Linking your business to more business.

Caught between PCI-DSS compliance mandates and a shrinking budget?

Use our quick contact form above and we'll show you how to become PCI-DSS complient on a seriously tight budget!

Still looking for more conventional answers? Here are some possible resources for PCI-DSS...

http://www.watchguard.com/
DescriptionWatchGuard gives you powerful firewall and VPN appliances for small and medium-size enterprises. ... DescriptionWatchGuard gives you powerful firewall and VPN appliances for small and medium-size enterprises.KeyWordswatchguardfireboxlivesecuritynetwork securityzero day protectiontrainingactivate fireboxunified threat managementUnited States Deutschland Espaa France Italia ... and our worldFree Trial Sign Up NowWatchGuard Finance Get more. Right now.For over a decade WatchGuard has provided reliable easy-to-manage firewall and VPN appliances to hundreds of thousands of businesses worldwide. Our best-selling Firebox X family of unified threat management UTM...

http://www.breach.com/resources/breach-security-labs/alerts/breach-security-labs
for database corruption or malware to be downloaded to website visitors. PCI DSS non-compliance.Resolution Verify blocking policy in web application firewall and remediate code flaws.Who Thousands of websites around the world have been successfully compromised with a mass generic SQL injection... Web Application Security Project OWASP their sites would have been protected. In addition deployment of a Breach Security web application firewall prevents the attack.Resolution Breach Securitys web application firewalls enable security organizations to pinpoint security vulnerabilities in code for quick remediation... have been protected. In addition deployment of a Breach Security web application firewall prevents the attack.Resolution Breach Securitys web application firewalls enable security organizations to pinpoint security vulnerabilities in code for quick remediation and offer continuous protection by detecting and blocking...

http://chuvakin.blogspot.com/
look out of your high-floor ivory tower window youd see there is a ginormous crowd of people who confuse a firewall with a fire-extinguisher And those people have your credit card data SSNs and medical records in their computers Get it...

http://www.cgisecurity.com/web_application_firewalls/
Web Application Firewalls Permalink Reddit Comments 0 TrackBack 0 Read more of this story...Web application firewalls for security and regulatory complianceIf youre not familiar with web application attacks we covered them in detail in a previous... his points however one in particular Im going to have to disagree with and that related to using Web application firewalls. For many years Ive been anti Web application firewall and as...Posted by Robert A. on 06192008 in Commentary Defense... 0 TrackBack 0 Read more of this story...Ivan Ristic On Web AppFirewalls Tide is turning for web application firewallsIvan Ristic has posted his thoughts on the web application firewall market. While Ivan works for a vendor he has been... Ristic On Web AppFirewalls Tide is turning for web application firewallsIvan Ristic has posted his thoughts on the web application firewall market. While Ivan works for a vendor he has been working on mod_security for years and is extremely knowledgeable on..

http://www.tssci-security.com/archives/2009/02/12/post-to-webappsec-mailing-list
available to adversaries and new ways of establishing covert channels. This means a few things. First of all the word firewall is dead and therefore the word web application firewall and the associated acronym WAF are also dead. Imagine today if... once. This is cloud computing but virtualized. Not only that but we are saying that adversaries have already bypassed traditional firewalls by using the application layer i.e. Hacking Intranets from Jeremiah Grossman. Thus this master covert control channel is already on... a process. Its not a silo as alluded to in this post stating because one can get past a firewall that it is killing the word kills the technology now dead. A layered defense is still useful and needed if... an inline device. right but having something that can do something about it is advantageous. At that point the firewall can just be another point of inspection but with broader capabilities. The clincher for me is the hypocrisy stated here... am a firm believer that

http://pcianswers.com/2008/11/03/cloud-computing-security-and-pci/
explain this by telling a little story. I routinely ask people if they can be PCI compliant by using a firewall. They look at me strangely and then consider how a firewall could be used to segment a network and reply... can wait for it properly configure your own servers to meet the PCI DSS requirements. Dont have a firewall Im sure your provider is willing to sellrent you one that here we go again you can define...

http://tssci-security.com/
available to adversaries and new ways of establishing covert channels. This means a few things. First of all the word firewall is dead and therefore the word web application firewall and the associated acronym WAF are also dead. Imagine today if... once. This is cloud computing but virtualized. Not only that but we are saying that adversaries have already bypassed traditional firewalls by using the application layer i.e. Hacking Intranets from Jeremiah Grossman. Thus this master covert control channel is already on...

http://net-security.tradepub.com/
podcasts to find the titles that best match your skills and interests topics include authentication hacking internet privacy and internet firewalls. Simply complete the application form and submit it. Remember to fill out the forms COMPLETELY. All are...

http://www.watchguard.com/account/shortreg.asp?t=pci_saq_hp
on regulatory business technology and information security challenges.The PCI DSS SAQ provides an easy way for merchants to use WatchGuard firewall and VPN solutions and other technologies to deliver continuous compliance with the PCI DSS requirements. With the SAQ you canWatchGuard...

