Platform
Managed Security Services
Managed Penetration Testing
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Resources
March 19, 2023Severity Medium Analysis Summary CVE-2023-0027 Rockwell Automation Modbus TCP AOI Server could allow a remote attacker to obtain sensitive information. By sending a malformed message, an […]March 17, 2023Severity High Analysis Summary CVE-2023-27984 CVSS:7.8 Schneider Electric IGSS could allow a remote attacker to execute arbitrary code on the system, caused by improper input validation […]March 17, 2023Severity High Analysis Summary Chaos is a customizable ransomware builder that emerged on June 9 2021 (in underground forums) by falsely marketing itself as the .NET […]Threat Insights
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Connect with Us
Platform
Managed Security Services
Managed Penetration Testing
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Resources
March 19, 2023Severity Medium Analysis Summary CVE-2023-0027 Rockwell Automation Modbus TCP AOI Server could allow a remote attacker to obtain sensitive information. By sending a malformed message, an […]March 17, 2023Severity High Analysis Summary CVE-2023-27984 CVSS:7.8 Schneider Electric IGSS could allow a remote attacker to execute arbitrary code on the system, caused by improper input validation […]March 17, 2023Severity High Analysis Summary Chaos is a customizable ransomware builder that emerged on June 9 2021 (in underground forums) by falsely marketing itself as the .NET […]Threat Insights
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Connect with Us
Conficker.C Pakistani (.PK) Domains
April 1, 2009The Need for Data Leakage Prevention (DLP)
April 4, 2009
Attackers are modern version of pocket pickers, only more bothersome as unlike pocket picker they not only just steal your wallet but also your personal confidential information. When plastic money i.e credit cards were introduced, they were hailed as a source of convenience and ease. Unfortunately, it proved to be an easy target for scams, frauds, phishing, and other related attacks. To cater that, giants of the credit card industry established Payment Card Industry (PCI) Data Security Standard (DSS) – PCI DSS.
Just as the name suggests, theses are a set of standards to protect from security breaches in credit card payment networks. These standards are governed by a council comprising of American Express, Discover, JCB, MasterCard and Visa. These standards apply to any financial institution, organization, vendor, and merchant that use, store, process, or transmit payment cardholder data.
In some countries, by now businesses must be PCI DSS compliant or else they can lose the ability to process credit card payments and can be heavily fined. In Pakistan, I believe financial institutions must be PCI DSS compliant by 2010. So, it’s the right time to start preparing for the implementation of PCI DSS controls.
To be PCI DSS compliant, company has to follow twelve specified requirements that are organized into six logically related groups.
Control Objectives | PCI DSS Requirements |
| Build and Maintain a Secure Network | 1. Install and maintain a firewall to protect cardholder data |
| 2. Do not use vendor-supplied defaults for system passwords and other security parameters | |
| Protect Cardholder Data | 3. Protect stored cardholder data |
| 4. Encrypt transmission of cardholder data across open, public networks | |
| Maintain a Vulnerability Management Program | 5. Use and regularly update anti-virus software on all systems commonly affected by malware |
| 6. Develop and maintain secure systems and applications | |
| Implement Strong Access Control Measures | 7. Restrict access to cardholder data by business need-to-know |
| 8. Assign a unique ID to each person with computer access | |
| 9. Restrict physical access to cardholder data | |
| Regularly Monitor and Test Networks | 10. Track and monitor all access to network resources and cardholder data |
| 11. Regularly test security systems and processes | |
| Maintain an Information Security Policy | 12. Maintain a policy that addresses information security |
Various revisions in PCI DSS have been released over the years and the current version was released in December 2008 October 2008 (Credit goes to Mr. Yousuf Zubairi for pointing out our lapse here – Thanks alot). Many controversies and criticisms surround these versions that I believe, deserve another post.