CoalfireOne Special Notes

PCI-DSS can be challenging to navigate - particularly when it comes to the ASV scanning requirements. While fulfilling the scanning requirement is easy, obtaining a passing attestation report may involve more than simply remediating failed findings. One requirement that we receive many questions...

Script Src Integrity Check

The remote host may be vulnerable to payment entry data exfiltration due to javascript included from potentially untrusted and unverified third parties script src. If the host is controlled by a 3rd party, ensure that the 3rd party is PCI DSS compliant. C Tenable Network Security, Inc...

App Security and PCI; Are you ready for the audit?

As most people know, merchants, financial institutions and anybody else who is involved in processing credit cards are subject to the PCI DSS compliance to reduce fraud and cybersecurity risks. This affects both brick-n-mortar stores and banks as well as card-not-present CNP transactions that...

What You Should Know About the Changing Nature of Telephone-Based Payments

In March 2011, the PCI SSC released the initial version of the "Protecting Telephone-Based Payments Card Data" Information Supplement as a guide to help assessors assess environments where cardholder data was stored, processed, and/or transmitted over the telephone. It was a pivotal guidance...

Chrome, Firefox, Edge and Safari Plans to Disable TLS 1.0 and 1.1 in 2020

All major web browsers, including Google Chrome, Apple Safari, Microsoft Edge, Internet Explorer, and Mozilla Firefox, altogether today announced to soon remove support for TLS 1.0 20-year-old and TLS 1.1 12-year-old communication encryption protocols. Developed initially as Secure Sockets Layer...

PCI & QID 38598 “Deprecated Public Key Length”

QID 38598 “Deprecated Public Key Length” will be marked as PCI Fail as of November 1, 2018 in accordance with its CVSS score. Under PCI DSS merchants and financial institutions are required to protect their clients' sensitive data with strong cryptography. Strong cryptography is defined in the...

Accelerating PCI Data Security Standard projects with Deep Security as a Service

Does your organization need to meet PCI DSS requirements? Are you struggling with multiple security tools? Or stretching your already overstretched team to prepare for an audit? Time to hit the accelerator with Trend Micro! If your applications deal with credit or payment card data, you need to g...

Assessing Linux Security Configurations with SCAP Workbench

Recently I had a chance to work with OpenSCAP. It's a set of free and open-source tools for Linux Configuration Assessment and a collection security content in SCAP Security Content Automation Protocol format. In this post I will write about SCAP Workbench. It is a GUI application that can check...

Cb Protection 8.1 Makes Replacing Legacy Antivirus On Critical Systems and Servers Easier Than Ever

Cb Protection, has a long history of innovation in the market. Many have referred to Cb Protection as a pioneer in the application control market. Application control also known as whitelisting is used to lock down critical systems and servers. It's also one of the strongest forms of protection a...

Static vs Dynamic Data Masking: Why Are We Still Comparing the Two?

Earlier this month a leading analyst released their annual report on the state of Data Masking as a component of the overall Data Security sector; which included commentary on what’s known as ‘static’ data masking and an alternative solution known as ‘dynamic’ data masking. And these two solution...

Sending tables from Atlassian Confluence to Splunk

Sometimes when we make automated analysis with Splunk, it might be necessary to use information that was entered or edited manually. For example, the classification of network hosts: do they belong to the PCI-DSS Scope or another group critical hosts or not. In this case, Confluence can be quite ...

PCI DSS v3.2.1 – What You Need to Know

On Thursday, May 17, the PCI Security Standards Council PCI SSC released an updated version of the PCI DSS standard, primarily to include clarifications and minor revisions around controls that referenced SSL/early TLS. The new version removes notes referring to the effective date of February 1,...

PCI Scan Accuracy cannot be verified through Load Balancer with non-identically configured or non-synced systems

The remote has is behind a load balancer either with a non-identical configurations to its peers, or is not synced with its peers. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid109582; scriptversion"1.2"; scriptcvsdate"Date: 2019/04/04 10:19:47";...

What HIPAA and Other Compliance Teaches Us About the Reality of GDPR

with contributing author, William J. Malik, CISA | VP, Infrastructure Strategies The date for General Data Protection Regulation GDPR compliance is just weeks away, yet many organizations, especially those outside Europe, remain unprepared. It turns out that the experiences from other privacy...

Web Form Sending Credentials Using GET (PCI-DSS check)

The remote web application has a form that sends credentials using an HTTP GET request. This can cause sensitive information such as usernames and passwords to be logged by the server in access logs. Authors of services which use the HTTP protocol SHOULD NOT use GET based forms for the submission...

Windows Server 2008 Critical RCE Vulnerabilities (uncredentialed) (PCI/DSS)

According to the version number obtained by NTLM the remote host has Windows Server 2008 installed. The host may be vulnerable to a number of vulnerabilities including remote unauthenticated code execution. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid108811;...

PCI DSS Compliance : Scan Interference

Interference from either the network or the host did not allow the scan to fulfill the PCI DSS scan validation requirements. This report is insufficient to certify this server. There may be a firewall, IDS or other software blocking Nessus from scanning. C Tenable Network Security, Inc...

QID 86725 “F5 BIG-IP Load Balancer Internal IP Address Disclosure”

QID 86725 “F5 BIG-IP Load Balancer Internal IP Address Disclosure Vulnerability” will be marked as a PCI Fail as of May 1, 2018 in accordance with its CVSS score. F5 BIG IP encodes private IP addresses in the persistent cookies, which could be collected by the attacker and decoded back. The...

OS vulnerabilities detected in banner reporting (PCI-DSS check)

A service banner response from the remote host indicates an OS install at a level that may be vulnerable to one or more vulnerabilities. This plugin only runs when 'Check for PCI-DSS compliance' is enabled in the scan policy. It does not run if local security checks are enabled. It runs off of...

Kernel vulnerabilities detected in banner reporting (PCI-DSS check)

A service banner response from the remote host indicates a Linux kernel install at a level that may be vulnerable to one or more non-denial-of-service vulnerabilities. This plugin only runs when 'Check for PCI-DSS compliance' is enabled in the scan policy. It does not run if local security checks...