Linking your business to more business.

Caught between PCI-DSS compliance mandates and a shrinking budget?

Use our quick contact form above and we'll show you how to become PCI-DSS complient on a seriously tight budget!

Still looking for more conventional answers? Here are some possible resources for PCI-DSS...

http://www.ukhoneynet.org/
the authors suggest that over 45 web surfers roughly some 637 million people accessed Google with a browser that contained unpatched security vulnerabilities. There is also some interesting analysis of the exposure to plugged in as well as inbuilt vulnerabilities plus...

http://sbin.cn/blog
off till tomorrow if tomorrow might improve the odds. Robert Heinlein This is very interesting point particularly for security patching. Enjoy it. Share ToPosted in English Security Tags Quote SecuritySecurity tools are now officially accomplices to hackers January 16th...

http://bugs.gentoo.org/show_bug.cgi?id=204760
- Assigned_To - Filename Description Type Creator Created Size Actions postgresql-8.2.6.ebuilds.tar.bz2 postgresql 8.2.6 and libpq 8.2.6 ebuild patch conf and init files applicationoctet-stream Michael Kefeder 2008-01-12 2124 0000 8.49 KB Details build.log postgresql-7.3.21-build.log textplain Angelo Arrifano 2008-01-15 1940... 0000 8.49 KB Details build.log postgresql-7.3.21-build.log textplain Angelo Arrifano 2008-01-15 1940 0000 361.25 KB Details Create a New Attachment proposed patch testcase etc. View All Bug 204760 depends on 194098 Show dependency tree Show dependency graph Bug 204760 blocks Additional Comments... sh sparc x86 ------- Comment 9 From Markus Meier 2008-01-13 212419 0000 ------- gtgtgt Unpacking postgresql-7.4.19.tar.bz2 to vartmpportagedev-dblibpq-7.4.19work Applying libpq-7.4.19-gentoo.patch ... Failed Patch libpq-7.4.19-gentoo.patch usrportagedev-dblibpqfileslibpq-7.4.19-gentoo.patch Include in your bugreport the contents of ... Failed Patch libpq-7

http://www.sentrigo.com/
full-visibility database security while simplifying the compliance process. Host-based database activity monitoring Real-time alerts and reporting Immediate breach prevention Virtual patching with no downtimeSpotlight Sentrigo receives SC Magazines Excellence award as Rookie Security Company of the Year Read more ... database security Buffer Overflow Database Activity Monitoring Database Security Hedgehog Enterprise Oracle Security Privilege Escalation Protecting PII SQL Injection Security patches Security policies Zero day hacksContact Us Privacy Policy Site Map Terms ConditionsCopyright Sentrigo Inc. All rights reserved. Sentrigo...

http://www.thecoverofnight.com/blog/
is no comparison or metric for money saved. There are other places where money can be saved like a streamlined patching process or reliability as a result of security but for brevity we will continue on to the other questions that...

http://www.gfi.com/lannetscan/?adv=62&loc=61
security vulnerabilities with minimal administrative effort. As an administrator you have to deal separately with problems related to vulnerability issues patch management and network auditing at times using multiple products. However with GFI LANguard these three cornerstones of vulnerability management are... languages. Not only can you automatically download missing Microsoft security updates but you can also automatically deploy the missing Microsoft patches or service-packs throughout your network at the end of scheduled scans. Network Auditing GFI LANguards Network Auditing tells you all... Features Identify security vulnerabilities and take remedial action Detect Virtual Machines Automatic remediation of unauthorized applications Automatic deployment of network-wide patch and service pack management Easily analyze and filter scan results Other Features Custom vulnerability checks Extensive industrial-strength vulnerabilities database Ensures... and correct problems on the netwo

http://www.net-security.org/secworld.php?id=6995
vendor-supplied patches. Further 46 percent of vulnerabilities from 2006 and 44 percent from 2007 were still left with no available patch at the end of 2008. The McColo shutdown had the most impact on spam activity in 2008 not only affecting...

