An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

learn more… | top users | synonyms

1
vote
1answer
36 views

Would the following practice make email PCI compliant?

If a system applied to the following three practice/technologies to each e-mail, would it rate as PCI compliant? The email itself is encrypted Encryption is applied end-to-end in the transport layer ...
1
vote
1answer
20 views

Can a non-PCI Compliant Service Provider provide SAQ A-EP compliance?

I am trying to find clarification regarding PCI Compliance SAQ A-EP and third party hosting solutions. In order to achieve SAQ A-EP PCI Compliance using "Hosting Company A" is it necessary for "...
0
votes
2answers
204 views

Is PIN affective security for credit cards considering it's not always needed?

This question asked about how having a PIN is safer than signing the receipt when doing a credit card transaction (personally the question makes no sense to me as it's just a scientific fact that a ...
8
votes
3answers
205 views

A store I visited is breaching PCI DSS. What should I do?

I recently visited a store in Northern Ireland and paid using my Visa debit card. The receipt shows my entire card number and expiry date. It also contains other info. I thought this should all be ...
2
votes
2answers
73 views

Using browser AJAX to initiate credit card transaction with processor?

Let's say that I have a website where people can make purchases, donations, etc. The entire website is served with https. I store the information regarding the purchases (item, quantity, price) as ...
0
votes
1answer
29 views

PCI DSS Scope outside CDE

Our organization is in process of determining if our PCI DSS scope is correct. We have done lots of research and read the Open PCI DSS Scoping Toolkit document. However, we still struggle to fully ...
3
votes
1answer
64 views

Is it PCI compliant to write down credit card information on paper and store it in unattended boxes?

There is a local mom and pop video store that requires new customers to write their names, addresses, and credit card information on 3x5 cards. These cards are actually kept in a recipe cards box that ...
2
votes
2answers
41 views

Interaction between cash register and card terminal

A store allows you to join their loyalty club by simply presenting an ID and a credit card. Your identity is somehow linked to your card and automatically registered the next time you pay, no extra ...
1
vote
1answer
46 views

PCI Compliance requirement when storing card data on user's device

I have an application where I take the user to a PCI compliant payment gateway for completing the payment. I want to give the functionality of "Remember my card" so that the user does not have to ...
0
votes
1answer
103 views

PCI check failing

I have had a customer come to me with a failed PCI compliance check with the failure apparently caused by an extension I develop. The scenario is that web page content is served by the extension but ...
3
votes
1answer
53 views

Store PCI DSS data in an encrypted form in non PCI DSS scope

Am I allowed to save a strongly encrypted archive containing the CHD on an external storage which is outside our PCI-DSS infrastructure ? For example, we'd like to save an encrypted backup archive ...
3
votes
2answers
155 views

How to not store the card during 3D Secure authentication, to be PCI DSS compliant?

I'm implementing a payment solution where the cardholder enters his card details on our own website. We need to use 3D Secure for extra authentication of the cardholder. Our payment gateway ...
1
vote
1answer
17 views

Should EMV data fields be encrypted?

Are there any EMV data fields considered to be sensitive data according to the PCI DSS standard?
2
votes
2answers
72 views

PCI DSS 3.1 and Windows XP

I'm looking for some clarification on the effects of PCI DSS v3.1. In an consumer ecommerce context (e.g amazon.com), I'm assuming that customers attempting to make credit card purchases on the site,...
2
votes
1answer
120 views

HTTPS iFrame embedded in HTTP page - PCI implications?

I'm currently volunteering at a nonprofit. While researching something unrelated, I noticed that a $sisteragency was using an embedded iFrame to accept online donations. While the frame's source uses ...
3
votes
3answers
59 views

How to be PCI compliant with Shopkeep (and others)?

When I walk into some businesses, I see them using Shopkeep on an iPad. I don't understand how this is PCI compliant, as the iPad itself would be in scope, and it can send unconstrained traffic to ...
2
votes
2answers
3k views

Does sending credit card info over email violates PCI DSS?

