Posts

RDP SSL Causes PCI Compliance to fail

Found another issue crop up with a firewall rule change that opened up and RDP availability RDP should be configured using strong encryption methods or use SSL as the privacy and integrity provider. To configure RDP encryption methods, launched in mmc.exe to run the  'Terminal Services Configuration' or 'Remote Desktop Session Host Configuration' snap-in. The 'Terminal Services Configuration' or 'Remote Desktop Session Host Configuration' properties dialog box General tab for the Encryption Level 'High' should be selected. See more here for Windows 2008 R2 basically Start> Administrative Tools> Remote Desktop Services> Remote Desktop Session Host Configuration Click on Connection Click General Tab Change Security FROM Negotiate to SSL(TLS 1.0) Click Encryption Level to “High” A restart may be required (hopefully you won't get kicked out)

cf_sql_timestamp vs cf_sql_date vs getdate()

If there's one thing I don't like it is people confusing a date with a timestamp, and how a lazy bit of development can ruin a load of data. Here is a simple query inserting data to a timestamp I found in a system where all the created dates were truncated because of the incorrect syntax. Bad one which was in use: insert into testdate values (<cfqueryparam cfsqltype="cf_sql_date" value="#createodbcdatetime(now())#">); Result :  2015-09-29 00:00:00.000 Best One (easiest to read) insert into testdate values(getdate() ); Result : 2015-09-29 10:10:09.880 Not great (no binding) insert into testdate values(#createodbcdatetime(now())#); Result :  2015-09-29 10:14:44.000 What the bad one should have been insert into testdate values(<cfqueryparam cfsqltype=" cf_sql_timestamp " value="#createodbcdatetime(now())#">)

How should I improve my funnel and which colors are best for conversion?

With reference to the following articles on conversionxl: http://conversionxl.com/which-color-converts-the-best/ http://conversionxl.com/ux-hacks-to-increase-revenue/  While it is not necessarily about whether Red is best or Green or Orange, it highlights that Call to action is more important than a colour A color is more important than having none From experience, I'd have to say if you can split test different colors separately to a different design then you will be able to choose colors you like ! With the improving of a checkout purchase funnel, it is fairly standard fair: Save Orders  Save Customers (though don't "make them" create an account - https://www.youtube.com/watch?v=3Sk7cOqB9Dk Save Credit Cards (be aware of your PCI requirements) Don't have cryptic error messages (break it down, is it wrong, invalid, unkown) Layout the screen in an appropriate manner for different devices (responsive is clear the best design pattern here).  Ma...

Chrome 44 cgi.https value changed from "on" for SSL traffic to "1" for all traffic

Weird issue, used to use a few cgi.https comparison with "on" as per  https://msdn.microsoft.com/en-us/library/ms524602(v=vs.90).aspx which indicates it would be populated with on or off in IIS. In Chrome 43 this used to return the value on for https and off for http, in chrome 44 the value has change to 1 for all traffic (https and http), nothing in the release notes from what I can see at  https://chromium.googlesource.com/chromium/src/+log/43.0.2357.134..44.0.2403.89?pretty=fuller&n=10000 Update: Google acknowledge the issue and fixed it see http://src.chromium.org/viewvc/blink?view=revision&revision=199090 The "number" of websites the release broke is funny, as I would think it is "a lot", WooCommerce apparently was broken, as was any PHP or ColdFusion code using the cgi.https comparison. Just as an FYI, I'm not sure what php.net did to their website in response, but their main google SERP says https://www.php.net which is unre...

Viewport and responsive design and scaling

Just found that if you have a website and it rotates; then it won't resize properly on landscape with the following viewport <meta name="viewport" content="width=device-width"> You need to specify the initial scale: <meta name="viewport" content="width=device-width, initial-scale=1.0"> This seems to be mainly an IOS thing. To see the acutal sizes of viewports, see this link : http://viewportsizes.com/ Different Properties available are as follows: Property Description width The width of the virtual viewport of the device. device-width The physical width of the device screen. height The height of the virtual viewport of the device. device-height The physical height of the device screen. initial-scale The initial zoom when visiting the page, 1.0 does not zoom. minimum-scale The minimum amount the visitor can zoom on the page, 1.0 does not zoom. maximum-scale The maximum amount the visitor can zoom on the page,...

URLScan and UseFastPathReject fix to stop disclosure of sensitive information

There is a flag in URLScan 3 to stop URL Scan redirecting dodgy requests and instead sending back a 404 response quickly, this is "UseFastPathReject=1" (by default it is 0) The issue outlined: http://www.securityfocus.com/bid/7767/info The fix explained: http://www.securityfocus.com/archive/1/323389

Ghost Records, Card Recon and PCI Compliance

As part of a PCI Compliance audit, I recently ran a scan on a database using software call Card Recon. A little odd thing occurred. At a point in the past, a row of data in a column, which had been dropped from the database schema, contained a single test credit card number. However, the Card Recon software showed that the data was still there in the database file (this was a SQL Database) in the form of a SQL Ghost Record. A Ghost Record can appear when running a delete or insert command and when running delete and insert in different queries but related by the same indexed data, you can read all about it over at Ghost "Rows" Buster in  SQL Server on Technet. It's basically a record somewhere in the database file, but not directly in a database table and is living in a bit of spare fragmented space somewhere and this needs to be cleaned up. Following this procedure managed to remove the Ghost Record: Convert the database to Simple (only so the transactio...