An Apache DSO Module that has to be installed in the Apache Software directly.

http://www.net-secur..._news.php?id=2364

Ummm, yeah, already we've been tagged to "ensure" no unknown "modules" are loaded... and proof with PNG/Configs/in-memory references... etc.

These people can't even get it through their heads we haven't had a single unlogged intrusion attempt nor a single successful (and proven with our IDS that logs ALL traffic) intrusion.

There is the pervasive: "But what if they did"... since its Windows based "what if"

GAH, get over it.

Well, if they did, our APIs wouldn't work properly, when dealing with Credit Cards... and I'd be able to see the module being loaded and the compiled module in a location that is wrong or the location its loading from is wrong.

They "PCI auditors" just don't friggin get it. External Scanners are now dinging for it.

Must!!!! get!!!! out!!!! of!!!! doing/dealing!!!! with!!!! PCI!!!!

!1!!!!!1!!!!1!!!!!!!!!!!!!111!!!!!!!!1!!!!!!!!1!!!1!!1!1!11!!!!1!!1

That is the last piece. We use SAMHAIN as a FIM, of course Tripwire is there also as a secondary FIM.

My Webservers are behind a Firewall, load balancers, a caching (squid) reverse proxy, a Web Application Firewall, another Apache Proxy server for Static content and then a modperl webserver. Then on anything that deals with CHD, our APIs won't even work with anything intercepting the info... as the data has to be "blessed properly and pure" and only over SSL.

The APIs are behind three firewalls, behind two layers of NAT, three layers of ACL and have to prove they are whom they say they are every time.

Auditors and external scanners jobs are to help us get through the scan remediation and to get things taken care of satisfactorily.

Our current auditor is an idiot to the extreme, with no ability to communicate. He can help if he pays attention, but seriously... we are 6 months out of compliance with out AoC, but we have had a "pending" one for 6 months. Which while its good enough for temporary use, one bank in Canada is about ready to start fining us.

I got the last, last, last, last, last, task of the ever moving task list done Friday.

I only added about 400 IPTables rules and 17 chains related to them. GRAH! Our IPTables was only 300 rules to begin with and caused no problems. "Spirit of the regulations" are what is expected... not "Letter of the Regulations".

Anyway, this is a serious OOOGA-BOOOOGA, since we don't even have install-able compilers available to the machines the web-servers live on.

I'm not chatting with him either.