Predating password

You do stuff (a process- rev A) At some point the process must be changed for a valid reason (a process - rev B) ..you're not sure rev B process works...So you try it , and test it , and tweak it , and validate it until you have a process that works again.

predating password-16

Some retailers, who deal with account takeover (ATO) attacks on a regular basis, block attempts from known malicious addresses before they can even start rattling the doorknobs.

Even if an attacker manages to use the right username and password, Duo’s push notification gives the details of the secondary request, allowing the original user to indicate that the request is fraudulent and deny it.

Pretty much Day 50 When did you confirm it was the right process to be using? The document is "effective" when people have the ability to follow the approved document... I can see this, Ninja, but then you are going to have to put in special controls as you "test and tweak". In fact, I put such documents in "Level 5" of a document hierarchy back in the 1990's along with "Temporary Change" documents. Your description is of a "special circumstance" situation.

Whether or not you have to "scrap it all" depends upon the contract language as well as communication/coordination with the customer(s).

It’s a common tactic, and many security assessors and penetration testers disapprove of the notion of letting anyone know what they got wrong in a login sequence, just in case it’s an attacker.

But anyone who has had to staff a help desk knows how frustrating it is for the user, who may not even be sure of the username, much less the password.

PCI DSS 3.2 went into effect in October 2016, with requirement 8.3.1 (expanded use of MFA) coming into effect on February 1, 2018.

In the meantime, the PCI Council has come out with an MFA Supplement that sets forth some guidelines that may possibly be incorporated into the standard at some point in the future.

as principle & practice, "Effective date" is assigned after approval & training.

Tags: , ,