PCI DSS 3.0 ROC Reporting Template Released

Heads up for our PCI customers: the PCI SSC released the "ROC Reporting Template for v3.0" this last weekend and it is available here. This document supports the PCI DSS 3.0 standard and must be used by all QSA organizations to create and submit a Report on Compliance ROC. What does this mean?...

[Lynis 1.4.0] Security and System Auditing Tool to Harden Linux Systems

Lynis is an auditing tool for Unix/Linux. It performs a security scan and determines the hardening state of the machine. Any detected security issues will be provided in the form of a suggestion or warning. Beside security related information it will also scan for general system information,...

Are you ready for PA-DSS 3.0?

Theres been a lot of chatter about PA-DSS 3.0 among several early-adopter application vendors. As of January 1, 2014 its permissible to validate against 3.0 in place of a 2.0 validation. Longevity of the 3.0 validation and the desire to be validated first on a new standard seem to be driving the...

RAM Scrapers and the Target Data Breach

The retail and hospitality industries have a painful history with wonky point-of-sale systems and malware known as RAM scrapers. These attacks, which date back as many as six years, are designed to be injected into running processes and steal payment card data before it’s encrypted by a...

[dotDefender] Web Application Security

dotDefender is the market-leading software Web Application Firewall WAF. dotDefender boasts enterprise-class security, advanced integration capabilities, easy maintenance and low total cost of ownership TCO. dotDefender is the perfect choice for protecting your web site and web applications today...

Use of 3DES to Encrypt Stolen Target PIN Data Invites Worry

Target Corp.’s admission that encrypted PIN data was stolen in the Black Friday breach was bad news for consumers. For security experts, especially cryptographers, particular exception was taken to the retail giant’s use of Triple DES 3DES encryption to keep the PIN data safe. With all crypto...

Free and low-cost tools for PCI DSS Compliance

Complying with the PCI DSS requires policies and processes plus implementing and managing a variety of software tools. As a QSA who has performed many PCI assessments for merchants and service providers, Ive seen and assessed a variety of free and low-cost under $200 software tools that help our...

[Matriux Leandros v3.0 rc1] The pentesting distrib (Now added Blackhat Arsenal 2013 Tools)

Matriux is a Debian-based security distribution designed for penetration testing and forensic investigations. Although it is primarily designed for security enthusiasts and professionals, it can also be used by any Linux user as a desktop system for day-to-day computing. Besides standard Debian...

Importance of Logs and Log Management for IT Security

IT Security is the name of the game and no matter how big or small the size of your organization, you will always invest enough on securing certain aspects of your IT network. In many organizations, it starts with monitoring your network for vulnerabilities that may enter the network to access...

PCI DSS 3.0 puts emphasis on year-round awareness

Its easy to think of PCI compliance as just another annual hoop to jump through. Of course, after the annual audit, the business is safe for another 12 months, right? Well, not exactly, and with the upcoming release of PCI DSS 3.0, there will be an even bigger reason to think about compliance...

Highlights of Newly Released PCI DSS 3.0 Information

The standards are coming! The PCI SSC has finally let loose with some much needed information regarding the upcoming releases of the PCI DSS 3.0 and PA DSS 3.0 standards. Available on the PCI SSC website; the document titled "Version 3.0 Change Highlights" contains information on what PCI...

PuTTY 0.52 to 0.62 Multiple Vulnerabilities

The remote host has an installation of PuTTY version 0.52 or greater but earlier than version 0.63. As such, it is reportedly affected by the following vulnerabilities : - An overflow error exists in the function 'modmul' in the file 'putty/sshbn.c' that could allow heap corruption when handling...

Apparel Company Files Landmark Lawsuit Against Visa in PCI Dispute

A Tennessee-based footwear and apparel company has filed a $13 million lawsuit against Visa for what it considers random, subjective penalties for being out of compliance with the Payment Card Industry PCI standard the credit card company regulates. Last week Nashville-based Genesco, which operat...

Retailer Challenges Visa $13.2M PCI Fine in Court

Genesco Inc., a Tennessee-based shoe retailer, is taking Visa to court in what is being reported as the first case challenging fines and penalties levied by the Payment Card Industry Data Security Standard PCI DSS under which Genesco was fined $13.3 million. In late 2010, attackers compromised...

Microsoft ASP.NET MS-DOS Device Name DoS (PCI-DSS check)

The web server running on the remote host appears to be using Microsoft ASP.NET, and may be affected by a denial of service vulnerability. Requesting a URL containing an MS-DOS device name can cause the web server to become temporarily unresponsive. An attacker could repeatedly request these URLs...

P2PE Hybrid, the next best thing since the Prius

P2PE promises many things, the most coveted being scope reduction for the merchant and a shifting of the compliance burden from the merchant to the service provider. A properly implemented P2PE solution can indeed reduce the risk of compromise for a merchant as well as reduce the scope of what mu...

Attorney Adds Security Company, State IT Department to Data Breach Lawsuit

A former South Carolina lawmaker has added the data security firm Trustwave and the state’s technology department to a lawsuit filed in the wake of a massive data breach at the state’s Department of Revenue. The Associated Press reports attorney John Hawkins in an amendment claims Trustwave...

PCI DSS Compliance : Handling False Positives

Note that per PCI Security Standards Council PCI SSC standards, if the version of the remote software is known to contain flaws, a vulnerability scanner must report it as vulnerable. The scanner must still flag it as vulnerable, even in cases where a workaround or mitigating configuration option ...

Airlock WAF 4.2.4 Overlong UTF-8 Sequence Bypass

Exploit for multiple platform in category dos / poc title: Airlock WAF overlong UTF-8 sequence bypass product: Airlock vulnerable version: = 4.2.4 without hotfix HF4213 fixed version: 4.2.5 impact: critical homepage: http://www.ergon.ch/ found: 2012-04-05 by: G. Wagner SEC Consult Vulnerability L...

Surprises Ahead for Some Level 2 Merchants

The PCI DSS has been around for years, and most PCI "pros" are familiar with the processes needed to validate compliance. However, insiders often forget that small changes to the guidelines can have a big impact on merchants. One such change is upon us: MasterCards new validation guidelines for...