http://www.scmagazineus.com/IronMail/Review/532/
through the good and bad InfoSec 23 percent of users fall for spear phishing Security during layoffs Inside out Microsoft patches for GDI DNS vulnerabilities How should you ensure PCI DSS compliance DHS National Cybersecurity Center director resignsRussia confirms involvement with...

http://pcianswers.com/2008/10/01/pci-dss-version-12-differences-and-updates/
installed within 30 days of release from the vendor. An organization may consider applying a risk-based approach to prioritize their patch installations. For example companies might ensure high-priority systems and devices are addressed within one month and addressing less critical devices...

http://www.mckeay.net/2008/11/02/pci-compliance-in-the-cloud-get-it-in-writing/
on it The service provider is still responsible for the physical security of the systems theyre still responsible for the patching and security of the underlying operating systems. Even when we talk about virtualization on your own network the same PCI... clients you have less visibility into whats going on lower in the stack and you have a new set of patching and vulnerability concerns to be worried about. Rather than reducing your stress levels and potential to be compromised cloud computing...

http://yashkadakia.blogspot.com/
will not be going into detail about these vulnerabilities in this posts as I will wait for vendor responses and patch releases before I do so. However I do want to talk about Fuzzing in general. What is a Fuzzer A...

http://www.mccune.org.uk/blog/
for a more expensive more restrictive electronic implementation are pretty slimDNS vulnerability - are there any other mitigations apart from patching By Rory2 on July 22 2008 916 AM 1 Comment No TrackBacksWell as Im sure everyone is aware... bit early. Im not going to get into the politics of whether thats a good thingbad thing or how urgent patching is as its been done to death elsewhere... I was thinking though about how it may be possible to mitigate... to death elsewhere... I was thinking though about how it may be possible to mitigate this in other ways than patching... Having heard the detailed explanation from matasano on the vulnerability wouldnt it be possible to mitigate this by changing the...

http://newsteam.scmagazineblogs.com/2009/01/23/is-pci-working-maybe-maybe-not/
High tech IM Industry reports Lawbreakers Legal and professional services Manufacturing Mergers and acquisitions Microsoft Mobile and Endpoint Security Non-Microsoft patches Non-profit Open source Opinion Patch Management Patch Tuesday Personnel moves Phishing Piracy Privacy Product news Rootkits SC Magazine SC Magazine...

http://www.secureconsulting.net/2009/02/pci_dss_v12_in_a_nutshell.html
be allowed access to servers in the DMZ and to nowhere else. Such a requirement could introduce interesting challenges for patch and vulnerability management if strictly adhered to. 3. Personal firewall software is required on mobile and employee-owned computers with direct... Requirement 6 Develop and maintain secure systems and applications Summary Implement patch and vulnerability management policies and procedures. Critical security patches must be applied within 1 month using a risk-based approach to prioritizing patches. Software must be developed using secure coding... prioritizing patches. Software must be developed using secure coding practices within a software development lifecycle. The lifecycle must address testing patches and configuration changes prior to deployment including validating input proper error handling secure storage of cryptographic materials secured communication and... including regular code review at least annually or the deployment of a web application

http://blog.tenablesecurity.com/2008/10/pci-dss-plugins.html
mis-configured or has out-of-date signatures. PCI Requirement 6 The Security Center is the premier tool to manage scanning data patch audit data configuration data and passively obtained network data. With the Security Center it is trivial to schedule scans identify...

http://www.acunetix.com/websitesecurity/pci-compliance-wp.htm
device weaknesses and incorrectly configured user rights. These security risks are resolved by various configurations and application of security software patches and updates. Any changes in a network infrastructure may open potential security breaches therefore regular scans must be on any...

http://nickcoblentz.blogspot.com/2009/02/pci-compliance-and-cloud-computing.html
Takeaway Its unclear whether the cloud computing providers applications like Amazons web services must be assessed. Additionally the cloud providers patch management process should be verified and documented. Requirement 7 Restrict access to cardholder data by business need to know Amazon...