http://www.pciassessment.org/pci-expertise.php#
for PCI DSS compliance.The PCI DSS standards require an advanced knowledge of information security and all supporting drivers such as firewalls intrusion detectionprevention logical security and access control mechanisms encryption methods along with system monitoring and logging just to name a...

http://jtgraves.wordpress.com/2009/02/16/security-is-not-a-checklist/
the organization and the costs of the security measures. Its a flexible approach but it doesnt provide many answers. Are firewalls required Does internal traffic have to be encrypted It depends. As a checklist PCI DSS is more to the point.... depends. As a checklist PCI DSS is more to the point. Companies know exactly whats expected. They have to have firewalls between untrusted networks and any cardholder data environment PCI DSS Requirement 1.2 install personal firewall software on laptops Requirement 1.4...

http://trustseals.wordpress.com/2009/02/10/pci-compliance-explained/
is I have to understand all twelve of those requirements and sub-points underneath those requirements. We have things like understanding firewalls and the firewall rule sets to actual compliance regulations. Do you have HR Are you doing things like background checks... of the first requirements is sitting down and documenting and understanding what your network is all about understanding what your firewalls are doing understanding what your rules sets involved in this firewall. Are we protecting credit card data that is coming...

http://paloaltonetworks.wordpress.com/2009/02/17/a-waf-does-not-make-you-pci-com
those that may take advantage of the coding errors. Unable to perform many of the functions that a network firewall will do such as network segmentation. Look only at the specific L7 fields of a web application they... a very small subset of the application traffic and as such cannot address the network throughput requirements of a network firewall. Palo Alto Networks next-generation firewalls enable policy based visibility and control over applications users and content traversing the network. The... of which application is traversing the network who is using it and the associated threats is the basis of all firewall security policies including access control SSL decryption threat prevention and URL filtering. Key attributes of Palo Alto Networks next-generation firewall... firewall security policies including access control SSL decryption threat prevention and URL filtering. Key attributes of Palo Alto Networks next-generation firewall Designed to be a primary firewall identifyi

http://pcidss.wordpress.com/2009/02/13/cloud-computing-and-the-assumed-lack-of-s
We currently operate our own data centers in the happy walls of our buildings and push packets out of our firewalls to clients suppliers BPO providers 401k processors partners remote offices home office team members coffee shop workers and numerous other...

http://www.artofdefence.com/
Descriptionart of defence - web application security and web application firewall plugin for apache and microsoft server ... Descriptionart of defence - web application security and web application firewall plugin for apache and microsoft serverKeyWordsWeb Security Security Sicherheit XSS CSRF Exploit Session Riding Angriffsmethoden Hacking Sicherheitsscan Security Consultant SektionEins... Security Consultant SektionEins Viren Hacker Application Firewall Angriffe auf Anwendungsebene Buffer-Overflow-Exploits SQL-Injection Cross-Site-Scripting web security 2.0 email server exchange server firewall router web proxy internet filtering internet threat protection web filter content filter web filter appliance content filter appliance waf WAF...

http://pcianswers.com/2008/10/01/pci-dss-version-12-differences-and-updates/
are combined into 1.1.5 - business justification and documentation of secure service implementation. In version 1.1 quarterly review of firewall and router rule sets. In version 1.2 Requirement to review firewall and router rule sets at least every six... implementation. In version 1.1 quarterly review of firewall and router rule sets. In version 1.2 Requirement to review firewall and router rule sets at least every six months. Now the control can be better customized to the organizations risk...

http://www.treasuryinstitute.org/blog/
least there is a long list of known bad guy IP addresses with the suggestion that you update your firewalls to prevent any users from going there. All of this is good stuff. Make sure youre on top of these...

http://blog.paymentsecuritypros.com/
only real and scalable approach towards not just security but also compliance. Im famous for asking the question Can a firewall be used to segment a network Most people will say yes but I will say no. I feel the paradigm...

http://www.mckeay.net/2008/11/02/pci-compliance-in-the-cloud-get-it-in-writing/
or members that control or could impact the security of cardholder data. Examples include managed service providers that provide managed firewalls IDS and other services as well as hosting providers and other entities. Entities such as telecommunications companies that only provide...

http://rationalsecurity.typepad.com/blog/2008/10/please-help-me-i-need-a-qsa-to-
me I dont know if I meet any of the following PCI requirements PCI12-requirements I dont know if there are firewalls. I dont know about the cloud-vendors passwords AV access controlmonitoring vulnerability management or security processes. A friend told me about...

http://www.theenterprisecloud.com
meets SAS 70 Type II requirements essential for companies subject to information security regulations like Sarbanes-Oxley HIPAA and GLBA. Integrated firewalls and private VLAN architecture provide a secure network infrastructure. All connections to the Infinicenter management console are secured by SSL...

