Linking your business to more business.

Caught between PCI-DSS compliance mandates and a shrinking budget?

Use our quick contact form above and we'll show you how to become PCI-DSS complient on a seriously tight budget!

Still looking for more conventional answers? Here are some possible resources for PCI-DSS...

http://www.techworld.com/security/pci.cfm#Insight
IP SANs Read more... Soul of a new standard server 22 Sep 05 Unconventional innovation 11 May 05 Infiniband clustering wants to do business 18 Feb 05 PCI Whitepapers 15 October 2008 Automated PCI compliance with Tripwire By Tripwire The credit...

http://www.pcicomplianceguide.org
a free PCI scan from ControlScan Ask the ExpertFrederick Young Fritz Young ControlScan Senior Security Engineer CISSP What do you want to know about PCI ComplianceFeatured Article Written by Fritz Young Feb. 27 2009 Joan HerbigIs PCI compliance a law The...

http://www.technorati.com/search/http://rationalsecurity.typepad.com/blog/2008/1
2003. by AlessandroPerilli Authority 185Additionally VMware is now fully busy pushing its cloud computing vision and if the company wants to convince large corporations to move their data into the cloud better have some security standards supporting the scenario. Otherwise... ago in VMTalk.com Authority 2Additionally VMware is now fully busy pushing its cloud computing vision and if the company wants to convince large corporations to move their data into the cloud better have some security standards supporting the scenario. Otherwise...

http://www.ukhoneynet.org/
tesco.com. Not foolproof but a reasonable reduction in risk. The problem with this is that a lot of stuff I want to buy online is only available from smaller shops. Worse its only available from mid-sized retailers. Ones that are too...

http://chuvakin.blogspot.com/
war with hackers and we need offense. What if it is insurance Or door locks Or something else Something I wanted to highlight for a long time How to Suck at Information Security A very good thing to read next is...

http://riskmanagementinsight.com/riskanalysis/
and Cap Gemini have started publishing free .pdfs on what Jericho networks look like. Note to Cap Gem If you want me to read stuff that is marketing putting dark text on a colored semi-opaque background is ok. If you want... want me to read stuff that is marketing putting dark text on a colored semi-opaque background is ok. If you want me to read a white paper please make it easier to read. My aesthetic whining aside these are good important... get away with it Honestly if this were true would we have any reason to buy Mikes product Doesnt EiQ want you to not just collect data but make sense of it 1 And if we think that Big Chief... have their placeA Couple of Links on Risk Decision Making Filed on January 13 3 comments First I wanted to point you over to Chris Risktical blog. Hell be doing a FAIR analysis over there that looks interesting. Its... post takes a financialeconomic principle Pareto and then applies it to software development. But regarding the useful definition of Blac

http://www.tssci-security.com/archives/2009/02/12/post-to-webappsec-mailing-list
second that you are a regular user with all of those Clickjacking and modern application attacks available to anyone who wants to get to you. Like many of us used the words brick-and-mortar to describe backwards-companies during the dotCom bubble I... better in the morning right after you forget that you just opened up your database to any talented people who want to make money from the data in it. Also pen-testing is dead. We no longer need to prove that applications...

http://pcianswers.com/2008/11/03/cloud-computing-security-and-pci/
year a new technology raises issues about compliance Compliance people claim it cannot be used and technology people claim they want more attention paid to them. Sigh. Expect this to occur out into the future. PCI DSS Compliance with Cloud But... again only if used properly. You see being able to spin up serves on a whim is nice when you want to respond quickly to an incident but you can just as easily spin down compromised servers improperly. Lets say its...

http://www.thecoverofnight.com/blog/
article pointed at this piece of legislation. Some of the intent is good where Senator Cornyn and Rep. Lamar Smith want to prevent child pornography and other contraband from circulating on the internet. I dont necessarily appreciate for other purposes part... what I did is guaranteeing I am not in that category but its a step away from the crowd. I wanted to control some of the data in the TCP segment e.g. payload sequence number dport sport etc. and I wanted... wanted to control some of the data in the TCP segment e.g. payload sequence number dport sport etc. and I wanted something to tell me waves hands in circles if there was possibly an IPS or Firewall in my way that... sport is the dst-port to scan from seq number is current seq number of the packet if we want to mix it up and add arbtrary payloads simply make ppayload into a string or a RandStringsize chars p... and whether or not the security integrated into the software development life cycle is worth the effort. Another q

http://trustseals.wordpress.com/2009/02/10/pci-compliance-explained/
below the transcript of his YouTube video or watch the video below. PCI Compliance is so important that you dont want to miss this. Hi my name is Ward Spangenberg. Im a Delivery Director with IOActive in Seattle Washington. Today Im...

