An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

learn more… | top users | synonyms

3
votes
2answers
235 views

Best way to scan for and eliminate earlier versions of SSL/TLS in a production environment

Due to new PCI DSS standards mandating that nothing lower than TLS 1.2 be used in a PCI environment, I am tasked with phasing out anything lower than TLS 1.2 on every device in this environment by our ...
-3
votes
0answers
17 views

PCI Compliance for 2checkout Payment API [on hold]

I am using 2checkout Payment API for payments which requires PCI compliance, for which I registered with 2checkout's PCI partner Trustwave. Trustwave scanned my server and this scan passed. The next ...
1
vote
1answer
34 views

PCI Compliance SAQ-A-EP or SAQ D

Our eCommerce wesbite attracts less than 5000 CC transactions each year and we do no store any CC information in our backend or systems but transmit them to our third party provider. We also use a ...
0
votes
2answers
41 views

What is the PCI requirement for tracking software installation on workstations?

We have a task open right now to implement UAC and matching event log tracking for our devs installing software on their machines. I've been asked whether storing/parsing these logs centrally is a ...
-4
votes
0answers
32 views

Requirement 8.3: Incorporate two-factor authentication for remote network access originating from outside the network by personnel [duplicate]

Requirement 8.3: Incorporate two-factor authentication for remote network access originating from outside the network by personnel (including users and administrators) and all third parties, ...
0
votes
1answer
63 views

PCI requirement 8.3 - 2FA for all network access originating outside the network

Requirement 8.3: Incorporate two-factor authentication for remote network access originating from outside the network by personnel (including users and administrators) and all third parties, ...
5
votes
3answers
350 views

PCI DSS - VPN network?

My network is segmented into internal (which holds private cardholder data), DMZ and VPN. There is a gateway in between which restricts access, for example: VPN: 10.0.0.0/24 DMZ: 10.1.0.0/24 INT: ...
4
votes
2answers
61 views

Source code scanning - PCI Requirement - Service Provider

I've been doing a lot of research regarding the requirements for source code scanning but haven't found anything conclusive when it comes to my question below. So I need some guidance from PCI Experts ...
2
votes
0answers
63 views

PCI 3.1 - SAQ D - Supporting Servers

For the past year and a half now, I've been working as the sole individual at a small retail hardware store trying to attain proper (read: not checkbox) compliance, and I am beginning to enter the ...
3
votes
1answer
49 views

PCI DSS 3.0, 11.3 - What happens if a low risk vulnerability prevents compliance with another requirement?

As I understand the PCI DSS 3.0/3.1 penetration testing requirements, a company is compliant with 11.3 if the penetration test does not return any high risk vulnerabilities. However, what happens if ...
3
votes
1answer
64 views

Distributed tokenization for credit card numbers

I have two locations within the same firm that hold credit card numbers. I want to be able to "join" on credit card number to do business analytics after transmitting card number-linked data from one ...
1
vote
3answers
73 views

PCI Compliance and fines

Our organisation has validated compliance with PCI DSS. What are the consequences to us if we had been breached by a security incident related to credit card information, considering we have validated ...
2
votes
2answers
100 views

Tools to demonstrate NO storage of cardholder data

Our organization has been asked to comply with PCI DSS. As part of IT Department, we need to demonstrate that none of our IT infrastructure stores any carhdolder data nor sensitive authetication ...
1
vote
1answer
80 views

Can Windows 8 be PCI compliant?

I am in the process of getting PCI. I am in the last step in which I would need a secure PC on my internal network. All the scans I must run are only available through a plugin in browsers for Windows ...
1
vote
1answer
42 views

Card Present PCI Requirements

We are using an IDTECH card reader for iPhone that is not encrypted, our application is web based and runs inside of an iOS app to pull the data off the card. We are then using a client side ...
1
vote
3answers
79 views

Do I need an ASV to come out when going for an SAQ?

Our company is going for a SAQ, under PCI DSS 3.1. Do we need to pay a vendor to come out and do an on site scan, or can we use something like Nessus to do the scan on our own?
4
votes
4answers
121 views

Can I show Credit Card Data to final customers and be PCI Compliant?

