An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

learn more… | top users | synonyms

3
votes
1answer
31 views

What's the advantage of passing credit cards via javascript vs. over the server (without saving it)?

I've noticed current credit card gateways like stripe and wepay encourage sending the credit card number via their js framework (which would use some iframe jsonp magic to pass the data). To my ...
-1
votes
0answers
17 views

PCI DSS Requirements covered by Vanguard solution [on hold]

I am interested in the Vanguard PCI DSS solution concerning System z compliance. I was wondering if anyone knows which specific PCI DSS requirements are covered when this solution is used? I see ...
3
votes
1answer
69 views

How can a very small company handle PCI-DSS requirement 6.4.2?

PCI-DSS 3 requirement 6.4.2 calls for Separation of duties between development/test and production environments. Based on the guidance text and this, answer to another question, it appears ...
1
vote
0answers
24 views

How to design a right VPN connection for an organisation (Interconnected MPLS link or Individual FW)

Thanks in advance for your advice We have to implement VPN connection for nearly 7 countries Option 1 : As we have private MPLS link to all 7 countries. It is been outsourced Third party. They ...
1
vote
0answers
112 views

OSSEC not detecting deleted files?

I have configured 3 VMs: ossec server and two agents in CentOS 6 and Windows 2k8 R2. I have completed the setup and FIM and Log Management works smoothly. It also reports the new files. However, it ...
3
votes
2answers
180 views

Are credit card number look ups more secure with a hash function than with a deterministic encryption algorithm?

I understand PCI DSS 3.0 allows hashes of cardnumbers to be stored separately from encrypted values, but I'm startled at the efficiency of tools like hashcat in discovering card numbers from hashed ...
3
votes
2answers
93 views

Dealing with credit card data that is not charged directly

I have a client who is a reseller for vacation packages. For years they've had a payment form on their site where the end user would fill out their credit card data and the information is emailed to ...
1
vote
3answers
945 views

If am using Stripe am I SAQ A-EP in PCI V3

We are going through the PCI process at the moment and because v2 goes out of date on December 2014, I opted to use PCI v3. Because with Stripe you put the form inside your application and post to ...
1
vote
1answer
62 views

card.io & PCI DSS v3.0

I've researched for quite some time now, but I cannot find an answer to this question: If I touch card holder data in any way, I need PCI DSS v3.0 SAQ A-EP certification, which is quite complex to ...
2
votes
2answers
72 views

Determining PCI DSS SAQ level

I have a b2b SaaS that my clients then use with their own customers to gather data in a face to face scenario with iPads, I would like to expand it to take credit card details. The credit card details ...
0
votes
1answer
27 views

PCI compliant RSA key generation and getting value of private exponent

Is it possible to generate RSA key and get its private exponent in clear and to be compliant with the following PCI requirement?: Keys must be generated so that it is not feasible to determine that ...
0
votes
1answer
31 views

PCI DSS - Network Design - users connect to internet via proxy;Should we place it at the last hop or before FW?

We need to be PCI compliant. PCI user VLAN is connecting to Internet via proxy but i need confirmation about the location of the proxy. PCI user traffic flow PC ==> ASA FW ==> IPS(integrated with ...
0
votes
1answer
260 views

DSA Generates different signatures with the same data [closed]

I'm using the example given in msdn article about the DSACryptoServiceProvider Class. The problem is that I get a different signature each time I run the code. I tried OpenSSL and didn't get this ...
2
votes
2answers
65 views

Is HTTPS required for PCI Compliance when downloading desktop software patches, if no PII is transmitted, and content is digitally signed + verified?

We have a desktop app that downloads patch content via HTTP. The content is digitally signed and verified by client software after download. Is HTTPS required to achieve PCI compliance if: No PII ...
1
vote
1answer
33 views

Does PCI compliance requires DRP even if we dont store Card data

Our company is does not store any credit card details. We are storing it in a cloud platform which is already PCI compliant. We just require to access the Cloud portal from our company. I understand ...
0
votes
0answers
34 views

Backup procedure for PCI

Our company is does not store any credit card details. We are storing it in a cloud platform which is already PCI compliant. We just require to access the Cloud portal from our company. I understand ...
0
votes
1answer
56 views

How to enforce TLS on Windows [duplicate]

In Windows 2008 R2 and 2012, how do you enforce TLS-only and how do you demonstrate that posture? I am in IP Compliance and have a strong background in practical system administration and support. I ...
3
votes
3answers
703 views

PCI DSS 2.0 and ssh keys

I know the real answer to the auditor. We are a smaller company under 40 total employees that is also PCI level 1 compliant. We've always used ssh keys on internal servers. You can't ssh in from the ...
20
votes
4answers
4k views

How to store credit card information for repeated transactions and still be PCI compliant?

