Download

More documents

Recommendations

Info

Why PCI Is Important • Chapter 8 267NOTEAmerican Express, Visa Canada, Discover, and JCB compliance dates for serviceproviders are not well defined. Please check with your acquirer for moreinformation.Compliance ProcessDepending on your company’s merchant or service provider level, you will either need togo through an annual on-site PCI audit, or complete a Self-assessment Questionnaire (SAQ)to validate compliance. In addition to this, you will have to present the results of the quarterlynetwork perimeter scans (which had to be performed by an approved scanningvendor), evidence of internal vulnerability scans, and evidence of application and networkpenetration tests. In other words, you have to prove to the card brands that your companypractices sound patch management and vulnerability management processes.Table 8.5 Compliance Validation for MerchantsLevel American Express MasterCard Visa USALevel 1 Annual on-site Annual on-site review Annual on-site reviewreview by QSA (or by QSA by QSA (or internalinternal auditor if Quarterly scan by ASV auditor if signed bysigned by officer ofofficer of merchantmerchant company)company)Quarterly scanQuarterly scan by ASVby ASVLevel 2 Quarterly scan by ASVAnnual Self-assessment Annual SAQQuestionnaire Quarterly scan by ASVQuarterly scan by ASVLevel 3 Quarterly scan by Annual SAQ Annual SAQASV (recommended) Quarterly scan by ASV Quarterly scan by ASVLevel 4 N/A Annual SAQ Annual SAQ(recommended) (recommended)Quarterly scan by ASV Quarterly scan by ASV(recommended) (recommended)
268 Chapter 8 • Why PCI Is ImportantNOTEDiscover and JCB handle merchant PCI compliance validation differently.Contact the payment brand for more information.NOTEAlthough American Express and Visa allow Level 1 merchants to have theirPCI compliance validated by the merchant’s internal audit group, MasterCarddoes not explicitly allow this. If this affects your company, contactMasterCard for clarification.Table 8.6 Compliance Validation for Service ProvidersLevel American Express MasterCard Visa USALevel 1 Annual on-site Annual on-site review Annual on-site reviewreview by QSA (or by QSA by QSAinternal auditor if Quarterly scan by ASV Quarterly scan by ASVsigned by officer ofservice providercompany)Quarterly scan by ASVLevel 2 N/A Annual onsite review Annual on-site review byby QSAQSAQuarterly scan by ASV Quarterly scan by ASVLevel 3 N/A Annual SAQ Annual SAQQuarterly scan by ASV Quarterly scan by ASVNOTEDiscover and JCB handle service provider PCI compliance validation differently.Contact the payment brand for more information.
Page 1 and 2:
www.dbebooks.com - Free Books & mag
Page 3 and 4:
Elsevier, Inc., the author(s), and
Page 6 and 7:
ForewordDr. Richard Ford graduated
Page 8 and 9:
http://www.info-secure.org and seve
Page 10 and 11:
Jeremiah Grossman founded WhiteHat
Page 12 and 13:
ContentsForeword . . . . . . . . .
Page 14 and 15:
ContentsxvChapter 4 XSS Theory. . .
Page 16 and 17:
ContentsxviiReal-Life Examples . .
Page 18 and 19:
ContentsxixSummary . . . . . . . .
Page 20:
ContentsxxiRegulatory Requirements
Page 23 and 24:
xxivForewordgain somehow from it or
Page 26 and 27:
Chapter 1Botnets:A Call to ActionSo
Page 28 and 29:
This book will attempt to add new s
Page 30 and 31:
Consider the power in one botnet at
Page 32 and 33:
SubSeven Trojan/BotBy the late 1990
Page 34 and 35:
sites. In 2002, the motivation for
Page 36 and 37:
Botnets: A Call to Action • Chapt
Page 38 and 39:
MytobThe Mytob bot was discovered i
Page 40 and 41:
the FBI who tracked down the hacker
Page 42 and 43:
Anthony Scott ClarkIn December 2005
Page 44 and 45:
Botnets: A Call to Action • Chapt
Page 46 and 47:
2007. In these meetings, a clearer
Page 48 and 49:
Chapter 2Botnets OverviewIf only it
Page 50 and 51:
standing of the botnet life cycle c