http://rss.tradepub.com/?br=hackerscenter&feed=information_technology_security
Box seeks to consolidate what you might already be doing with multiple point solutions like web email filters VPN and firewall. If combining all of these technologies on to a single easy to use platform sounds like a better idea to...

http://darkreading.com/blog/archives/2009/02/pci_dss_is_a_pr.html
KeyWordsDark Reading security network security computer security virus spyware spam phishing malware worm hacker firewall encryption VPN intrusion prevention intrusion detection wireless security network access control authentication exploits threat vulnerabilities SSL compliance regulation penetration test...

http://internet-b52.net
networks especially where network paths involve multiple router hops or tunneling. UDP may also be blocked at a router or firewall preventing the syslog traffic from flowing. Secondarily the configuration of standard Unix syslogd offers little flexibility beyond facility and priority... over the months. Scenario Details Heterogeneous UnixLinuxWindows hosts Heterogeneous CiscoJuniperother network devices Geographically dispersed data centers and points-of-presence POP Compartmentalized firewalls networks Requirements for PCI SOX and other monitoring Requirements for remote logging to aid in intrusion detection and forensics Components...

http://risktical.com
percentage of American PCs have anti-malware software AV Spyware but a large number of consumers still do not have firewall software installed anti-spam or anti-phishing capabilities. b. The INI survey results would indicate that INIs consumers are security aware and...

http://blog.tevora.com/
default build for SuSe that you prefer then by all means use it just make sure to open the appropriate firewall ports for Splunk and administering the system 22 and 443 to start with more to be added as we go...

http://www.bhi.com/secureconnect_pci.htm
for compliance organized into six control objectives. These includeBHI Advanced Internet is able to address every objective that applies to firewalls anti-virus configurations and on-going management with SecureConnect. SecureConnect addresses the specific requirements of installing and maintaining a firewall configuring a... applies to firewalls anti-virus configurations and on-going management with SecureConnect. SecureConnect addresses the specific requirements of installing and maintaining a firewall configuring a firewall without using defaults for system passwords or other security parameters encrypting transmission of outgoing cardholder data using...

http://www.thetechherald.com/article.php/200905/2849/Does-the-Heartland-breach-p
must install and maintain a firewall to protect cardholder data. In IT Industry Best Practice tells you to use a firewall to block all incoming and outgoing traffic to the network allowing only select ports access. This is often referred to... case with the Hannaford breach the Heartland breach took advantage of problems that were not related to port lockdowns and firewall configurations. The firewall was circumvented by other non-disclosed means.We know this because both Heartland and Hannaford were PCI certified they... they had to meet Requirement 1 to earn this certification. So there had to have been another route past the firewalls.So should Heartland be doing anything in the aftermathIt already has by looking into security upgrades and creating a public Web...

http://beastorbuddha.com/2009/01/27/okay-ill-add-my-2-cents-to-the-heartland-bre
US10K per annum fee for bringing the profession into dis-repute. The ones that often generate config checking involve 1.2 Examine firewall and router configurations to verify that connections are restricted between untrusted networks and system components in the cardholder data environment...

http://www.secureconsulting.net/2009/02/pci_dss_v12_in_a_nutshell.html
requirements listed within PCI with associated summary commentary and specification of actionable items. Requirement Requirement 1 Install and maintain a firewall configuration to protect cardholder data Summary You need to implement a DMZ for your cardholder environment within which you need... are exposed along with a justification and description of security measures taken. In general all untrusted network connections must be firewalled including to the Internet partner networks and wireless environments. Rules must be narrowly focused limiting both ingress and egress traffic.... such as by using NAT with IP masquerading and servers should not be allowed to open new egress connections. The firewalls must not be bypassable to the Internet and must be stateful inspection type firewalls. All rule sets must be reviewed... to open new egress connections. The firewalls must not be bypassable to the Internet and must be stateful inspection type firewalls. All rule sets must be reviewed at

http://www.pciassessment.org/pci-bb/
and Maintain a Secure Network Topics Posts Last post Install and Maintain a Firewall Requirement 1 Install and maintain a firewall configuration to protect cardholder data. 37 Topics 39 Posts Last post by Alexnatter View the latest post Fri Mar 06...

http://teldata.wordpress.com/2007/11/15/about-the-pci-data-security-standard-pci
the specific elements of the DSS are organized Build and Maintain a Secure Network Requirement 1 Install and maintain a firewall configuration to protect cardholder data Requirement 2 Do not use vendor-supplied defaults for system passwords and other security parameters Protect...

http://nickcoblentz.blogspot.com/2009/02/pci-compliance-and-cloud-computing.html
administrators within an organization. This means everyone must share a single account to turn on images remove images and make firewall changes. One way this can be addressed is by creating a custom interface to Amazons API. The custom interface should...