#pcidss — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #pcidss, aggregated by home.social.
-
💳 PCI vulnerability management is more than scanning.
Validate findings. Fix the root cause. Verify the remediation.
Learn how penetration testing and code audits strengthen PCI DSS security.
👉 https://7asecurity.com/blog/2026/06/pci-vulnerability-management-find-fix-verify-cyber-risks/ -
✈️ New Blog Post: Your Boarding Pass Is a Skeleton Key. Frontier Airlines Doesn't Care.
Frontier's mobile API returns full passport numbers, home addresses, children's DOB, credit card details, and KTNs for any booking. The only auth? A PNR and last name. Printed on every boarding pass.
Reported March 3rd. 105 days later, still live. They fixed the least important vuln and ghosted me on the rest. They also updated the website code and somehow made the leaks worse.
Full writeup: https://bobdahacker.com/blog/frontier-airlines-hack
#InfoSec #BugBounty #ResponsibleDisclosure #FrontierAirlines #Security #CyberSecurity #Privacy #Aviation #PCIDSS #DataExposure
-
PCI DSS 4.0.1 is 2 years old. are you compliant?
march 2025 came and went
PCI DSS 4.0.1 requirement 5.4.1 made anti-phishing controls mandatory
DMARC at p=reject is the clearest path to satisfy it
yet most merchants I check still sit at p=none
auditors are starting to flag this
the standard is enforceable now
if you process card payments, your DMARC policy is an audit line item
-
The annual scurry for PCI DSS 4.0 audit logs is essentially a tax on your engineering team's innovation. 📉💸
By building on Upsun, you can avoid the heavy lifting of OS hardening and patching through inherited controls. 🤖🛡️
Shift your focus back to application logic and reclaim your product roadmap from the burden of regulatory plumbing. ⚡☁️✨
-
💳 PCI DSS compliance ≠ real security.
Scans alone won’t stop attackers.▶️ https://7asecurity.com/blog/2026/05/pci-dss-vulnerability-management/
-
Security isn’t a checkbox — it’s a commitment.
RELIANOID’s latest 𝗣𝗖𝗜 𝗗𝗦𝗦 𝗖𝗼𝗺𝗽𝗹𝗶𝗮𝗻𝗰𝗲 𝗦𝘁𝗮𝘁𝗲𝗺𝗲𝗻𝘁 shows exactly how that commitment translates into action.From network security to incident response, RELIANOID aligns with key PCI DSS requirements to help organizations operate confidently within or alongside the 𝗖𝗮𝗿𝗱𝗵𝗼𝗹𝗱𝗲𝗿 𝗗𝗮𝘁𝗮 𝗘𝗻𝘃𝗶𝗿𝗼𝗻𝗺𝗲𝗻𝘁 (𝗖𝗗𝗘).
If PCI DSS matters to your business, this is worth your attention.
👉 Dive into the full statement: https://www.relianoid.com/security-compliances/pci-dss-compliance/
-
PCI DSS is a global security standard that applies to any fintech handling payment card data. It defines 12 requirements covering data protection, access control, network security, and vulnerability management.
-
𝗚𝗼𝗼𝗴𝗹𝗲 𝗮𝗻𝗱 𝗬𝗮𝗵𝗼𝗼 𝗮𝗿𝗲 𝗿𝗲𝗷𝗲𝗰𝘁𝗶𝗻𝗴 𝘂𝗻𝗮𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗲𝗱 𝗲𝗺𝗮𝗶𝗹. 𝗜𝘀 𝘆𝗼𝘂𝗿𝘀 𝗻𝗲𝘅𝘁?
Not filter. Reject.
I scanned 5.5M domains.
Only 30.4% have a DMARC record.
Only 12.8% are at enforcement (p=quarantine or p=reject).That means 87% of domains are exposed. Check yours in 10 seconds.
No signup required.
https://dmarcguard.io/tools/dmarc-checker/ -
@xeraa Das Problem ist auch Graylog. Wir hängen an Graylog 6.0.14, weil das die letzte Version ist, die mit dem ELK 7.10 zusammenarbeitet. Für Graylog 6.1 braucht es dann eine sehr aufwende ELK / OpenSearch Migration und die bringt Probleme mit sich. Mein Kollege könnte da genaueres sagen .. aber es war etwas nicht triviales.
Man hat sich dazu entschieden, die Speicherdauer auf 3 Monate zu reduzieren, da unser Syslog (rsyslog) das ganze Jahr speichert, um den #pcidss #auditor glücklich zu machen.
Parallel wird geschaut, #victorialogs parallel laufen zu lassen, da der nur einen Bruchteil an Kapazität in Anspruch nimmt.
-
Passwords are where PCI DSS compliance often breaks down https://www.helpnetsecurity.com/2026/01/08/passwords-pci-dds-compliance/ #passwordmanager #compliance #Don'tmiss #Hotstuff #Passwork #PCIDSS #News
-
GRC rarely feels like “governance, risk, and compliance” and more like alphabet soup with lawyers attached.
I wrote up how I approach GRC as an Associate CCISO: one risk-based program mapped to HIPAA, PCI DSS, NIST CSF, FTC Safeguards, and NIS2 instead of five separate nightmares.
#GRC #CyberSecurity #InfoSec #Compliance #HIPAA #PCIDSS #NISTCSF #NIS2
-
Chase account tells me that #Animoto is storing my payment card information despite me closing the account. I reached out to them, and they confirmed my account has been closed. That is NOT why I contacted them. I contacted them because my card company believes they are still holding onto my payment information. I do not know how they know that, but apparently they do, and it shows on the security page at Chase. Chase says they cannot remove it and I must contact the merchant.
-
PCI DSS 4.0 represents a philosophical shift from point-in-time validation to continuous, risk-based assurance.
