2
votes
2answers
84 views

Is PCI Compliance mandatory?

I recently started working on an eCommerce addition to a site I'm working on.In my research looking for a way to do SSL without a certificate/a free certificate I came across PCI Compliance.I have ...
0
votes
1answer
154 views

When does a PA-DSS certified application expire?

When you search the PCI website for validated payment applications it shows a re-validation date and an expiry date. There is also two categories of payment applications, "Acceptable for new ...
1
vote
3answers
126 views

Are there any security related rules in PCI-DSS that govern when I can capture a payment?

Is there a PCI-DSS rule that a merchant cannot capture the funds for an order until we have actually shipped it? I can't seem to find an official reference that describes this as a PCI DSS ...
5
votes
2answers
794 views

Is SSL terminated at a load balancer PCI compliant?

I've read this nice question: Should SSL be terminated at a load balancer? And I have the same question, but with PCI-DSS compliance in mind. Is SSL terminated at the load balancer, with clear ...
3
votes
3answers
168 views

What is the job of an IT auditor?

I am going through training in information security, as a part of the course they included compliance standards like: PCI DSS ISO 27001-2005 Cobit framework So after searching over Google, I came ...
1
vote
0answers
352 views

How can Stripe be PCI-compliant?

According to the Stripe FAQ, they are PCI-compliant. Also, in their API documentation, one of the parameters to create a new card is the CVC (although, granted, it is optional). So, I assume they ...
4
votes
1answer
581 views

Are Linux vendor-supplied security updates enough for PCI Compliance?

I have several systems that require PCI compliance, all of them are running CentOS 6.4 with all security updates applied daily. However, PCI compliance scanning will often reject detected versions of ...
1
vote
1answer
133 views

Would using Websockets cause PCI compliance failure?

Would utilizing WebSockets cause an issue with obtaining or maintaining PCI compliance?
10
votes
5answers
552 views

Data needed for why not to load third party JavaScript on web page with credit card form

My company makes a JavaScript widget that e-commerce sites can embed on their pages. Our current instructions to our customers tell them to load our JS on every page of their site and most follow this ...
4
votes
1answer
444 views

Nessus HTML5 version 5.0.3 - PCI Scan

I've been searching for a couple days, even contacting support, to find out if Nessus has a bundle that scans for PCI compliance. It selects all 44 categories and regardless of what kind of scan I ...
10
votes
4answers
1k views

PCI-DSS - one application per server?

How do I interpret the 2.2.1 point for PCI-DSS? Is "application server" 'one primary function' or does it need to be "program x server", "program y server" etc? I have a collection of applications ...
3
votes
3answers
116 views

If I host a web form which submits CC details to a provider, are there PCI implications form host?

I'm wondering if anyone has any thoughts on a specific question I have. I read a lot about systems that 'store, process, submit' CC data requiring compliance. If I host a form on my website which ...
2
votes
2answers
170 views

Does requiring users to fill out a PDF w/ CC information and mail it back violate PCI compliance?

I'm attempting to place an order with an American company and I reside outside of America. Upon placing the order (and already submitting payment) I received an email asking me to fill out a PDF ...
4
votes
1answer
304 views

Conceptual design of vulnerability scanning program in global retail network (PCI DSS)

I am trying to design yearly program to scan for vulnerabilities on a very large network of payment terminals. The company has thousands of retail points all around the world which need to be ...
2
votes
3answers
778 views

Vulnerability scanning applicability for PCI DSS

I'm fully up to speed on PCI DSS requirements and have attend the ISA course recently. The course was helpful and I was able to bounce ideas off of the trainer. However I keep coming back to one ...
6
votes
3answers
1k views

If PCI DSS isn't a law, how can I be prosecuted for not being compliant?

PCI DSS isn't a law. Why can I be prosecuted for not being compliant?
1
vote
1answer
339 views

Which PCI DSS SAQ applies when you don't store store but transmit CHD?

We have a merchant website that uses Authorize.net's AIM. Cardholder data (credit card number, expiration date, etc.) is entered at our website. Then it's transmitted to payment gateway and isn't ...
23
votes
2answers
10k views

Minimum requrements for storing last 4 digits of credit card number?

We have a merchant website that uses Autorize.net's CIM and AIM. Our users may have multiple credit cards so we'd want to give them opportunity to distinguish between credit cards that they use on ...
0
votes
2answers
464 views

Is this way of using Authorize.net's CIM PCI compliant?

We have a webapp where Authorize.NET's CIM and AIM are used for payment operations. When user buys something at first time he enters his CC number and other billing information at our site. This ...
2
votes
2answers
870 views

PCI Compliance network scope

I was wondering if anyone could clarify the scope of PCI compliance with regard to multiple networks. At present, there's one PCI compliant network to which another network connects via VPN. The PCI ...
6
votes
3answers
842 views

Is storing card details without the permission of the card holder against PCI DSS?

I've bought something from an online store, and when entering the card details, it sent the details to their server through a HTTPS connection, which I then assume they forwarded to their provider - ...
5
votes
2answers
4k views

PCI DSS requirement 6.4.2 separation of duties between development/test environments

6.4.2 Is there separation of duties between personnel assigned to the development/test environments and those assigned to the production environment? What does the separation of duties here mean? ...
1
vote
3answers
330 views

What is the best way to get a third party audit done of website security?

