PCI Compliance -Invalid Login Error Messaging

We had brought to Interwoven's attention when we installed TS 7.3.2 that in order to be PCI Compliant, their login error messaging needed to be modified to always say "Wrong username or password" for any type of login failure instead of using terms like "No such teamsite user" and "No such user". We were assured back then that they'd fix this in 7.4. You can only imagine our shock when it still is not fixed in 7.5 (and I assume 8.0). We are required to be PCI Compliant, so since IW didn't offer to send us a patch for this, we were forced to hack it ourselves. I am not confirming that I went ahead and hacked it again in 7.5, but if anyone was interested in how to fix your login error messaging to be PCI compliant by hacking IW's code (unsupported), I might be able to point you in the right direction.

Find more posts tagged with

Comments

nipper

My question is why does TS have to be PCI compliant? There is no financial information put into TS, it is not storing credit cards, etc.

When I did site PCI compliance for another airline, I had to show we can create a site that is PCI compliant but TS didnt have to be.

David Smith

I don't have the answer to that - every application in the company that has a login tied to LDAP is required to be PCI compliant as far as I know. We argued that we weren't a security risk but there were no exceptions. While there may be no user data stored, there is some very proprietary company content stored in TeamSite.

nipper

Smitty97007 wrote:
I don't have the answer to that - every application in the company that has a login tied to LDAP is required to be PCI compliant as far as I know. We argued that we weren't a security risk but there were no exceptions. While there may be no user data stored, there is some very proprietary company content stored in TeamSite.

My point exactly. There is no reason for TS to be PCI compliant and you are probably the only company that has this requirement.

FYI, TS 8 has the same feature as earlier versions :-)

David Smith

nipper wrote:

There is no reason for TS to be PCI compliant and you are probably the only company that has this requirement.

Well lucky us then

Rick Poulin

nipper wrote:
There is no reason for TS to be PCI compliant

Maybe not, but I don't see why TS can't just adopt the defacto industry standard for access denied messaging, given we're just talking about changing a few strings. Whether compliance applies or not, what's the harm in making the login page a tiny bit more robust? I've had a few clients where IT didn't like this, even if they didn't force us to change it.