Mastodawn

Meysam 3h ago

𝗚𝗼𝗼𝗴𝗹𝗲 𝗮𝗻𝗱 𝗬𝗮𝗵𝗼𝗼 𝗮𝗿𝗲 𝗿𝗲𝗷𝗲𝗰𝘁𝗶𝗻𝗴 𝘂𝗻𝗮𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗲𝗱 𝗲𝗺𝗮𝗶𝗹. 𝗜𝘀 𝘆𝗼𝘂𝗿𝘀 𝗻𝗲𝘅𝘁?

Not filter. Reject.

I scanned 5.5M domains.
Only 30.4% have a DMARC record.
Only 12.8% are at enforcement (p=quarantine or p=reject).

That means 87% of domains are exposed. Check yours in 10 seconds.

No signup required.
https://dmarcguard.io/tools/dmarc-checker/

#DMARC #EmailSecurity #PCIDSS #EmailCompliance

DMARC Record Checker | DMARCguard

Validate your DMARC policy and get actionable recommendations. All checks run in your browser -- nothing is sent to our servers.

DMARCguard

Show thread

Kevin Karhan

Mar 19

@adlerweb ja, absolutes unding!

#PCIDSS sagt nein…

Outpost24 Feb 27

Stay PCI DSS–Compliant
🔵 𝐀𝐧𝐧𝐮𝐚𝐥 𝐏𝐂𝐈 𝐃𝐒𝐒 𝐂𝐡𝐞𝐜𝐤𝐥𝐢𝐬𝐭: https://outpost24.com/blog/pci-dss-compliance-checklist/

#PCI #PCIDSS #PCICompliance #InfoSec #RiskManagement

Show thread

Kevin Karhan

Feb 24

@pastelfluffyfox it's also a trap at best and can be used to frame the user of said details as #carding #fraudster!

Not to mention since carding #fraud is only getting more rampant since the days of #Boseak, it won't work either because #FraudDetection will simply flag said transactions as fraudulent and preemptively block any charges.
- And if you think that's extreme: No, that's so old I knew this even before I worked at a payment processor.

NEVER EVER use someone elses' card without authorization and having that being allowed by the card issuer.

This is usually not the case NOR would any non-business card issuer agree to it!
- And OFC they will demand all the #KYC stuff beforehand...

So at best someone violated #PCIDSS and their card issuer's ToS'es but most likely they either want to track you and/or frame you for #CreditCard fraud!

Or they pranked you with a known testing CC number…

Miami’s Darklord of Credit Card Scams | John Boseak

YouTube

Show thread

Denny Feb 23

@xeraa Das Problem ist auch Graylog. Wir hängen an Graylog 6.0.14, weil das die letzte Version ist, die mit dem ELK 7.10 zusammenarbeitet. Für Graylog 6.1 braucht es dann eine sehr aufwende ELK / OpenSearch Migration und die bringt Probleme mit sich. Mein Kollege könnte da genaueres sagen .. aber es war etwas nicht triviales.

Man hat sich dazu entschieden, die Speicherdauer auf 3 Monate zu reduzieren, da unser Syslog (rsyslog) das ganze Jahr speichert, um den #pcidss #auditor glücklich zu machen.

Parallel wird geschaut, #victorialogs parallel laufen zu lassen, da der nur einen Bruchteil an Kapazität in Anspruch nimmt.

Kevin Karhan

Jan 8

@neurovagrant @dangoodin @mttaggart @Em0nM4stodon personally, I'd say no #US company can make any privacy claims by design because #CloudAct exists and that applies to everyone (regardless if #ClosedAI or #Signal) having personnel, office, infrastructure or offering services from within the #USA.

#NotLegalAdvice but Cloud Act is irreconcileable with any #privacy & #dataProtection laws, not just #GDPR & #BDSG, but even #HIPAA & #PCIDSS!

Kevin Karhan :verified: (@[email protected])

@[email protected] well, #CloudAct says they'll have ti hand over *any data they have* - *even without a duely issued warrant*… #USpol #NotLegalAdvice #privacy #AI #AIslop #Enshittification #OpenAI #ClosedAI #AIbubble #DataProtection

Infosec.Space

Outpost24 Dec 18

𝐂𝐨𝐦𝐩𝐥𝐢𝐚𝐧𝐜𝐞 𝐖𝐫𝐚𝐩𝐩𝐞𝐝 𝐔𝐩 𝐁𝐞𝐟𝐨𝐫𝐞 𝐘𝐞𝐚𝐫-𝐄𝐧𝐝

If PCI compliance isn’t complete, now is the time to close it.

Our team delivers fully managed PCI DSS scans in 24–48 hours, designed for busy retail and ecommerce environments.

❌ No last-minute chaos.
❌ No January carry-over.

✅ Get your PCI requirements done: https://outpost24.com/products/pci/

#PCIDSS #Compliance #ITSecurity #RiskManagement #GRC

The Cyber Unc Dec 9

GRC rarely feels like “governance, risk, and compliance” and more like alphabet soup with lawyers attached.

I wrote up how I approach GRC as an Associate CCISO: one risk-based program mapped to HIPAA, PCI DSS, NIST CSF, FTC Safeguards, and NIS2 instead of five separate nightmares.

🔗 https://www.kylereddoch.me/blog/grc-in-the-real-world-making-hipaa-pci-nist-csf-ftc-safeguards-and-nis2-work-together/

#GRC #CyberSecurity #InfoSec #Compliance #HIPAA #PCIDSS #NISTCSF #NIS2

GRC In The Real World: Making HIPAA, PCI, NIST CSF, FTC Safeguards, and NIS2 Work Together

A practical guide to building one risk-based GRC program that satisfies HIPAA, PCI DSS, NIST CSF, FTC Safeguards, and NIS2 without drowning in duplicate work.

CybersecKyle

cs Dec 3

Chase account tells me that #Animoto is storing my payment card information despite me closing the account. I reached out to them, and they confirmed my account has been closed. That is NOT why I contacted them. I contacted them because my card company believes they are still holding onto my payment information. I do not know how they know that, but apparently they do, and it shows on the security page at Chase. Chase says they cannot remove it and I must contact the merchant.

@jackyan Personally I tend to literally block entire ASNs whenever possible.

And in fact with past cleints/employers this was rather welcome'd as there was basically never legitimate customer traffic from #GAFAMs or any of their hosting services.

Obviously #PCIDSS and @bsi standards do call for "best practises" and for a bona-fide payment processor, blocking known proxies and hosters is basically standard procedure, as there's no scenario why a customer would use a credit card over #aws, #Azure or #GCP instead of their (residential or mobile) internet connection.