http://paloaltonetworks.wordpress.com/2009/02/17/a-waf-does-not-make-you-pci-com
in many cases more than one is needed. Only those corporations that feel they have web application coding issues or want an added layer of security for their public facing web applications need a WAF. Key attributes of a Web Application...

http://pcidss.wordpress.com/2009/02/13/cloud-computing-and-the-assumed-lack-of-s
the live broadcast should be posted here at the MIT Forum in the next couple of days. One token I want to highlight from the discussion is the concept that utilizing services is inherently insecure. I dont agree with this flat...

http://profitprogram.wordpress.com/2009/03/06/are-you-pci-aware/
follow-up comments via email.search About... David Stelzl is a professional Speaker and author who works with companies and individuals who want to build a unique value proposition around technology solutions and sales. Email Updates Subscribe to Profitprograms Blog by EmailSubscribe in...

http://www.treasuryinstitute.org/blog/
a little slow recently. The reason is that Ive been taking some time off in France in case you were wonderingwanna see the pictures and I just got back. Its not like there hasnt been news. First the plans for the...

http://blog.paymentsecuritypros.com/
cwysopal asked the question Why doesnt the security industry like certifications I knew this would spark quite the debate but wanted to relate it to what we do regulatory compliance. So we PaymentPro posed the question on Twitter Why doesnt the... current security mandate and baseline for your company how can you measure yourself against an industry standard Companies do not want to chase compliance at the expense of security. If a company has a solid informaiton security strucutre in place then...

http://www.mckeay.net/2008/11/02/pci-compliance-in-the-cloud-get-it-in-writing/
on these topics. His rational is that cloud computing is going to happen is happening and will happen whether we want it to or not. He believes that the definition of service provider needs to be re-examined and updated to reflect...

http://mediaphyter.wordpress.com/2008/02/01/security-twits/
Comment by Joel Esler Feb 1 08 1129 amNice initiative Comment by Kees Leune Feb 1 08 1254 pmwanna do the same for pownce. Comment by Joel esler Feb 2 08 524 amJoel You should. Comment...

http://finance.yahoo.com/news/Lib-de-Veyra-Named-prnews-14227762.html
New Zealand Brazil Canada China Chinese France French Canada Germany Hong Kong India Italy Japan Korea Mexico Singapore Spain Spanish Taiwan UK IrelandQuotes and other information supplied by independent providers identified on the Yahoo Finance partner page. Quotes are updated...

http://c.moreover.com/click/here.pl?z1856760814&z=950243767
the attack a script is inserted that determines the origin of the visitor. If a user types the URL they want to visit in the browser bar the legitimate correct content is displayed. However if the user has come from a...

http://www.pciknowledgebase.com/index.php?option=com_frontpage&Itemid=1
which are available for saleClick on the slide You can search the Knowledge Base for any word or term you wantClick on the slide You can find peer feedback by PCI standardClick on the slide You can view peer comments in... EXPERTS which includes nearly 100 PCI assessors QSAs consultants project managers internal auditors security executives and technologists. If you want to ask questions of our panel or learn about what your peers are doing about PCI please visit our free...

http://blog.trigeo.com
before or after it ceased operations. How long will the VCs continue to fund companies with products that customers dont want22. January 2009 0 CommentsThe hunt for the nations first CTO has begun. Theres no shortage of names being considered nor...

http://holisticinfosec.blogspot.com/
essence of this work. Courage my friends...be true to yourselves and the cause. 3 Gunter has further indicated that he wants software vendors to stop acknowledging companies and researchers who buy and sell security vulnerabilities. I must agree entirely here as...

http://www.mccune.org.uk/blog/
you wont have fulfilled the customers requirements. Unfortunately in a lot of cases the customer doesnt actually know what they want they may have heard that they need one of those security test things they may have auditors telling them they...

http://blog.imperva.com/
very interested in being able to identify who when it came to monitoring applications and databases. Beyond the who they wanted to know what the person did when they did it how from where and what was accessed. For a couple...

http://maltainfosec.org/
suck. Except in high profile cases computer forensics and true chain of custody techniques are not followed-- and if you want a computer forensics job youll probably have to work for a large governmentpublic sector bureaucracy and all the fun that...

http://internet-b52.net
of the fingerprints of these three types of activity is the repetitive nature of the attack. Attackers are greedy generally wanting to get in do the work then get out so they are often noisy in doing so. This activity stands...

http://risktical.com
community is capable of applying force or reporting non-compliance on INIs PCI Compliance posture. Here is my reasoning a. INI wants to be ethical and not appear to be covering up vulnerabilities that affect compliance but also could harm consumer confidence... the Initech Inc. page of this blog. 8. Estimate Worst-Case Loss WCL Page 9 of the FAIR BRAG Now we want to start estimating loss values in terms of dollars. For the basic FAIR methodology there are two types of loss...

