PCI DSS for large organizations: A Coalfire perspective

As organizations grow, PCI DSS responsibilities become more complex. Logically, they gain more interconnected relationships internally and with third parties. Multiple payment channels, complex network architectures, and large inventories of devices in scope require preparation before performing...

Riding another wave of success for our multi-layered detection and response approach

The corporate endpoint is a constant battle between cybersecurity white hats and criminal attackers. According to one study from the Ponemon Institute, 68% of organizations were victims of an attack on the endpoint in 2019. The risks and costs associated with undetected threats are immeasurable...

Attention Payment Application Developers: Begin Your Transition from the PA-DSS to the PCI SSF Today

The Payment Card Industry PCI Council plans to formally retire the Payment Application Data Security Standard PA-DSS in October 2022 and replace it with the PCI Software Security Framework SSF. For vendors, the new framework expands program eligibility with improved support for evolving...

Download: The Comprehensive Compliance Guide

A large part of the CISO/CIO responsibility is ensuring compliance standards are met. As one of the main drivers of security product purchase and implementation, regulation comes in many different shapes and sizes. Some standards provide clear consequences for failure to meet them. Others provide...

4 Best Free Online Security Tools for SMEs in 2020

Cyberattacks on small and midsized companies in 2019 cost $200,000 per company on average, mercilessly putting many of them out of business, says CNBC in its analysis of a recent Accenture report. In light of the global cybersecurity skills shortage, the number is set to soar in 2020. Solely in t...

The Comprehensive Compliance Guide (Get Assessment Templates)

Complying with cyber regulations forms a significant portion of the CISO's responsibility. Compliance is, in fact, one of the major drivers in the purchase and implementation of new security products. But regulations come in multiple different colors and shapes – some are tailored to a specific...

Tips to Accelerating PCI Data Security Standard Projects with Deep Security as a Service

Does your organization need to meet PCI DSS requirements? Are you struggling with multiple security tools? Or stretching your already overstretched team to prepare for an audit? Time to hit the accelerator with Trend Micro! If your applications deal with credit or payment card data, you need to g...

Preparing for PCI DSS 4.0

PCI DSS 4.0 is currently in its request for comments RFC process, where the industry can provide comments and feedback to help shape the next iteration. This process is initially open to the participating organizations - members that help steer and inform the PCI SSC based on their experiences. T...

Gain the Trust of Your Business Customers With SOC 2 Compliance

In today's business environment, data is what matters most. It matters to organizations that monetize it into operational insights and optimisations, and it matters the threat actors that relentlessly seek to achieve similar monetisation by compromising it. In the very common scenario in which...

Flyeralarm Secures Web Shop with RIPS

Download PDF The Challenge At FLYERALARM, around 15,000 products and 24,000 dispatches are coordinated on a daily bases by a PHP-based web shop and backend that drives the major revenue of the company. Every day, the complex code base is customized and advanced by 80+ developers to meet new...

PCI DSS Compliance - Information Leakage

The remote host is vulnerable to one or more conditions that are considered to be 'information leakage' and so are not automatic failures according to the PCI DSS Approved Scanning Vendors Program Guide version 3.1. These information leakage issues include one or more of the following : - Detaile...

8 Live Queries That Will Speed Up Your Next PCI Audit

It’s no secret that kicking off any kind of compliance audit can be a slow, tedious project. This is especially true when it comes to performing a pre-assessment gap analysis for PCI-DSS. Ask any qualified security assessor QSA, and they’ll tell you that the data gathering, scoping, and gap...

Mitsubishi FX-32ET/DSS Digital I/O Module Detection

Binary data 751962.prm...

Mitsubishi FX5-C32EYT/DSS-TS Digital I/O Module Detection

Binary data 751995.prm...

RIPS 3.1: TeamCity, LDAP and JSP Support

Compliance Management Compliance to industry standards is a major topic in todays product development strategies. We revised our compliance tab that now provides an efficient overview of all violations against industry standard requirements that were found during RIPS code analysis. Developers ca...

PCI & SSL/Early TLS QIDs 38601, 42366

Two QIDs will be marked as PCI Fail on May 1, 2019 as required by ASV Program Guide: QID 38601 “SSL/TLS Use of Weak RC4 Cipher” QID 42366 “SSLv3.0/TLSv1.0 Protocol Weak CBC Mode Server Side Vulnerability BEAST” Last revision of ASV Program Guide ver. 3.1 has the following for SSL/TLS component: “...

Operating System Unsupported Version Detection in banner reporting (PCI-DSS check)

A service banner response from the remote host indicates an operating system install at a level that indicates the operating system running on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, ...

Unsupported linux kernel version detected in banner reporting (PCI-DSS check)

A service banner response from the remote host indicates a Linux kernel install at a level that may no longer be supported, where kernel development and security patching has ceased. This plugin only runs when 'Check for PCI-DSS compliance' is enabled in the scan policy. It does not run if local...

The HOW, WHY, and HUH? Blog on Disputes

As you may know, performing vulnerability scans is a requirement for PCI DSS compliance. One of those specific requirements, described in section 11.2.2, states that quarterly external scanning must be done by a qualified Approved Scanning Vendor. Coalfire just so happens to be an ASV, so if you...

PA-DSS to Software Security Framework: What You Need to Know

The Payment Application Data Security Standard PA-DSS developed by the Payment Card Industry Security Standards Council PCI SSC applies to software vendors and others who develop payment applications that store, process, or transmit cardholder data and/or sensitive authentication data. The list o...