ISC2 Blog

PCI Onsite Assessment - Part 5

Part Five - Selecting a QSA! This is the fifth chapter in a series about preparing for and going through a PCI assessment;... 1. Part One - Intro to a PCI on-site assessment & the QSA selection process 2. Part Two - Preparation for an on-site assessment and what to do first! 3. Part Three - Defining your scope so you know what you’re assessing 4. Part Four - Authoring a PCI On-site Assessment RFP 5. Part Five – Selecting a QSA to conduct an on-site PCI assessment 6. Part Six – Preparing your Company and I.T. department for the... Read more →

PCI Onsite Assessment - Part 4

Part Four - Authoring your PCI on-site assessment RFP This is the fourth chapter in a series about preparing for and going through a PCI assessment;... 1. Part One - Intro to a PCI on-site assessment & the QSA selection process 2. Part Two - Preparation for an on-site assessment and what to do first! 3. Part Three - Defining your scope so you know what you’re assessing 4. Part Four - Authoring a PCI On-site Assessment RFP 5. Part Five – Selecting a QSA to conduct an on-site PCI assessment 6. Part Six – Preparing your Company and I.T.... Read more →

PCI Onsite Assessment - Part 3

Part Three - Defining your scope so you know what you're assessing This is the third chapter in a series about preparing for and going through a PCI assessment;... 1. Part One - Intro to a PCI on-site assessment & the QSA selection process 2. Part Two - Preparation for an on-site assessment and what to do first! 3. Part Three - Defining your scope so you know what you’re assessing 4. Part Four - Authoring a PCI On-site Assessment RFP 5. Part Five – Selecting a QSA to conduct an on-site PCI assessment 6. Part Six – Preparing your... Read more →

BSIMM2

A considerable change from the first Build Security In Maturity Model. Version 2 has more structure, but I'm not sure that the two-dimensional model adds much. It still isn't a "maturity" model as such. Still, anything that gets more app dev security advice out there ... Read more →

Privacy economics

An interesting paper looking at the risks, risk management, and legal economics of breaches of privacy. Much of the material is fairly standard, but it also looks at different types of controls (such as preventative and recovery) in regard to data breaches, disclosure laws, and standards such as PCI DSS. Valuation of assets is also a factor. (Free download, as of this posting.) Read more →

CSIRT exercise

ENISA (European Network and Information Security Agency)has extensive materials on setting up a CSIRT (Computer Security Incident Response Team). They have also provided significant exercise materials in order to test and train such teams. Read more →

Patent Absurdity

Patents are generally held to be granted on devices, or inventions. In recent years, United States patents have been granted on processes, and even software. "Patent Absurdity" is a half hour video outlining the dangers and difficulties surrounding the granting of software patents. The interviews take place around the "Bilski" case appeal before the Supreme Court. (The "Bilski" case decision is generally held to strike down software patents, but is still the subject of a good deal of debate.) Read more →

PCI Onsite Assessment - Part 2

Part Two - Preparation for on-site assessment! This is the second chapter in a series about preparing for and going through a PCI assessment;... 1. Part One - Intro to a PCI on-site assessment & the QSA selection process 2. Part Two - Preparation for an on-site assessment and what to do first! 3. Part Three - Defining your scope so you know what you’re assessing 4. Part Four - Authoring a PCI On-site Assessment RFP 5. Part Five – Selecting a QSA to conduct an on-site PCI assessment 6. Part Six – Preparing your Company and I.T. department for... Read more →

PCI Onsite Assessment - Part 1

Part One - Introduction to a PCI on-site assessment This is the first chapter in a series about preparing for and going through a PCI assessment; 1. Part One - Intro to a PCI on-site assessment & the QSA selection process 2. Part Two - Preparation for an on-site assessment and what to do first! 3. Part Three - Defining your scope so you know what you’re assessing 4. Part Four - Authoring a PCI On-site Assessment RFP 5. Part Five – Selecting a QSA to conduct an on-site PCI assessment 6. Part Six – Preparing your Company and I.T.... Read more →