An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

learn more… | top users | synonyms

0
votes
0answers
3 views

Level 4 merchants becoming PCI Compliant

I was prompted recently to take a deeper look into some of the PCI requirement information, and I have found some pretty serious discrepancies with regard to the reporting obligations of Level 4 ...
2
votes
1answer
84 views

Transmitting Credit Card Information

I want to know how secure it is to transmit Credit Card details as plain text to the payment gateway from my website using HTTPS. We are not storing any details in our database but I read that ...
0
votes
1answer
28 views

PCI DSS Compliance for a Level 4 organization

We are a small company and process less than 500 Credit Card transactions each year so we fall under Level 4 category merchants. The company heads wants to make sure that we are PCI compliant at all ...
0
votes
1answer
29 views

PCI Compliance - Antivirus in host and virtual environment?

We have a couple servers with a host system, and virtual DB and Web instances. Is it possible to be compliant with PCI if you install the Antivirus only on the host system, or does it need to be ...
2
votes
0answers
32 views

Advice on if I should talk at my local user group about NIST, InfoSec etc [closed]

I have been toying with the idea for a while now about doing my first talk, on my last project I was building a Risk Management portal for information security so I had to read all about Risk ...
3
votes
1answer
144 views

Is storing CVV compliant with PCI standards?

From personal, job-related experience I know that many "Booking Engines" store the CVV info for customers' credit cards from the time a reservation is made until the time the guest leaves the hotel. ...
-1
votes
0answers
27 views

Which PCI DSS SAQ applies when you store only the last 4 digits of the PAN and the expiry date? [closed]

Which PCI DSS SAQ applies when you store only the last 4 digits of the PAN and the expiry date?
0
votes
0answers
47 views

PCI-DSS: Recomendations for Mixed-Mode Virtual Environments

We are PCI-DSS 2.0 compliant. We have three internal networks: GENERAL (workstations, app file servers) workstations can RDP to the PCI servers in order to work on the cardholder data. MANAGEMENT ...
0
votes
2answers
54 views

Storing CardHolder Data using RC2 encryption

I would like to know if storing credit cardholder data using RC2 encryption requires to be compliant with PCI DSS. Currently the 16 digit PAN number and expiry date is stored in the database. The PAN ...
1
vote
1answer
67 views

PCI DSS 3.0 - Is restricting SSH and/or RDP outbound required?

This question comes up a lot as I do evaluations for different customers. I currently recommend the following: All outbound SSH & RDP blocked by default from user network (non-CDE) All outbound ...
2
votes
2answers
40 views

PCI DSS - mask PAN and log individual access to PAN

How do you re-conciliate two PCI DSS requirements in applications: 3.3 Mask PAN when displayed (the first six and last four digits are the maximum number of digits to be displayed), such that only ...
0
votes
0answers
15 views

PCI service provider and separation

This is connection to my previous question: Shared Database and PCI Compliance However, this question relates to the requirement "Appendix A: Additional PCI DSS Requirements for Shared Hosting ...
3
votes
1answer
38 views

Dealing with credit card data that is not charged directly

I have a client who is a reseller for vacation packages. For years they've had a payment form on their site where the end user would fill out their credit card data and the information is emailed to ...
4
votes
1answer
69 views

PCI Compliance and PayPal

First, please forgive my ignorance. Until this week, the only "credit card security" I understood was how to hack systems and why to write PHP pages with the types of features I do (msqli, pdo, ...
1
vote
1answer
61 views

Can you store sensitive app config vars in the environment and be PCI compliant?