I work with reservation management syatems. In the hospitality industry there is the concept of credit card as guarantee. By it when making any kind of reservation you are asked for your credit card ...
1
vote
0answers
32 views

PCI process, how to solve mambo vulnerability CVE 2006-0871 on debian 8?

I am involved in the process of becoming pci-dss compliant. I am really close to get it although I am having this vulnerability on the server when I am doing an external scan. Does someone know how to ...
1
vote
1answer
51 views

PCI DSS 3.0 and card swipe terminals for our merchants

We run an online software service that collects and transmits card transactions for small merchants. They use card swipe terminals connected to their business PCs that direct the traffic straight ...
1
vote
1answer
116 views

Is zinc.io PCI compliant (/does it need to be)?

zinc.io provides shopping API to programmatically purchase items on Amazon, Best Buy, and Walmart to name a few. A brief observation of its API tells us credit card information is definitely being ...
1
vote
1answer
91 views

Confusion regarding PCI compliance in an office

We use myvirtualmerchant.com (previously Converge, owned by Elavon) to process payments in our doctor's office. Recently, they emailed us that we have to fulfill their partner company's (Trustwave ...
1
vote
1answer
82 views

Multiple Bank Accounts on one payment gateway or merchant account

I'm looking to use PCI compliant payment gateways such as Authorize.net or Spreedly.com in my website. However in my particular case (hotel, tour, events reservations), we will serve as an ...
0
votes
2answers
79 views

PCI-DSS, what is the best distro? [closed]

What is the best distro of Linux to get PCI-DSS compliant? I am using Debian 8 because I think Debian is one of the most stable versions, but it seems not to be enough, I am struggling with a lot of ...
0
votes
1answer
329 views

How can American Express Serve login be PCI-DSS compliant?

Today I went to log into my American Express Serve account at https://secure.serve.com/ and accidentally discovered what appears to be a huge hole in their login process. Here are the steps involved: ...
4
votes
1answer
226 views

Is Heroku PCI Compliant?

Obviously Heroku wants you to think they're PCI compliant by telling you "Heroku’s infrastructure provider is PCI Level 1 compliant" (AWS). https://www.heroku.com/policy/security But since Heroku ...
0
votes
1answer
121 views

Is PCI SAQ A or A-EP applicable for my use case?

I read the FAQ over here andI feel that we do not need to be PCI Compliance but I have read many other posts, articles etc which seem to contradict my assumption. So I was wondering if any of you guys ...
3
votes
3answers
114 views

How is truncation according to PCI DSS secure?

In section 3.3 of the PCI standard, it says that when displaying PANs, limiting visibility to the first 6 and last 4 digits of the PAN is considered secure. Doing some quick math, on a 16 digit PAN, ...
0
votes
1answer
55 views

Distinguishing between tokens and actual PANs for tokens based on reversible cryptographic functions

I’m researching a possibility of implementing KEK and DEK servers compliant with PCI-DSS requirements. PCI Tokenization Guidelines states: “The tokenization solution should include a mechanism for ...
0
votes
0answers
83 views

PCI server room on premises: how to handle office visitors?

There is a server room which is part of PCI environment and located inside the office. Access to the server room itself is controlled according to PCI DSS Requirement 9: "Restrict physical access to ...
1
vote
0answers
25 views

Non-trad bus model: I pay suppliers directly with client CC info. Need to be able to securely collect and read info [closed]

I'm a home-based travel agent. It is against my contract with my host agency (and I think the law actually) to directly accept payment from clients. Instead, we use customer CC information to pay ...
1
vote
0answers
39 views

Internal Vulnerability scans - defining the applicability

If a service provider has a network with thin clients, and they use a citrix portal to access a PCI complaint service provider's cardholder data environment. If the environment is very similar to tho ...
3
votes
1answer
94 views

What's the advantage of passing credit cards via javascript vs. over the server (without saving it)?

I've noticed current credit card gateways like stripe and wepay encourage sending the credit card number via their js framework (which would use some iframe jsonp magic to pass the data). To my ...
2
votes
0answers
65 views

How to design a right VPN connection for an organisation (Interconnected MPLS link or Individual FW)

Thanks in advance for your advice We have to implement VPN connection for nearly 7 countries Option 1 : As we have private MPLS link to all 7 countries. It is been outsourced Third party. They ...
3
votes
1answer
123 views

How can a very small company handle PCI-DSS requirement 6.4.2?