I have a website that needs to be PCI compliant. I have coded it using the guidelines but to be safe i wanted to get a third party audit done where this individual who runs a IT security firm and ...
1
vote
1answer
690 views

Help with scope clarification of PCI requirement 8.5.15

Section 8.5.15 reads: If a session has been idle for more than 15 minutes, require the user to re-enter the password to re-activate the terminal. Section 8 Accompanying note reads: These ...
3
votes
2answers
767 views

The point of PCI 1.3.1 through 1.3.3

In expansion to my previous question what qualifies as public access? I'm trying to wrap my head around the intent of the points 1.3.1 and 1.3.2 and 1.3.3 of the PCI standard. I have four DMZs at my ...
2
votes
2answers
1k views

Credit card storage, hashes, truncation, encrypted data

I'm trying to figure out a way to meet multiple business requirements that don't seem to go well in hand in terms of security: store encrypted card data associated with customer accounts for ...
3
votes
3answers
748 views

Any place where I can find some template or base documents for IT/Infosec Compliance?

We're facing an audit and we are sorely lacking in documentation regarding information security policies. I've done some Googling and have been surprised by the difficulty of finding a good "template" ...
7
votes
7answers
4k views

Storing credit cards for automatic payments?

I have no experience with storing credit cards and I do not know anything about the legal end of this. The company I work for / develop for wants to store credit cards to process auto payments for ...
5
votes
3answers
278 views

Certifiable standards for server security, besides PCI-DSS?

The Payment Card Industry Data Security Standard is widely used in the financial industry and seems to be a useful requirement from the standpoint of a potential customer (see also Does PCI compliance ...
7
votes
7answers
1k views

Is this set-up PCI-Compliant?

Question: Is there a way to store credit card information on a shared hosting server AND be PCI compliant? Here is the setup: 1) SSL is being implemented for the whole checkout process and for the ...
4
votes
2answers
1k views

Storing account numbers and sort codes online

There are a lot of questions on storing credit card information, and of how PCI SSC/PA-DSS regulations apply to such activities and systems. I have read a lot of these, but my question relates to a ...
19
votes
1answer
2k views

Has anyone achieved PCI compliance on AWS?

All the FAQs, documents and statements published by AWS aside, did any Level 1 merchant or service provider actually achieve PCI compliance on AWS yet? We're evaluating moving some of our services to ...
12
votes
3answers
778 views

Whistleblowing, business ethics and credit card data

I'm writing this post as I'm facing a personal, ethical dillemma and I would like feedback on the best way to approach this situation, particularly from a philosophical point of view. I work for a ...
4
votes
2answers
330 views

Is PCI DSS applicable to other solutions than those dealing with payment cards?

According to this quote from "applicability" section of PCI DSS it's not: The primary account number is the defining factor in the applicability of PCI DSS requirements. PCI DSS requirements ...
4
votes
1answer
187 views

Store To Store communication through MPLS VPN

In a PCI environment with an MPLS VPN network setup should you allow store to store communication? Do you think that an MPLS network would be consider secure enough for this? why or why not?
9
votes
4answers
851 views

New credit card security standards regarding PA-DSS Compliance

The new credit card standards including PA-DSS can be quite confusing for software companies. My question is this: If your software company designs a POS software system (like we do) which utilizes ...
2
votes
1answer
553 views

PCI Compliance - If am eligible to self certify - do I need to use a QSA company in this context?

Setting up a new company with ecommerce app, and looking at PCI compliance. What I need to know is if I need to use a pci security assessor to verify the answers to the self assessment questionnaire? ...
7
votes
1answer
1k views

Is there a way for a consumer to report PCI non compliance?

Is there a way for a consumer to report PCI non compliance?
17
votes
4answers
2k views

Why doesn't the client's web browser need to be PCI compliant?

A hypothetical online store that accepts credit card payment will have to be PCI compliant because it receives (transmit), process and possibly store credit card numbers. But the client's web browser ...
5
votes
1answer
505 views

Does PA-DSS apply to a SaaS eCommerce system?

My company develops and hosts a custom eCommerce and CMS system. We provide this only under a hosted, software-as-a-service model. We are in full control of the hosting environment, and our customers ...
9
votes
4answers
2k views

Is Facebook Connect or Twitter OAuth PCI Compliant?

We have a system that stores credit cards securely on file. We'd love to allow users to sign up using Facebook Connect or Twitter. Obviously this wouldn't be secure if we were trusting just any old ...
3
votes
2answers
313 views

Which PCI SAQ would you say to use if you are neither a merchant nor service provider?

Low down: This client does zero with credit card data (no processing, no passing of it, nothing), but they do have a device often placed on the same network segment of a POS (Point of sale) system. ...
13
votes
3answers
3k views

Nessus vs third-party scans

As part of our PCI-DSS compliance process we get scans done by a third party. Based on the form and wording of the output, it's pretty clear they're using Nessus for most of their heavy lifting. Same ...
21
votes
5answers
3k views

PCI Encryption Key Management

(Full disclosure: I'm already an active participant here and at StackOverflow, but for reasons that should hopefully be obvious, I'm choosing to ask this particular question anonymously). I currently ...
11
votes
2answers
628 views

logging requirements for PCI for web applications

Does PCI dictate how much should be logged at an application level or simply what shouldn't be logged? I'm struggling with too much logging right now and some people who think we should have it. From ...
18
votes
5answers
999 views

Does PCI compliance really reduce risk and improve security?

Might as well bring this hot topic to here! For those not in the know: https://www.pcisecuritystandards.org/
11
votes
4answers
565 views

Wireless Activity Monitoring for PCI DSS Compliance

In an effort to be PCI DSS compliant, I took a trustkeeper.net questionnaire. I failed the question that asks Is the presence of wireless access points tested for by using a wireless analyzer at ...