I'm overhauling our absolute time-bomb of an order processing system that would put us out of business tomorrow were we audited for PCI compliance. It's so amateur it's scary. I'm planning on making ...
5
votes
2answers
73 views

Cloud Based WAF

I'm currently evaluating different approaches to implement a web application firewall (WAF) in our architecture. We need the WAF due to PCI DSS. I would prefer using a cloud based WAF (e.g. ...
1
vote
1answer
100 views

Can you store sensitive app config vars in the environment and be PCI compliant?

Note: this is a cross post from my question on SO. Feel free to keep the one in the more relevant location and close the other. We have a rails app which will be deployed on torquebox/jboss. (This in ...
5
votes
3answers
146 views

Looking for credit card data and other PII in files

I'm looking for ways to check for the presence of credit-card data and other personally identifiable information in files on a network I'm testing. Currently i'm doing this manually with the usual ...
1
vote
1answer
35 views

Can we use same Active directory / Proxy servers for PCI and Non PCI Segment users?

Can we use the same AD server for both PCI VLAN user and Non PCI VLAN users? How about proxy, we have a Proxy but both PCI and Non PCI user's traffic are flowing through those Proxy. But we have ...
2
votes
3answers
71 views

Businesses Handling Credit Cards via Email

I have done some I.T. contracting for a medium-sized Australian hotel recently. I am concerned about their credit card handling practices. Customers often email their CC number and expiry date in ...
1
vote
2answers
32 views

PCI DSS and ssh keys for root

Referring to this PCI DSS 2.0 and ssh keys I want to ask Is this PCI section 8.2 only for individual users or also valid if a user connects via ssh to a root account? I prefer to ssh root@localhost ...
5
votes
2answers
223 views

Clarification on being PCI compliant

So let's say we have a production site that requires VPN access to the datacenter. We also have a dev/qa datacenter in a separate datacenter with it's own VPN connection. When we're sitting in the ...
3
votes
1answer
250 views

Is RDP susceptible to the BEAST attack?

I have Windows 2008 R2 servers which are failing a PCI vulnerability scan because they have RDP enabled (needs to be disabled). I have applied the PCI settings of IISCrypto tool, but I have to leave ...
3
votes
2answers
135 views

PCI DSS - mask PAN and log individual access to PAN

How do you re-conciliate two PCI DSS requirements in applications: 3.3 Mask PAN when displayed (the first six and last four digits are the maximum number of digits to be displayed), such that only ...
-1
votes
1answer
86 views

How does SAQ A-EP apply in the situation where no I frames are used

I'm really disappointed in SAQ A-EP. I feel that as a web developer, there are just way too many questions that go over my head and I couldn't possibly know. I use primarily Stripe and Braintree in ...
1
vote
3answers
88 views

Clickjacking on a site without user accounts

My understanding of clickjacking attacks is that an attacker could embed my site in his. The attacker then uses clever styling to trick the user into performing actions on my site, that they did not ...
6
votes
2answers
399 views

What does the PCI-DSS statement “Store separately from the data encrypting key” mean?

As per the PCI-DSS 3.5.2 requirement Encrypted with a key-encrypting key that is at least as strong as the data-encrypting key, and that is stored separately from the data encrypting key. Does this ...
2
votes
3answers
689 views

PCI DSS - only one primary function per server

The PCI DSS says that a server can have only one primary function and i'm a little confused over what it means by 'one primary function' we have a webserver with database - web pages and email is ...
8
votes
7answers
1k views

Is this set-up PCI-Compliant?

