 security patches. After some search, MS also noticed this problem and the update is below. http://support.microsoft.com/?kbid=909444 This experience prompt me for 2 issues (one technical , one management) 1. MS recommend one setting "Everyone group should have Bypass Traverse Checking permission". But this violated the default server built standard at some companies. The servers before put into production was hardened and this permission was changed to Domain User or Authenticated User. Should we ask ourselves "Are we doing too much security hardening?" or "Why Everyone is need this permission?" 2. While it took 5 days for malicious hacker to publish exploit code, MS took 4 days to resolve their buggy patch. How IT admin is going to manage their internet facing server if running MS IIS ? Patch too soon, we are at risk of MS bug. Patch too late, we are at risk of exploi...
Read more

Blackhole for network security

There is a few paper on the net discuss how to divert and mitigate the damages caused by network attacks, in particular DDOS. Both papers describe a means to create a “black hole” on the network. One is on the network layer and one is on the web server layer Cisco Black Hole Filtering Cisco's paper explain a specifically built infrastructure can help ISP to route malicious packets to a null interface(blackhole filtering). Microsoft Beat Hackers At Their Own Game With A Hackerbasher Site Utilizing the principle that all vistors must know my name. This method divert incoming traffic using IP address not hostname. These papers give a good illustration that security can be achieved by thoughtful design. All the tools and technology is available to everyone or what they call built-in. By good designing, we increase the effectiveness of our security investment.
Read more

How the Security Breach Occurred

Below is the testimony from CEO of Cardsystem, which can be found at here It seems an insider job (knowing which file to look for and can bypass FW setups). It is very difficult to uncover a script on a server if it is plant by an insider. BUT having this script running for 8 months is another thing. Security Audits, periodic port scanning and health check should uncover this abnormality of the systems. If one look into the root cause of this problem, it is the credit card data is stored for incomplete transactions. I believe lots of other card processing companies also store these type of data for manual settlements. How the Security Breach Occurred In September 2004, an unauthorized party placed a script (a sequence of instructions interpreted or carried out by another program) on the CardSystems platform (an underlying computer system on which application programs run) through an internet-facing application that is used by our customers to access data. In contrast to scripts, viruse...
Read more