Being in the US, I have noticed that more and more companies ask to send sensitive credit card information (all information that is required to make a transaction) over a plain email. I believe that ...
0
votes
1answer
41 views

How to export application metrics out of PCI environment

I am building a credit card tokenization/payment-processing service. As these services need sit in pci-compliant environment, I find it hard to export the application metrics & logs. Anyone knows ...
2
votes
2answers
81 views

Is there a difference between getting encryption key versus encrypted data from server in terms of security

Suppose we have web and application servers and trying to encrypt credit card information for our financial web application. Communication between web and app servers are secured through SSL/TLS. Lets ...
6
votes
1answer
845 views

PCI Compliance and PayPal

First, please forgive my ignorance. Until this week, the only "credit card security" I understood was how to hack systems and why to write PHP pages with the types of features I do (msqli, pdo, ...
0
votes
1answer
62 views

PCI-DSS compliance in scope if part of card number and expiry stored only? [duplicate]

If we were to store the following information about a credit card, would we need to be PCI-DSS compliance or are we out of scope? Please assume for the purposes of this question that we only store ...
5
votes
3answers
208 views

Do you have to ban cellphones and paper to be PCI compliant?

Today I heard of a call centre that you are not allowed to bring cellphones into or take paper out of. This is allegedly to be PCI complaint. Is this true? What is the reasoning? This seems like ...
0
votes
1answer
50 views

How Point-to-Point encryption eliminates PAN storing? [closed]

Encrypted Primary Account Numbers (PAN) are stored without any personal info. The intention is to tie it for the refunds purposes. To move to a PCI-DSS environment, a vendor recommends moving to P2PE ...
-1
votes
1answer
41 views

Studying to become a ASV, need some guidence

I have completed the online training/exam to become an ASV (Approved Scanning Vendor) for my company. We currently have Nessus as our platform, and I am not feeling too great about it's capabilities. ...
0
votes
0answers
50 views

Handling Credit Card info in Source Code

Background Info I am using an API to make donation to charities (First Giving API). The API only supports credit card info for making a donation. Due to the requirements of the application, donors ...
1
vote
1answer
86 views

PCI: Does CHD or SAD still need to be protected after implementing a P2PE solution?

The promise of a good (even certified) PCI P2PE v2 solution is that the merchant does not have access to the keys which encrypted the Card Holder Data (CHD) and the Sensitive Authentication Data (SAD) ...
3
votes
1answer
737 views

Is it OK to generate a token for a credit card without the user's permission? Is that PCI compliant?

Is it PCI compliant to generate a token for every card used for processing, regardless of whether the client asked for his card to be saved or not?
3
votes
3answers
56 views

Boundaries of Personally Identifiable Information - PCI-DSS

I am attempting to ascertain the boundaries of personally identifiable information. For example does the combination of John and Doe equate to personally identifiable information since there could ...
2
votes
1answer
117 views

PCI DSS placement of puppet (or chef) server?

I'm puzzled as to whether I am allowed to set up a puppet server in a PCI DSS environment, and if I am, where should it be located? I was planning on installing it on gateway, and all the hosts would ...
1
vote
1answer
46 views

Call recording PCI-DSS issues

For a non-automated payment card entry system, if a caller is providing a payment card details over the phone to a call centre employee who confirms the number to the caller, does that mean the ...
2
votes
2answers
369 views

Are these merchant integration instructions wrong about server-client interaction?

I'm working with a payment gateway that seems to have a fundamental misunderstanding of "clients" and how to protect sensitive data. The integration instructions are mostly about a "redirect" mode of ...
12
votes
4answers
11k views

What logs to retain for PCI-DSS?