Page 52 and 53:
Backdoors Left by TrojanWorms or Re
Page 54 and 55:
Botnets Overview • Chapter 2 31Fi
Page 56 and 57:
Botnets Overview • Chapter 2 33ve
Page 58 and 59:
Botnets Overview • Chapter 2 35ec
Page 60 and 61:
Recruit OthersThe most basic thing
Page 62 and 63:
■HTTP_USER_FIELDS.LST■ICQ.LST
Page 64 and 65:
Page 66 and 67:
Installation of Adware and Clicks4H
Page 68 and 69:
The Botnet-Spam and Phishing Connec
Page 70 and 71:
need that many.These calculations a
Page 72 and 73:
Page 74 and 75:
Botnets Overview • Chapter 2 51Ac
Page 76 and 77:
RansomwareAs a category this includ
Page 78 and 79:
of the card, the ATM pin number, an
Page 80 and 81:
Botnets Overview • Chapter 2 57th
Page 82 and 83:
agree to purchase links, if Google
Page 84 and 85:
Botnets Overview • Chapter 2 61Th
Page 86 and 87:
Botnets Overview • Chapter 2 63Fr
Page 88:
Part IICross SiteScripting Attacks6
Page 91 and 92:
68 Chapter 3 • Cross-site Scripti
Page 93 and 94:
Page 95 and 96:
Page 97 and 98:
Page 99 and 100:
Page 101 and 102:
Page 104 and 105:
Chapter 4XSS TheorySolutions in thi
Page 106 and 107:
To describe methods 1 and 2 above,
Page 108 and 109:
Figure 4.3 illustrates what happens
Page 110 and 111:
Once the hacker has completed his e
Page 112 and 113:
This is where the problem is. In th
Page 114 and 115:
XSS Theory • Chapter 4 91Awesomea
Page 116 and 117:
XSS Theory • Chapter 4 93Notice t
Page 118 and 119:
AwesomeAwesomeawesome ajax applicat
Page 120 and 121:
AwesomeAwesomeawesome ajax applicat
Page 122 and 123:
the application that is developed.
Page 124 and 125:
XSS Theory • Chapter 4 101a redir
Page 126 and 127:
include the phishing site in questi
Page 128 and 129:
tinyurl.com/2z8ghb). Using somethin
Page 130 and 131:
tain that the administrator was, in
Page 132 and 133:
server. Because JavaScript is a ful
Page 134 and 135:
203.135.128.187 - - [15/Mar/2007:09
Page 136 and 137:
Once you download MTASC, you have t
Page 138 and 139:
XSS Theory • Chapter 4 115NOTEIf
Page 140 and 141:
XSS Theory • Chapter 4 117These t
Page 142 and 143:
Again, if you are running the lates
Page 144 and 145:
This is the reason why alert messag
Page 146 and 147:
XSS Theory • Chapter 4 123}.repla
Page 148 and 149:
In order for the attacker to take a
Page 150 and 151:
Unfortunately, even if Google remov
Page 152 and 153:
XSS Theory • Chapter 4 129if (typ
Page 154 and 155:
file that can be clicked when the f
Page 156 and 157:
Click only once on the Text Track n
Page 158 and 159:
Backdooring Image FilesIt is a less
Page 160 and 161:
application ignores .htm and .html
Page 162 and 163:
XSS Theory • Chapter 4 139NOTEDep
Page 164 and 165:
XSS Theory • Chapter 4 141Figure
Page 166 and 167:
Firefox is not the only one. Now, l
Page 168 and 169:
Technically, inside the IMG tag, th
Page 170 and 171:
ions.join(',');data.states=data.sta
Page 172 and 173:
XSS Theory • Chapter 4 14948 0 49
Page 174 and 175:
XSS Theory • Chapter 4 151var que
Page 176 and 177:
Obviously, this code should not app
Page 178 and 179:
14. onBegin() The onbegin event fir
Page 180 and 181:
62. onMove() The user or attacker w
Page 182 and 183:
XSS Theory • Chapter 4 159While t
Page 184 and 185:
XSS Theory • Chapter 4 161&#X3c&#
Page 186 and 187:
Since the number is lower than 10,
Page 188 and 189:
There is no doubt that some HTML is
Page 190 and 191:
XSS Theory • Chapter 4 167NOTEThe
Page 192 and 193:
}alert("XSS");The .htc vector only
Page 194 and 195:
XSS Theory • Chapter 4 171?script
Page 196 and 197:
SummaryIn this chapter, we discusse
Page 198 and 199:
XSS Theory • Chapter 4 175Source
Page 200 and 201:
Chapter 5XSS Attack MethodsSolution
Page 202 and 203:
XSS Attack Methods • Chapter 5 17
Page 204 and 205:
Stealing Search Engine QueriesSPI D
Page 206 and 207:
sole to error where they can be cap
Page 208 and 209:
Page 210 and 211:
Page 212 and 213:
