The pci-dss tag has no wiki summary.
-1
votes
0answers
19 views
APAC PCI LRC calculation [closed]
Can anyone tell me how the LRC is calculated when using APACS or iso 8583 protocol?
Also any other info/advice that may be of use is most welcome?!
Thanks in advance.
3
votes
2answers
77 views
How can I report an ecommerce site in violation of security practices?
I ordered a product from a website and found that their invoice display page is completely un-protected with the order id in the query string and merely incrementing the number exposes every order. ...
1
vote
2answers
82 views
PCI Compliant Key Management solutions that don't cost a fortune
We are relatively small software company who has a requirement to store PAN's for our customers. Hosted payment solutions just don't fit our product requirements. We literally have 3 lines of ...
0
votes
1answer
75 views
Hybrid key management doing it wrong?
I'm currently working on a project that needs be as secure as possible key-management. My experience with encryption, decryption and key-management are none whatsoever so i did some research on the ...
6
votes
2answers
162 views
Is storing card details without the permission of the card holder against PCI DSS?
I've bought something from an online store, and when entering the card details, it sent the details to their server through a HTTPS connection, which I then assume they forwarded to their provider - ...
2
votes
2answers
188 views
PCI DSS requirement 6.4.2 separation of duties between development/test environments
6.4.2 Is there separation of duties between personnel assigned to the development/test environments and those assigned to the production environment?
What does the separation of duties here mean? ...
1
vote
3answers
142 views
What is the best way to get a third party audit done of website security?
I have a website that needs to be PCI compliant. I have coded it using the guidelines but to be safe i wanted to get a third party audit done where this individual who runs a IT security firm and ...
2
votes
1answer
109 views
iPhone Credit Card Payment
I am trying to understand what is the best way to implement a credit card payment flow into a native iPhone app. From what I see on the market, most of the apps use a WebView to process the payment. I ...
1
vote
1answer
76 views
Help with scope clarification of PCI requirement 8.5.15
Section 8.5.15 reads:
If a session has been idle for more than 15 minutes, require the user
to re-enter the password to re-activate the terminal.
Section 8 Accompanying note reads:
These ...
3
votes
2answers
103 views
The point of PCI 1.3.1 through 1.3.3
In expansion to my previous question what qualifies as public access? I'm trying to wrap my head around the intent of the points 1.3.1 and 1.3.2 and 1.3.3 of the PCI standard.
I have four DMZs at my ...
5
votes
1answer
150 views
PCI - what qualifies as public access?
My development staff is in the process of automating our end of month process.
There is a small manual step that needs to be executed.
We have been thinking about the PCI ramifications for making ...
4
votes
3answers
221 views
What logs to retain for PCI-DSS?
I am using Splunk to centrally collect all of my logs for PCI-DSS. I'm running into my licensed volume limit and I need to know exactly what needs to be retained for regulatory compliance.
I am ...
2
votes
1answer
154 views
PCI Compliance guidance
I am in the middle of setting up an ecommerce solution on a commercial website.
My system will store card number in the form of : xxxx-xxxx-xxxx-4000 (just the last 4 digits) and XXX (nothing) for the ...
2
votes
2answers
235 views
Credit card storage, hashes, truncation, encrypted data
I'm trying to figure out a way to meet multiple business requirements that don't seem to go well in hand in terms of security:
store encrypted card data associated with customer accounts for ...
4
votes
3answers
377 views
Storing Credit Card Numbers
I'll be making a website with a membership type of option for the website, and I'll be most likely using Authorize.Net to make the transactions, however, I need to know what kind of encryption I can ...
3
votes
1answer
93 views
PCI DSS and Memcached
If I store cardholder details (PAN, Expiry etc.) in a Memcached data bucket, is that something to worry about in terms of PCI DSS compliance?
Our database is in a data center and is encrypted. Our ...
2
votes
2answers
180 views
Secure Mobile Payments using HTTPS Web App
I'm hoping an expert with PCI compliance knowledge can help answer this question.