PCI-DSS 3 requirement 6.4.2 calls for Separation of duties between development/test and production environments. Based on the guidance text and this, answer to another question, it appears ...
2
votes
1answer
180 views

card.io & PCI DSS v3.0

I've researched for quite some time now, but I cannot find an answer to this question: If I touch card holder data in any way, I need PCI DSS v3.0 SAQ A-EP certification, which is quite complex to ...
0
votes
1answer
90 views

PCI compliant RSA key generation and getting value of private exponent

Is it possible to generate RSA key and get its private exponent in clear and to be compliant with the following PCI requirement?: Keys must be generated so that it is not feasible to determine that ...
2
votes
1answer
84 views

PCI DSS - network design - users connect to internet via proxy; should we place it at the last hop or before firewall?

We need to be PCI compliant. PCI user VLAN is connecting to Internet via proxy, but I need confirmation about the location of the proxy. PCI user traffic flow: PC ==> ASA FW ==> IPS ...
3
votes
1answer
92 views

Does PCI compliance requires DRP even if we dont store Card data

Our company is does not store any credit card details. We are storing it in a cloud platform which is already PCI compliant. We just require to access the Cloud portal from our company. I understand ...
2
votes
2answers
87 views

Is HTTPS required for PCI Compliance when downloading desktop software patches, if no PII is transmitted, and content is digitally signed + verified?

We have a desktop app that downloads patch content via HTTP. The content is digitally signed and verified by client software after download. Is HTTPS required to achieve PCI compliance if: No PII ...
3
votes
2answers
97 views

Backup procedure for PCI

Our company is does not store any credit card details but we do transmit them. We are storing it in a cloud platform which is already PCI compliant. We just require to access the Cloud portal from ...
0
votes
1answer
133 views

How to enforce TLS on Windows [duplicate]

In Windows 2008 R2 and 2012, how do you enforce TLS-only and how do you demonstrate that posture? I am in IP Compliance and have a strong background in practical system administration and support. I ...
6
votes
6answers
280 views

Looking for credit card data and other PII in files

I'm looking for ways to check for the presence of credit-card data and other personally identifiable information in files on a network I'm testing. Currently i'm doing this manually with the usual ...
1
vote
1answer
113 views

Can we use same Active directory / Proxy servers for PCI and Non PCI Segment users?

Can we use the same AD server for both PCI VLAN user and Non PCI VLAN users? How about proxy, we have a Proxy but both PCI and Non PCI user's traffic are flowing through those Proxy. But we have ...
2
votes
2answers
70 views

PCI DSS and ssh keys for root

Referring to this PCI DSS 2.0 and ssh keys I want to ask Is this PCI section 8.2 only for individual users or also valid if a user connects via ssh to a root account? I prefer to ssh root@localhost ...
2
votes
3answers
111 views

Businesses Handling Credit Cards via Email

I have done some I.T. contracting for a medium-sized Australian hotel recently. I am concerned about their credit card handling practices. Customers often email their CC number and expiry date in ...
5
votes
2answers
304 views

Clarification on being PCI compliant

So let's say we have a production site that requires VPN access to the datacenter. We also have a dev/qa datacenter in a separate datacenter with it's own VPN connection. When we're sitting in the ...
5
votes
3answers
155 views

Cloud Based WAF

I'm currently evaluating different approaches to implement a web application firewall (WAF) in our architecture. We need the WAF due to PCI DSS. I would prefer using a cloud based WAF (e.g. ...
3
votes
1answer
933 views

Is RDP susceptible to the BEAST attack?

I have Windows 2008 R2 servers which are failing a PCI vulnerability scan because they have RDP enabled (needs to be disabled). I have applied the PCI settings of IISCrypto tool, but I have to leave ...
0
votes
1answer
249 views

How does SAQ A-EP apply in the situation where no I frames are used

I'm really disappointed in SAQ A-EP. I feel that as a web developer, there are just way too many questions that go over my head and I couldn't possibly know. I use primarily Stripe and Braintree in ...
1
vote
3answers
147 views

Clickjacking on a site without user accounts

My understanding of clickjacking attacks is that an attacker could embed my site in his. The attacker then uses clever styling to trick the user into performing actions on my site, that they did not ...