Weak SSL Ciphers on Remote Server - Help?!

[leehack]

We have a site owner, a hosting company and a payment gateway all in the mix. The hosting company and the payment gateway can pass on blame to the site owner if something breaches their systems. It's a rather failsafe way of operating a business. Can't think of too many businesses that can get away with such blame free methods.

Does a server hack occur as often as Haley's comet appears Simon or more common that that? once again an area where you could state facts and not ramble on about how wrong people are. Paint the picture or we are all looking at a blank canvas, no matter how much you talk.

[Mark H]

I think there is a confusion here between hacking of a site and PCI compliance:

• PCI Compliance only applies to sites which collect card data, which means the actual numbers. If your site doesn't collect card numbers then it doesn't need to be compliant. PCI themselves make this crystal clear.
  
• If your company collects card details (say over the phone) then you need to be PCI compliant (means of storage, PC network if used for storage etc), but your website still does not need be if it doesn't collect card details or form part of the storage process.
  
• If any website is hacked which leads to the skimming of card details by another website, the question of liability is an interesting one, however if your website doesn't need to be PCI compliant because it doesn't itself collect card details (see first point), then PCI compliance is wholly irrelevant.

PCI compliance of websites which collect/store data, and liability of website owners whose websites do not require PCI compliance, but which are hacked, are two completely different issues.

[Darren B]

Actinics version / interpretation http://www.actinic.co.uk/services/pci-dss.htm

interesting comment made here "Royal Bank of Scotland/Natwest/Streamline and HBOS have made clear statements that a merchant can depend on the compliance of their PSP. We are in the process of trying to obtain similar statements from other banks."

And simon posting a link to the pci website that tells you what to check to ensure compliance is a bit pointless really, the debate is who is and who is not. Not what to check for

Stop adding to the muddy waters and start solving them, cos you are not helping at all.

Lee i think he took your advice, not prepared to give his full name, and company so went off

[bcomp]

Why actinic? your logic applies to others PROTX, World pay e.t.c

Im confused, so you agree every software has some form hole, i think we all accept that, but having a security scan then makes this all go away then? so you passed it on monday, cpanel / plesk, windows release a patch which has another hole in it on tuesday what happens for the next 3 months until your next scan? Are SM going to take the hit then, well they failed not the website or the PSP

So what you are saying is all the banks should pull the plug on every company that has not a security check carried out on their servers. Oh and in reality shared hosting is not going become compliant, so everyone needs to move to dedicated servers aswell.

The simple fat is simple, all ecommerce websites are required to pass PCI-DSS or they will be liable in the event of a security breech regardless of the payment method they use. I’m very sorry for you that in order to be compliant you need to maintain security, I’m sorry if that’s an inconvenience to you and I’m sorry that running an ecommerce site requires that you take security seriously and not simply assume you can pass the buck to your PSP.
I simply used actinic as an example in the hope that someone from Actinic Payments would confirm who is liable in the event that a site is compromised, naturally the same applies to any other PSP.

Simon, where people like yourself fail so miserably is communication. You come on here talking about things, which could all be true and something we should all take advice from, however you get people's backs up by trying to tell us how right you are and how wrong we all are.

If what you say is true, then put your full name, your phone number, your email address, your company name and your web address for people to contact you and address any issues they may have. Anything less and you are not doing the job you think you are. Surely you have a moral and professional obligation to do this as a security expert?

Stop adding to the muddy waters and start solving them, cos you are not helping at all.

Well having looked at a vast selection of your posts Lee it's quite clear who it is that deems themselves always right never wrong. I would suggest your comments such as “where people like yourself fail so miserably is communication” and “you get people's backs up by trying to tell us how right you are and how wrong we all are” could be referred to as “pot calling the kettle” and perhaps it would be advisable that you take a look in the mirror.

The fact is all ecommerce sites should be PCI-DSS compliant regardless of if they use a PSP or not and any site that isn't PCI-DSS compliant at the time of a compromise to their ecommerce site are liable and any professional or self proclaimed professional such as yourself advising client otherwise should be held accountable but sadly that would not be the case and it’s your clients who trusted and listed to your misinformed advice that would suffer the consequences..