iframe.setAttribute("src", "/");ifr
Page 214 and 215:
Port ScanningWith the internal IP a
Page 216 and 217:
Page 218 and 219:
cading style sheets (CSS), or JavaS
Page 220 and 221:
will update the device. For example
Page 222 and 223:
application that uses innerHTML or
Page 224 and 225:
Page 226 and 227:
Page 228:
Part IIIPhysical and LogicalSecurit
Page 231 and 232:
208 Chapter 6 • Protecting Critic
Page 233 and 234:
Page 235 and 236:
Page 237 and 238:
Page 239 and 240: 216 Chapter 6 • Protecting Critic
Page 277 and 278: 254 Chapter 7 • Final ThoughtsInt
Page 279 and 280: 256 Chapter 7 • Final Thoughts■
Page 281 and 282: 258 Chapter 7 • Final Thoughts■
Page 284 and 285: Chapter 8Why PCI IsImportantSolutio
Page 286 and 287: Why PCI Is Important • Chapter 8
Page 294 and 295: Co published the updated DSS, now a
Page 296 and 297: ■■■Maintain a Vulnerability M
Page 300 and 301: SummaryPCI refers to the DSS establ
Page 302 and 303: Chapter 9ProtectCardholder DataSolu
Page 304 and 305: Protect Cardholder Data • Chapter
Page 306 and 307: Full Disk EncryptionFull disk encry
Page 308 and 309: Protect Cardholder Data • Chapter
Page 310 and 311: OverviewThe pursuit of protecting d
Page 312 and 313: allow traffic through your firewall
Page 314 and 315: modern standard Web browser is all
Page 316 and 317: SegmentationSegmentation essentiall
Page 318 and 319: Intrusion Detection Systems (IDSes)
Page 320 and 321: Step 4—Develop PoliciesBased On W
Page 322 and 323: SummaryProtect Cardholder Data •
Page 324 and 325: Sensitive cardholder authentication
Page 326: Part VAsterisk andVoIP Hacking303
Page 329 and 330: 306 Chapter 10 • Understanding an
Page 341 and 342:
318 Chapter 10 • Understanding an
Page 343 and 344:
Page 345 and 346:
Page 347 and 348:
Page 349 and 350:
Page 351 and 352:
Page 353 and 354:
Page 355 and 356:
Page 357 and 358:
Page 359 and 360:
336 Chapter 11 • Asterisk Hardwar
Page 361 and 362:
Page 363 and 364:
Page 365 and 366:
Page 367 and 368:
Page 369 and 370:
Page 371 and 372:
Page 373 and 374:
Page 375 and 376:
Page 377 and 378:
Page 379 and 380:
Page 381 and 382:
Page 383 and 384:
Page 385 and 386:
Page 387 and 388:
Page 389 and 390:
Page 391 and 392:
Page 393 and 394:
Page 395 and 396:
Page 397 and 398:
Page 400 and 401:
Chapter 12Social EngineeringSolutio
Page 402 and 403:
privisp1002.htm) Jan Dulaney, presi
Page 404 and 405:
To make your own hardware keystroke
Page 406 and 407:
Social Engineering • Chapter 12 3
Page 408 and 409:
TheftA 2005 survey conducted by the
Page 410 and 411:
these files may be copied into fold
Page 412 and 413:
Sometimes people choose poor passwo
Page 414 and 415:
There are times when an attacker wa
Page 416 and 417:
Phreak BoxesAnother way to get free
Page 418 and 419:
transferred callers to a 1-900 numb
Page 420 and 421:
on a hyperlink appearing in a SMS m
Page 422 and 423:
Page 424 and 425:
Page 426 and 427:
Just as information systems authent
Page 428 and 429:
Page 430 and 431:
different vulnerabilities that each
Page 432 and 433:
no advance knowledge of the company
Page 434 and 435:
The Computer Security Act establish
Page 436 and 437:
Page 438 and 439:
Page 440 and 441:
Things change. New assets are acqui
Page 442 and 443:
Quantitative AssessmentImagine all
Page 444 and 445:
Page 446 and 447:
Download the S.O.B. Orangebox archi
Page 448 and 449:
Page 450 and 451:
NOTE: In this index, a page numberf
Page 452 and 453:
Index 429perpetrators, 15-20, 51-52
Page 454 and 455:
Index 431Default passwords, 29, 197
Page 456 and 457:
Index 433GPRS (General Packet Radio
Page 458 and 459:
Index 435Left bracket (
Page 460 and 461:
Index 437Qualified Security Assesso
Page 462 and 463:
Index 439SCADA (Supervisory Control
Page 464 and 465:
Index 441Threats to process control
show all

Download

Create successful ePaper yourself

Delete template?

Save as template?