Question: Is there a way to store credit card information on a shared hosting server AND be PCI compliant? Here is the setup: 1) SSL is being implemented for the whole checkout process and for the ...
4
votes
2answers
611 views

Is storing CVV compliant with PCI standards?

From personal, job-related experience I know that many "Booking Engines" store the CVV info for customers' credit cards from the time a reservation is made until the time the guest leaves the hotel. ...
2
votes
0answers
40 views

How can I determine whether or not a POS terminal violates requirements in the PCI DSS?

The business I work for uses an Equinox Optimum T4220 (hardware number 060001) in dial-out mode. I see two search results1 for "T4220" listed on the PCI SSC's website under Approved PIN Transaction ...
0
votes
1answer
75 views

IP whitelisting as two factor authentication method for server access under PCI DSS

In the answer to my question: Two factor authentication for web application under PCI DSS gowenfawr stated: I have seen other methods used for 2FA than those you mention; IP whitelisting and ...
0
votes
1answer
56 views

Two factor authentication for web application under PCI DSS

PCI DSS 8.2 is stated as follows 8.2 In addition to assigning a unique ID, ensure proper user-authentication management for non-consumer users and administrators on all system components by ...
2
votes
1answer
49 views

Google Analytics on Checkout

Are there any risks to using Google Analytics on my checkout page? The page is on SSL and I will obviously be serving the analytics script from their secured URL. Thanks.
0
votes
1answer
31 views

Can we share a folder across regions for PCI Users

We need to be PCI compliant for a small setup. We need to share a folder which should be accessible by other regions as well. We have Private MPLS Connection. PCI users will be having only READ ...
3
votes
2answers
299 views

Verifying credit card ownership

When a fraudulent credit card CNP (Card Not Present) transaction is made, merchant is liable for the chargeback. For that reason, our company implemented a policy where we ask a photo of customer's ...
2
votes
2answers
2k views

Credit card storage, hashes, truncation, encrypted data

I'm trying to figure out a way to meet multiple business requirements that don't seem to go well in hand in terms of security: store encrypted card data associated with customer accounts for ...
0
votes
2answers
111 views

Can Amazon's AWS Identity and Access Management (IAM) be used to manage server access?

Requirement 8.1.1 of PCI DSS states: Assign all users a unique ID before allowing them to access system components or cardholder data. Using Amazon IAM I can set up individual accounts for users ...
5
votes
1answer
648 views

How can Stripe be PCI-compliant?

According to the Stripe FAQ, they are PCI-compliant. Also, in their API documentation, one of the parameters to create a new card is the CVC (although, granted, it is optional). So, I assume they ...
2
votes
1answer
63 views

For PCI compliance, does every request need to be logged regardless of how it affects system performance?

Our cloud based service is currently undergoing changes with a view towards PCI compliance. It is a high throughput service, and there are concerns that enabling the right amount of logging on our ...
-1
votes
1answer
76 views

iFrame or Tokenization for Credit card transactions [closed]

My company is currently processing less than 4000 Credit Card transactions a year and we are a level 4 organization. I see that we are storing the credit card data in one of our databases but the PAN ...
0
votes
3answers
894 views

Is it PCI compliant to send credit card details to the server without saving them there?

Considering I use SSL the whole process. I have an IOS client that I want to use to enter the user's credit card details. I want to do the whole charging and processing on the server side, so I send ...
1
vote
2answers
153 views

Does sending credit card info over email violates PCI DSS?

Being in the US, I have noticed that more and more companies ask to send sensitive credit card information (all information that is required to make a transaction) over a plain email. I believe that ...
0
votes
1answer
56 views

PCI Compliant Secure Vault Design and Implementation

I often see the phrase “Secure Vault” in PCI DSS documentations and I want to know if a “Secure Vault” must be a highly protected file with sophisticated technologies stored on a very secure hardware ...
1
vote
1answer
106 views

PCI DSS - Recorded Phone Conversations

I am using the using the following image from FishNet Security as a sort of guide for the data flow diagram required by PCI DSS as defined by: 1.1.3 Current diagram that shows all cardholder ...
4
votes
2answers
131 views

PCI service provider and separation

This is connection to my previous question: Shared Database and PCI Compliance However, this question relates to the requirement "Appendix A: Additional PCI DSS Requirements for Shared Hosting ...