You ask me for the answer? The answer is simple sign up to a scanning service and get your ecommerce store PCI-DSS compliant. It’s not even as if a scanning service would cost a single penny and even on a shared hosting environment

PS: Who said anywhere I was a security expert? I’m simply a site owner who has managed to pass PCI-DSS and now a user of these forums posting relivent information whilst not attacking other users in the process. Just because the penny has dropped for you that your advice is complete nonsense regarding a websites security and need to be PCI-DSS compliant thats not really my problem but at least the penny has dropped and you will now be a little more informed when advising others.

[Darren B]

interesting this is from Barclaycards website

" I use other companies and suppliers to process card payments on my behalf and supply services. Does PCI DSS affect me?

You are responsible for ensuring you are using a fully compliant solution for managing your card data which includes your third parties. If your data is breached or stolen as a result of one of your third parties you will be held liable for that data breach.
Therefore any solution or service that is used by you to accept, process and/or store your customer card holder data must be compliant. It is your responsibility to ensure your supplier provides you with evidence of their compliance status and the compliance of their service or solution."

[grantglendinnin]

Well having looked at a vast selection of your posts Lee it's quite clear who it is that deems themselves always right never wrong. I would suggest your comments such as “where people like yourself fail so miserably is communication” and “you get people's backs up by trying to tell us how right you are and how wrong we all are” could be referred to as “pot calling the kettle” and perhaps it would be advisable that you take a look in the mirror.[/url]

Simple answer to this. Site of the Year 2008 (Edit. Sorry, that's 'The Specsavers Award' ).

---Edit---

Thought I'd throw the rest in. Joint winner of the 'British Red Cross Award for Helpful Member to the Community' - very well deserved IMO. IMO the sites I have seen Lee develop are the best Actinic-based sites going, Atlantic Shopping, Quantum Electronics, Dude, etc.

You ask me for the answer? The answer is simple sign up to a scanning service and get your ecommerce store PCI-DSS compliant. It’s not even as if a scanning service would cost a single penny and even on a shared hosting environment

Let me guess...you're getting commission from ALL of the 'security scanning' services???

PS: Who said anywhere I was a security expert? I’m simply a site owner who has managed to pass PCI-DSS and now a user of these forums posting relivent information whilst not attacking other users in the process. Just because the penny has dropped for you that your advice is complete nonsense regarding a websites security and need to be PCI-DSS compliant thats not really my problem but at least the penny has dropped and you will now be a little more informed when advising others.

Be a man and stop hiding behind your virtual hard-man act.

[Rich Brady]

The simple fat is simple

I'm glad you cleared that up for me LOL

The thing is Simon that you've kept everything about yourself a secret.

This leads me to believe either:

1. You are simply here to stir up trouble
2. You are here to drum business for some security check
3. You're not entirely sure what you are saying is true
4. You're a current member on this forum that knew his posts were going to piss people off and didn't want to effect any help you may need in the future

Which one is it?

Also, you do seem to be very much in the minority here and until you have proved what you are saying is true, members are going to follow the advice of established helpful guys like Lee

[leehack]

The fact that I have had a very successful actinic design service for a good few years now is yet again testament to the rubbish you speak i'd imagine, but don't take my word for it, speak to my clients. I think i did quite well in the recent forum votes for best of categories too.

Hmm do I believe a new forum ID hiding his true identity or look at facts in front of me. Hmm i wonder.

The worst part of it all is that you use the weak line of 'not being bothered about security' type affair, everyone is bothered about security, it's the rubbish and utter muddy information around that confuses the whole thing.

[bcomp]

I'm glad you cleared that up for me LOL

The thing is Simon that you've kept everything about yourself a secret.

This leads me to believe either:

1. You are simply here to stir up trouble
2. You are here to drum business for some security check
3. You're not entirely sure what you are saying is true
4. You're a current member on this forum that knew his posts were going to piss people off and didn't want to effect any help you may need in the future

Which one is it?