http://blog.tevora.com/
has many benefits but it also has some hidden costs and pitfalls many organizations dont consider when adopting it. I wanted to touch on two issues which dont seem to be widely known or understood with respect to virtualization security and...

http://pcidss.wordpress.com/2009/01/08/how-to-choose-a-pci-dss-qsa-audit-or/
audit firms that are willing to do the work so a witling process is necessary Consider geographic location - you want one that is local or has resources local so you can have plenty of face time without incurring burdensome travel...

http://www.thetechherald.com/article.php/200905/2849/Does-the-Heartland-breach-p
financial officerin a Washington Post report.We considered holding back another day he addedbut felt in the interests of transparency we wanted to get this information out to cardholders as soon as possible recognizing of course that this is not an ideal... than marketing. There is little information online for the public most of what is will confuse average consumers who only want to know if they are affected by the events.Case in pointwould be the recent press release posted to the site....

http://events.qualys.com/content/pci_myths
Argentina Armenia Aruba Austrailia Austria Azerbaijan Bahamas Bahrain Bangladesh Barbados Belarus Belgium Belize Benin Bermuda Bhutan Bolivia Bosnia and Herzegobina Botswana Bouvet Island Brazil British Indian Ocean Territory Brunei Darussalam Bulgaria Burkina Faso Burundi Cambodia Cameroon Canada Cap Verde Cayman Islands... Territories Panama Papua New Guinea Paraguay Peru Philppines Pitcairn Island Poland Portugal Puerto Rico Qatar Reunion Island Romania Russian Federation Rwanda Saint Kitts and Nevis Saint Lucia Saint Vincent and the Grenadines San Marino Sao Tome and Principe Saudi Arabia Senegal... Lanka St. Helena St. Pierre and Miquelon Sudan Suriname Svalbard and Jan Mayen Islands Swaziland Sweden Switzerland Syrian Arab Republic Taiwan Tajikistan Tanzania Thailand Togo Tokelau Tonga Trinidad and Tobago Tunisia Turkey Turkmenistan Turks and Ciacos Islands Tuvalu Uganda Ukraine United... WYOMING Alberta British Columbia Manitoba New Brunswick Newfoundland and Labrador Northwest

http://beastorbuddha.com/2009/01/27/okay-ill-add-my-2-cents-to-the-heartland-bre
to argue against auditors measuring what you call spirit This is where the subject becomes subjective and you cant expectdont want auditors to carry out risk assessments on the control weakness to get an idea if the spirit is upheld. What... operating environment. This is what I consider the discussions mean by compliance security. I can tell you I dont want a PCI auditor telling me if I am achieving acceptable operational risk. I know and understand my organisations operational risk...

http://blogs.verisign.com/securityconvergence/2009/01/pci_compliant_companies_do
joins another elite group of companies that suffered a breach but was also validated as compliant by a QSA. I want to make something very clear in this next paragraph but before I do none of the comments here should be...

http://www.pciknowledgebase.com/index.php?option=com_content&view=article&id=61&
EXPERTS which includes nearly 100 PCI assessors QSAs consultants project managers internal auditors security executives and technologists. If you want to ask questions of our panel or learn about what your peers are doing about PCI please visit our free...

http://blog.tenablesecurity.com/2008/10/pci-dss-plugins.html
there is no reason to perform a full port scan. One last point for configuring port scans if you want to use the credentialed scanning options be sure to disable the network scan options. If you dont Nessus does not...

http://www.knowpci.com
Base for any word or term you want You can search the Knowledge Base for any word or term you wantClick on the slide You can find peer feedback by PCI standard You can find out what your peers are doing... EXPERTS which includes nearly 100 PCI assessors QSAs consultants project managers internal auditors security executives and technologists. If you want to ask questions of our panel or learn about what your peers are doing about PCI please visit our free...

http://www.imperva.com/pci
Zealand Norway Panama Paraguay Peru Philippines Poland Portugal Russian Federation Singapore Slovakia Slovenia South Africa South Korea Spain Sweden Switzerland Taiwan Thailand Tunisia Turkey Ukraine United Kingdom United States Vietnam otherSpecify your request herePCI Resource Center ResourcesPCI PCI Security Standards Council...

http://www.trust-guard.com/PCI-Compliance-s/65.htm
into 4 levels. I break down the levels and PCI DSS Compliance requirements for each level below but if you want to risk your brain exploding you can find the full PCI DSS documentation here.PA DSS stands for Payment Application Data...