Ready to operationalize compliance as a continuous practice?
Join us today at 10am PT / 1pm ET for a joint session with ControlCase and PCI DSS author Branden R. Williams.
In this webinar, we'll explore:
> The new compliance paradigm: Understanding the intent behind PCI DSS 4.0 changes and what continuous assurance means for your operations.
> Automation at scale: How to automate and scale assessment processes while maintaining control and visibility.
> Infrastructure for compliance: Using the SecOps Cloud Platform as your central compliance data layer with built-in retention, auditability, and integration capabilities.
> MSSP opportunities: How service providers can efficiently scale compliance services and create new revenue streams.
Learn how to build compliance operations that support business growth and trust.
Register now: https://limacharlie.wistia.com/live/events/nm3o9l8509?utm_campaign=pci+webinar+11+12+25&utm_source=mastodon&utm_medium=social
-
Two days until our PCI DSS 4.0 webinar with ControlCase and author Branden R. Williams.
Wednesday, November 12th at 10am PT / 1pm ET.
PCI DSS 4.0 is more than new requirements. It's a shift to continuous, risk-based security that creates opportunities for organizations that embrace it.
We'll cover:
> What's changed and why it matters
> How to interpret the intent behind the requirements
> Operationalizing continuous compliance
> Creating competitive advantages through automated assessment and enforcementDesigned for security engineers, compliance architects, and service providers building scalable compliance operations.
Last chance to register: https://limacharlie.wistia.com/live/events/nm3o9l8509?utm_campaign=pci+webinar+11+12+25&utm_source=mastodon&utm_medium=social
-
PCI DSS 4.0 isn't just a compliance update. It's a fundamental shift to continuous, risk-based security.
Join LimaCharlie, ControlCase, and author Branden R. Williams on Wednesday, November 12th at 10am PT to learn how to turn compliance from a burden into a competitive advantage.
What you'll learn:
> What's changed in PCI DSS 4.0 and why
> How MSSPs can create new revenue opportunities through compliance as a service
> Building continuous compliance operations with automated data collection and enforcement
> Practical approaches to auditability, retention, and integrationRegister now: https://limacharlie.wistia.com/live/events/nm3o9l8509?utm_campaign=pci+webinar+11+12+25&utm_source=mastodon&utm_medium=social
-
Auch in der Firma geht es voran: Für #pcidss (4.x!!!!)sind die unangenehmen Fragen für uns durch. Nur noch Pakete schnüren und alles hochladen zzgl. gefixter Incidents (Icinga Checks für ClamAV Prozess) und dann abwarten. Die Entwickler haben etwas mehr zu tun.
Und hab neues #logsystem fast schon komplett. #fluentbit wird #nxlog ersetzen. #victorialogs wird eine Weile parallel zum #Graylog laufen und die mangelnde Auth Fähigkeit von vmlog wird mittels #Nginx und #oauthproxy kompensiert. Es gibt auch ein schönes Ticket: Feature Request für fluentbit: Parameter für #yaml oder classic. Dann kann man nämlich fluent Config über Graylog ausrollen 😍
-
PCI DSS глазами архитектора: разбираем кейс передачи карточных данных в ДБО
Привет, Хабр! В этой статье я приоткрою вам самое священное место в любом финтех учреждении - обработку данных платежных систем и особенности работы с CDE сегментом. Вопрос о безопасной передаче карточных данных часто возникает на собеседованиях для архитекторов и senior аналитиков, и он будет полезен не только тем, кто напрямую занимается подобными задачами, но и разработчикам, специалистам по информационной безопасности, а также менеджерам продуктов в финтехе.
https://habr.com/ru/companies/otpbank/articles/944970/
#финтех #финтехпроекты #pcidss #интеграции #интеграции_сервисов #отп_банк #архитектура #архитектура_приложений #информационная_безопасность
-
PCI DSS 4.0.1: A Cybersecurity Blueprint by the Industry, for the Industry – Source: www.securityweek.com https://ciso2ciso.com/pci-dss-4-0-1-a-cybersecurity-blueprint-by-the-industry-for-the-industry-source-www-securityweek-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #securityweekcom #Dataprotection #securityweek #Compliance #PCIDSS #pci
-
PCI DSS 4.0.1: A Cybersecurity Blueprint by the Industry, for the Industry https://www.securityweek.com/pci-dss-4-0-1-a-cybersecurity-blueprint-by-the-industry-for-the-industry/ #DataProtection #Compliance #compliance #PCIDSS #PCI
-
PCI DSS 4.0.1: A Cybersecurity Blueprint by the Industry, for the Industry https://www.securityweek.com/pci-dss-4-0-1-a-cybersecurity-blueprint-by-the-industry-for-the-industry/ #DataProtection #Compliance #compliance #PCIDSS #PCI
-
The deadline for PCI DSS 4.0 compliance is March 31, 2025! 😮 Are you ready? 😨 Maybe you have questions about monitoring for PCI DSS 4.0 compliance? 🤔 Well, we've got answers. 😃
Get information about:
🗓️ Which updates are effective March 31, 2025 for all entities
💳 Which updates are applicable to service providers only
🔍 Monitoring, detection, and incident response for PCI DSS 4.0
...and more.When considering PCI DSS 4.0 scope, orgs need to implement controls around the following types of account data:
👉 Cardholder Data: Primary Account Number (PAN), Cardholder Name, Expiration Date, Service Code
👉 Sensitive Authentication Data (SAD): Full track data (magnetic stripe or chip equivalent), card verification code, Personal Identification Numbers (PINs)/PIN blocks.Learn more:
https://graylog.org/post/monitoring-for-pci-dss-4-0-compliance/ #PCIDSS #payments #finserv