Also, you do seem to be very much in the minority here and until you have proved what you are saying is true, members are going to follow the advice of established helpful guys like Lee

A: I run a business which is called BComp so nothing secret about that.
B: It opperates as an ecommerce business using Actinc.
C: My Name is Simon
D: Where have i linked to or recommended any security scanning services? Here's one just in case (It's FREE) www.qualys.com
E: What advice would i require exactly from the know it all's here that know nothing?

[Darren B]

Here's one just in case (It's FREE) www.qualys.com

Oh information from a company selling ermmmm security scans LMFAO give me your address i bet i can sell you something on your door step

[bcomp]

interesting this is from Barclaycards website

" I use other companies and suppliers to process card payments on my behalf and supply services. Does PCI DSS affect me?

You are responsible for ensuring you are using a fully compliant solution for managing your card data which includes your third parties. If your data is breached or stolen as a result of one of your third parties you will be held liable for that data breach.
Therefore any solution or service that is used by you to accept, process and/or store your customer card holder data must be compliant. It is your responsibility to ensure your supplier provides you with evidence of their compliance status and the compliance of their service or solution."

And from this your leaning towards perhaps becoming PCI-DSS compliant?

Lee, I have posted the facts which are if a site is compromised they are liable if they are not PCI-DSS compliant and not their PS which was not compromised, you choosing to ignore that is entirly your choice but unfortunately it is your clients that will suffer should there be a security compromise with one of their sites and not you.

[Darren B]

And from this your leaning towards perhaps becoming PCI-DSS compliant?

Keep up - i already told you what i had done, and also informed you that i have checked information, i have been for the last 18 months and as yet found nothing to tell me i have to become compliant. So i actually recon i have more of an understanding on the subject than you do.

Admit it you have not got a clue, however i notice you have yet to refute the infomation others and myself have posted that all clearly states it is not required

When you come back with a compelling arguement and factual statements let me know until then i have work to do and shall not waste more time

[bcomp]

The scanning service we use runs daily which is not required but as it's free why not and at the very least it offers piece of mind to us. We have not had a single issue for well over 2 months which required any attention, the last issue was

Vulnerability: ICMP Timestamp Request
Qualys ID : 82003 CVE ID : CVE-1999-0524
Port : N/A

Diagnosis: ICMP (Internet Control and Error Message Protocol) is a protocol encapsulated in IP packets. It's principal purpose is to provide a protocol layer able to inform gateways of the inter-connectivity and accessibility of other gateways or hosts. "ping" is a well-known program for determining if a host is up or down. It uses ICMP echo packets. ICMP timestamp packets are used to synchronize clocks between hosts.
Consequences: Unauthorized users can obtain information about your network by sending ICMP timestamp packets. For example, the internal systems clock should not be disclosed since some internal daemons use this value to calculate ID or sequence numbers (i.e., on SunOS servers).

Solution: You can filter ICMP messages of type "Timestamp" and "Timestamp Reply" at the firewall level. Some system administrators choose to filter most types of ICMP messages for various reasons. For example, they may want to protect their internal hosts from ICMP-based Denial Of Service attacks, such as the Ping of Death or Smurf attacks.

However, you should never filter ALL ICMP messages, as some of them ("Don't Fragment", "Destination Unreachable", "Source Quench", etc) are necessary for proper behavior of Operating System TCP/IP stacks.

It may be wiser to contact your network consultants for advice, since this issue impacts your overall network reliability and security.

This took our hosts all of 2 minutes to resolve and for us to remain compliant, so far being compliant has not cost us a single penny and surely despite all the childish tantrums being PCI-DSS compliant and resting easier in that knowledge is better than being liable for potentially a fortune?

[Rich Brady]

Simon, if you are who you say you are, give us a link to your Actinic E commerce PCI-DSS Compliant website and let us learn form you...

[parklifeclothes]

Where's GAViN when you need him??