I am using Splunk to centrally collect all of my logs for PCI-DSS. I'm running into my licensed volume limit and I need to know exactly what needs to be retained for regulatory compliance. I am ...
4
votes
0answers
38 views

Major UK company seems to be handling customer & card data recklessly [duplicate]

A company I used to work for is passing customer's personal details as well as card data (number, expiration date, name, CVV2 and the contents of the magstripe thanks to a reader) through Windows XP ...
1
vote
0answers
39 views

Approved Certificate Authorities for certification/compliance with HIPAA, PCI etc

Are there any requirements in PCI or HIPAA, or other security standards that may impact general government, payment processing, healthcare, that would disqualify any CA vendors that are trusted by the ...
4
votes
1answer
7k views

SSL certificate fails to adhere to basic constraints and PCI compliance

We have an SSL cert from GoDaddy and tried to run a PCI compliance check using McAfee's scan. The one problem they found was that the basic constraints / path length is not configured. Here's what ...
3
votes
1answer
30 views

ASV scan - What to expect from external scan services?

We've been asked to perform a vulnerability scan in our servers which process transactions with payment cards as a requirement for PCI compliance. PCI DSS mandates this scan must be done by a ASV. ...
3
votes
2answers
4k views

Effective wireless scanning to meet PCI DSS 11.1?

PCI-DSS section 11.2 requires the business to "Test for the presence of wireless access points and detect unauthorized wireless access points". However, this is more easily said than done. Simply ...
2
votes
1answer
35 views

What is the difference between PCI-DSS compliance and certification?

PCI-DSS compliance and certification appears to be used interchangeably however it isn't clear what the differences are. For example if you are certified does it mean you are compliant and if you ...
3
votes
3answers
206 views

Creditcard store first six digits PCI reference

I need to store masked PAN with first six digits and last four digits along with the card expiry month and year. Is it safe to do it according to the PCI rules? Regarding four digits has been ...
3
votes
1answer
99 views

Unable to completely enforce password policy

PCI DSS has a few requirements regarding the password policy (like remember last four passwords, change password every 90 days, use at least seven numeric and alphabetic characters and more). These ...
1
vote
0answers
20 views

PCI-DSS Helping customers with a third-party booking service

My clients are able to pay for services through a website EXAMPLE.COM. Sometimes, a client will call on the phone looking to pay for services over the phone. I would like to use a device to visit ...
0
votes
1answer
57 views

Storing last 6 digits of payment card vs 4 digits

I am wondering what are the risks associated with storing last 6 digits of a payment card as compared to the last 4 digits. In addition, will it have implications on PCI DSS compliance?
1
vote
2answers
39 views

PA-DSS & DTMF application

If the payment application is not storing any credit card information, does it needs to be PA-DSS? The application takes the Credit card information using DTMF and pass-through via secure XML for ...
1
vote
0answers
36 views

SAQ D PCI Compliance for Custom Shopping Cart

We use a custom developed open-source e-commerce software. We are SAQ D and I am trying to figure out which of these requirements applies to our cart if: We aren't storing credit card information We ...
2
votes
5answers
179 views

PCI Compliance and fines

Our organisation has validated compliance with PCI DSS. What are the consequences to us if we had been breached by a security incident related to credit card information, considering we have validated ...
2
votes
1answer
69 views

PCI Scope, Tokens, and Processor APIs

A merchant receives a processor provided payment token in response to an authorization from an online order (for the sake of this question assume this part of the process has all its PCI t-s crossed ...
1
vote
3answers
221 views

PCI Definition of “Transmission”

I am working at a company that is PCI compliant, but I believe they have interpreted some of the requirements incorrectly. Because of this, they are laboring to create work-arounds which I suspect are ...
5
votes
3answers
834 views

Cardholder data segmentation for PCI compliance (3.2)

We are currently collecting card holder data in a segmented way. Our system is used by call center agants which I will refer to as channel B Over channel A (mobile carrier) we collect the first 8 ...
3
votes
1answer
42 views

PCI definition of “store”

In the PCI DSS 3.1 requirements, the term "store" is used often. For example requirement 3.2 says "Do not store sensitive authentication data after authorization (even if encrypted)..." Does this ...
0
votes
2answers
160 views

How to prevent sysadmins tampering with code?

Let's say you have some sensitive user data you need to protect (e.g., for PCI compliance) and you have done this by having the server code encrypt it before storing it in a separate server where no ...