Note: this is a cross post from my question on SO. Feel free to keep the one in the more relevant location and close the other. We have a rails app which will be deployed on torquebox/jboss. (This in ...
1
vote
1answer
53 views

What is the difference between Internal and External scan in PCI

Is each firewall interface IP is considered as external IP?. Do we need to scan each interface IP??. What is an internal scan? What are the elements for internal, how we do it?.
-1
votes
2answers
46 views

Tools to check the firewall Configurations as per PCI standards [closed]

How do you audit the Firewall rules and configuration policies as per PCI standard. What are the tools used for it.
2
votes
1answer
38 views

PCI - prohibiting direct connections to the Cardholder Data Environment

In PCI 1.3.3 it states: Are direct connections prohibited for inbound or outbound traffic between the Internet and the cardholder data environment? A Cardholder Data Environment (CDE) ...
2
votes
2answers
87 views

What are the insecure Protocols in terms of PCI DSS

What are the insecure protocols which should be disabled according to PCI DSS standard. How to check those are disabled in Firewalls and Servers.
1
vote
2answers
46 views

Shared Database and PCI Compliance

Say we have a cloud based web application which is SaaS. This application is to be made PCI compliant as a service provider, as client card data passes through the application. This application uses a ...
1
vote
1answer
33 views

Code deployment in PCI CDE

The PCI DSS v3 standard states the following: Network Segmentation To be considered out of scope for PCI DSS, a system component must be properly isolated (segmented) from the CDE, such that ...
0
votes
1answer
27 views

Do we require to eliminate share drive access to PCI users?

Do we really require to eliminate the share drive access to the PCI users. We have a file server outside PCI VLAN. But PCI users have access to it. We dont have any DLP solutions. Does the PCI ...
0
votes
3answers
51 views

Is PCI-DSS compliance required for non-credit card payment source?

We have a banking application that allows you to pay your bills (using your savings/checking account) -- including your credit card bills. However our system was set up such that you enter the credit ...
1
vote
1answer
33 views

PCI Compliance for attachment in email

I am wondering if they are any PCI compliance issues around users of a service sending email with attachments that may or may not contain sensitive information through said service? As an example, if ...
0
votes
2answers
95 views

PCI Compliance - Encrypted Mobile Apps

My company (health care) went through a PCI audit and needs to solve some major issues. Our branches collect CHD on paper and saves them to a network drive as a pdf that our corp office accesses to ...
0
votes
3answers
74 views

PCI Compliance Check-list

I'm currently attempting to wrap my head around PCI compliance - and what I need to do for my business to be compliant. I would like some confirmation on what I've found so far. I accept payments in ...
22
votes
2answers
688 views

Effect on PCI compliance of not checking SSL certificate?

PCI DSS states: "[You must...] verify that only trusted SSL/TLS keys/certificates are accepted." Long story short, our payment service provider just asked us to please stop verifying their ...
0
votes
1answer
54 views

masking credit cards PAN with zeros

The PCI-DSS only requires you to protect the PAN if you are storing MORE THAN the first six and last four digits. Can an all zero mask be used? E.g. 4111 1100 0000 1234 to make it PCI compliant / not ...
3
votes
3answers
414 views

PCI compliance if not storing or transmitting credit card data

I have a networked product that we install on customer networks. The device is does not pass any of the CC data, but only sits on the same network (think Nest or Dropcam). The customer networks ...
2
votes
1answer
57 views

Handling unencrypted HTTP data for a PCI compliant system - in scope for PCI DSS v3 but not v2?

We currently have a custom, cloud based application that can analyse then route HTTP and HTTPS traffic through to a domain. So if a client wants to use our service, they re-point their DNS to our ...
2
votes
1answer
58 views

How do you back up cardholder data remotely without a network connection?

In the PCI DSS version 3 it says: 1.3.3 Do not allow any direct connections inbound or outbound for traffic between the Internet and the cardholder data environment. But in the event of hard ...
2
votes
1answer
58 views

Conversant, CNAME, Cookies, and PCI complaince

We have been asked to evaluate Conversant Tracking. http://www.conversantmedia.com/solutions/enterprise-solutions From what I can tell its pretty straight forward tracking, like google re-marketing, ...
1
vote
1answer
71 views

My app is asking for card details, but does not stores them. Do I need PCI compliance?

I plan to build an Android/iPhone app. The app will contain a few forms and status screens. One of the screens will ask the user for their card details. Once they'll click submit they'll be sent over ...
1
vote
3answers
113 views

How are HSMs used in payment processing on the server?

