Blurb: Uno Reversed

Being a security engineer my day to day involves reviewing and commenting on the security posture of applications and systems in the company. Today I got the good ol' uno reverse completely out of left field.

I'm trying out a potential "Buy Me a Coffee" page, and one of the steps is to set up a Stripe account. To enable that Stripe account in turn requires completing a task described simply as

All businesses in Japan are required to complete the security checklist to process payments. Please provide additional information.

Ok sure, set up my passwords and MFA right? Not quite!

"Learn more" points to this link with more context:

Card merchants (Stripe users) in Japan are expected to implement a certain level of security measures under the Installment Sales Act. Due to incidents involving unauthorised use of card data, the Credit Card Transactions Security Measures Council, an industry body, has published a Security Checklist that outlines specific measures that Japan merchants who process online card transactions must implement.

In 2026, the scope of the Security Checklist will expand.

Back to the "security posture" form, it has great questions such as:

• Do you restrict access to the administrator account by IP address, or implement access restriction such as basic authentication on the admin page if IP address restriction is not possible?
• Are settings configured to limit the file types and extensions that can be uploaded by the web server or web application?
• Are you taking measures to prevent vulnerabilities such as SQL injection and cross-site scripting?

I think it's wonderful that Japan is becoming more security conscious (what with the recent spat of companies going offline due to cyber attacks). This checklist is a good first attempt, but imo the questions are a little too specific for a general member of public to answer. This process is for businesses using Stripe, and I wouldn't expect a non-technical person (or heck, even a technical person) who just wants to set up a web shop using a point-and-click platform to know what is "SQL injection".

And to be asked about my security posture when I least expect it did give me a bit of a whiplash, not gonna lie!

If this helped you, I'd appreciate if you bought me a coffee!