We're looking at integrating mobile payments with our application which is HTML5-based for cross-platform reasons. ...
2
votes
3answers
673 views
Groupon SG is Storing Customers' Credit Card Information
Today I was purchasing a gift from Singapore Groupon website. And then I realized that what I have to do is simply login and hit the "submit order" button, because they store my credit card ...
2
votes
0answers
110 views
Using EventStore For PCI Compliance?
I have been hearing a lot of good things about EventStore 3 and am looking to upgrade my server event forwarding systems for PCI compliance next year and was wondering if anyone had looked at the ...
1
vote
3answers
108 views
Any place where I can find some template or base documents for IT/Infosec Compliance?
We're facing an audit and we are sorely lacking in documentation regarding information security policies. I've done some Googling and have been surprised by the difficulty of finding a good "template" ...
3
votes
3answers
143 views
Where's the security when a payment gateway let website handle Credit Card detail
Has anyone worked with eWay payment gateway before?
Basically, there's a service endpoint where you post the customer's detail and credit card details from the web application after the browser sends ...
3
votes
1answer
402 views
SSL certificate fails to adhere to basic constraints and PCI compliance
We have an SSL cert from GoDaddy and tried to run a PCI compliance check using McAfee's scan. The one problem they found was that the basic constraints / path length is not configured. Here's what ...
2
votes
2answers
130 views
PCI Scanning and authenticated user pages
I've just used a security vendor's automated PCI scanning tool to scan my web server.
It only has the ability, out of the box, to scan URLs as an un-authenticated user. This means it is only ...
4
votes
1answer
156 views
PCI-DSS Compliance Management Software?
Does anyone know of PCI compliance management software (specifically PA-DSS, but I'm assuming any kind of PCI-DSS software will do PA-DSS)? Mainly for our application end. We have a 3rd party site but ...
3
votes
1answer
125 views
POS still PCI compliant after Single Sign-on?
I have a Point of Sale System that's a web application. I also have a separate reporting system that's a web application and a separate inventory system that's a web application. It's necessary to use ...
3
votes
2answers
159 views
Payment gateway integration, any security considerations?
I'm interested in understanding what security considerations there are around implementing a payment gateway. I have, so far, thought of:
having a SSL Cert is a MUST.
logging actions is critical.
...
7
votes
7answers
433 views
Storing credit cards for automatic payments?
I have no experience with storing credit cards and I do not know anything about the legal end of this.
The company I work for / develop for wants to store credit cards to process auto payments for ...
5
votes
3answers
173 views
Certifiable standards for server security, besides PCI-DSS?
The Payment Card Industry Data Security Standard is widely used in the financial industry and seems to be a useful requirement from the standpoint of a potential customer (see also Does PCI compliance ...
5
votes
6answers
341 views
Is this set-up PCI-Compliant?
Question: Is there a way to store credit card information on a shared hosting server AND be PCI compliant?
Here is the setup:
1) SSL is being implemented for the whole checkout process and for the ...
4
votes
2answers
242 views
Storing account numbers and sort codes online
There are a lot of questions on storing credit card information, and of how PCI SSC/PA-DSS regulations apply to such activities and systems. I have read a lot of these, but my question relates to a ...
5
votes
3answers
280 views
Where do I securely store the key for a system where the source is visible?
I have a customer with an Access database (ugh!) in which credit cards are stored in plaintext (yikes!), so amongst other changes I'm doing in the app, I'm applying some encryption in there.
I've ...
17
votes
1answer
668 views
Has anyone achieved PCI compliance on AWS?
All the FAQs, documents and statements published by AWS aside, did any Level 1 merchant or service provider actually achieve PCI compliance on AWS yet? We're evaluating moving some of our services to ...
12
votes
3answers
352 views
Whistleblowing, business ethics and credit card data
I'm writing this post as I'm facing a personal, ethical dillemma and I would like feedback on the best way to approach this situation, particularly from a philosophical point of view.
I work for a ...