I came to know recently that HSMs are used in credit card processing on the server side but since I don't work in that space and stumped as to why its needed. I can see it used in an ATM machine - ...
1
vote
1answer
151 views

TrustWave PCI Compliance - OpenSSH

First time 'asker' on here, but wanted to say thanks to how much I've used this site and reading answers to questions I've had! Anyway, lately I've been having issues with a customer of ours who's ...
0
votes
2answers
78 views

PCI compliance and external resources http/https

Firstly, if a site is PCI compliant, and new references to a 3rd-party file (e.g. image, Javascript, CSS, etc…) via http:// instead of https:// are added, does it violate PCI compliance? Secondly, ...
4
votes
2answers
160 views

SAQ A-EP Requirements for VPS Hosting

We are hosting a site on a self-managed Digital Ocean VPS ("Droplet") that will be taking payments via Stripe using their stripe.js API. According to PCI, we have determined that we fall under the SAQ ...
0
votes
1answer
273 views

What can a hacker do with a card number without CVV? [duplicate]

From my experience a card can not be used for online payment without a valid CVV, then why is it still always emphasized that card number must be protected? What can a hacker do, assume that he has ...
0
votes
4answers
212 views

Using a Public-Key-Encryption browser side to avoid PCI compliance

We're developing a web application in which certain not logged users (clients) need to send their credit card details to other users (merchants) - which, we'll assume, are PCI compliant. We are ...
5
votes
1answer
112 views

Is a Linux environment PCI compliant if the swap file is not encrypted and PANs are loaded into RAM?

Is a Linux environment PCI compliant if the swap partition/file is not encrypted and PANs are loaded into RAM by an application?
-1
votes
1answer
148 views

PCI compliant transparent data encryption at disk/folder level on Windows?

Is there a way to achieve PCI compliant data encryption at disk/folder level in Windows in a way that is transparent to applications(they must be able to write/read to encrypted folders/disks as if ...
1
vote
2answers
60 views

pci compliance and temporary files

Does storing temporarily a non-encrypted file containing some PANs violate pci requirements? (for example because it is being processed by an application, or to open it on a file editor)
1
vote
2answers
55 views

Using Free AV to meet PCI Requirement 5

I am looking for some opinions on using free AV for meet PCI requirement 5. The way I read this for version 2.0 is that it's entirely possible for a client to meet their AV needs with the modern free ...
1
vote
4answers
334 views

Storing CVC / CVV / CVV2 until payment is processed

I need to store the payment info of a transaction. We have a script that reads which transactions haven't yet been sent to our ERP (the business management software), to then send it. This script ...
1
vote
2answers
436 views

If am using Stripe am I SAQ A-EP in PCI V3

We are going through the PCI process at the moment and because v2 goes out of date on December 2014, I opted to use PCI v3. Because with Stripe you put the form inside your application and post to ...
2
votes
1answer
100 views

How much information is released when paying with a debit card

How much information is released when paying with a debit card? Is it possible for a vendor to grab your name and address from your debit card and send you things in the mail?
1
vote
1answer
173 views

is it illegal to share customer credit card data

I have an app where users can enter credit card data and it is stored using a 3rd party toservice like BluePay or Authorize.net, I do not and will not save it in my system. Trying to get this point ...
0
votes
1answer
30 views

PCI questions regarding software

As a software company who is looking at writing something that could handle debit cards can I self certify my software or do I have to have it tested by a 3rd party company?
17
votes
3answers
2k views

How to store credit card information for repeated transactions and still be PCI compliant?

I'm overhauling our absolute time-bomb of an order processing system that would put us out of business tomorrow were we audited for PCI compliance. It's so amateur it's scary. I'm planning on making ...
1
vote
1answer
70 views

Does PCI DSS 1.4 include tablets and smartphones?

1.4 install personal firewall software on any mobile and/or employee-owned computers with direct connectivity to the Internet (for example, laptops used by employees), which are used to access the ...