Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Would utilizing WebSockets cause an issue with obtaining or maintaining PCI compliance?

share|improve this question
In and of itself I can't see the use of websockets contravening PCI, I'm definitely not aware of a specific mention of it in the standards. However it's entirely possible that an application implementation which made use of websockets could be non-compliant. If you provide some more details it may be possible to give a better answer :) – Rоry McCune Jun 7 '13 at 14:37
@RoryMcCune - this was a general water cooler question that came up in the office today, no application implementation. Thank you for the words. – jsanc623 Jun 7 '13 at 20:39
You would naturally need to use TLS-protected WebSocket protocol (wss:) for any communication including sensitive data like PANs. – bobince Jun 7 '13 at 23:32
up vote 3 down vote accepted

Not in and of itself; however, like any network connection, it is subject to PCI DSS rules such as the following:

1.1.5.a Verify that firewall and router configuration standards include a documented list of services, protocols and ports necessary for business—for example, hypertext transfer protocol (HTTP) and Secure Sockets Layer (SSL), Secure Shell (SSH), and Virtual Private Network (VPN) protocols. 1.1.5.b Identify insecure services, protocols, and ports allowed; and verify they are necessary and that security features are documented and implemented by examining firewall and router configuration standards and settings for each service.

So you'll need to document that any services you set up using WebSocket are necessary and secure; pretty much just the way you would as if it was vanilla TCP.

1.2.1.a Verify that inbound and outbound traffic is limited to that which is necessary for the cardholder data environment, and that the restrictions are documented.

Again... document that it's needed.

I haven't used WebSocket, but it appears to be just an abstraction layer on top of TCP, and so for PCI purposes does not introduce any inherent insecurities over the set pre-existing in TCP (...until proven otherwise, natch). Obviously for PCI purposes you'll want to pay attention to encryption and make sure that's enabled most places.

share|improve this answer
Thank you for the explanation and rule inclusion. – jsanc623 Jun 7 '13 at 14:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.