8
votes
4answers
456 views
PCI restrictions on using using (hashed) credit card number to identify a repeat customer?
Question for any PCI experts out there:
Airport ticket kiosks can use your credit card to find your reservation at checkin time. So clearly PCI must allow use of credit card numbers to identify ...
4
votes
2answers
152 views
Is PCI DSS applicable to other solutions than those dealing with payment cards?
According to this quote from "applicability" section of PCI DSS it's not:
The primary account number is the
defining factor in the applicability
of PCI DSS requirements. PCI DSS
requirements ...
4
votes
1answer
122 views
Store To Store communication through MPLS VPN
In a PCI environment with an MPLS VPN network setup should you allow store to store communication?
Do you think that an MPLS network would be consider secure enough for this? why or why not?
8
votes
3answers
310 views
New credit card security standards regarding PA-DSS Compliance
The new credit card standards including PA-DSS can be quite confusing for software companies.
My question is this: If your software company designs a POS software system (like we do) which utilizes ...
1
vote
1answer
197 views
PCI Compliance - If am eligible to self certify - do I need to use a QSA company in this context?
Setting up a new company with ecommerce app, and looking at PCI compliance.
What I need to know is if I need to use a pci security assessor to verify the answers to the self assessment questionnaire?
...
7
votes
1answer
359 views
Is there a way for a consumer to report PCI non compliance?
Is there a way for a consumer to report PCI non compliance?
4
votes
2answers
247 views
How to submit credit card info to a separate server/website (PCI)
My company has a website/service that stores/processes credit cards and is PCI compliant (Site A). We also have websites with storefronts that need to submit credit card data to that site for ...
15
votes
5answers
673 views
Why doesn't the client's web browser need to be PCI compliant?
A hypothetical online store that accepts credit card payment will have to be PCI compliant because it receives (transmit), process and possibly store credit card numbers.
But the client's web browser ...
3
votes
3answers
708 views
Web app pen testing tools for pre-PCI scan / assessment [closed]
Possible Duplicate:
What tools are available to assess the security of a web application?
I have a client that wants me to make an effort to uncover any vulnerabilities I can in their web ...
5
votes
1answer
229 views
Does PA-DSS apply to a SaaS eCommerce system?
My company develops and hosts a custom eCommerce and CMS system. We provide this only under a hosted, software-as-a-service model. We are in full control of the hosting environment, and our customers ...
6
votes
3answers
831 views
Is Facebook Connect or Twitter OAuth PCI Compliant?
We have a system that stores credit cards securely on file. We'd love to allow users to sign up using Facebook Connect or Twitter.
Obviously this wouldn't be secure if we were trusting just any old ...
3
votes
2answers
221 views
Which PCI SAQ would you say to use if you are neither a merchant nor service provider?
Low down: This client does zero with credit card data (no processing, no passing of it, nothing), but they do have a device often placed on the same network segment of a POS (Point of sale) system.
...
10
votes
3answers
961 views
Nessus vs third-party scans
As part of our PCI-DSS compliance process we get scans done by a third party. Based on the form and wording of the output, it's pretty clear they're using Nessus for most of their heavy lifting. Same ...
18
votes
5answers
997 views
PCI Encryption Key Management
(Full disclosure: I'm already an active participant here and at StackOverflow, but for reasons that should hopefully be obvious, I'm choosing to ask this particular question anonymously).
I currently ...
8
votes
2answers
311 views
logging requirements for PCI for web applications
Does PCI dictate how much should be logged at an application level or simply what shouldn't be logged?
I'm struggling with too much logging right now and some people who think we should have it. From ...
6
votes
3answers
138 views
Securing an E-commerce site
I'm building a custom e-commerce site, and the user will input their credit card details on the site instead of being directed to the payment gateway's site.
I'm confused as to what the critical ...
14
votes
5answers
475 views
Does PCI compliance really reduce risk and improve security?
Might as well bring this hot topic to here!
For those not in the know: https://www.pcisecuritystandards.org/
