An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

learn more… | top users | synonyms

1
vote
1answer
83 views

PCI Penetration Testing - Does the whole infrastructure need to be retested on significant change?

The PCI SCC states the following in their penetration testing guidance: Per PCI DSS Requirements 11.3.1 and 11.3.2, penetration testing must be performed at least annually and after any ...
1
vote
2answers
51 views

Access Controls on employees handling credit card data

Employee has access to image format of full credit card data on an application (primary account number, cvv, expiry code, name). He copies from this application and enters manually to another ...
4
votes
1answer
171 views

Banks storing credit card data in plain text?

Are the banks authorized to keep plain text hard copies of full credit card data (Primary account number, CVV, Expiry code, Cardholder name)
1
vote
2answers
137 views

Credit card data sent as a plain image format [closed]

The full Account number data plus Personally Identifiable Information (PII) for a credit card is captured in a document that is scanned as an image for later processing. This image is then uploaded ...
3
votes
2answers
231 views

Firewall UDP Packet Source Port 53 Ruleset Bypass

I have a question regarding recent PCI DSS scan performed on our network. On some of the Windows 2008 servers (physical and VM), there is a risk found "Firewall UDP Packet Source Port 53 Ruleset ...
3
votes
2answers
544 views

Clarification of PCI DSS 3.1 requirement 6+8

I'm quite puzzled about the PCI requirements when it comes to session timeouts and scope definitions. The login is the end user/customer login to the public facing control panel in which they can ...
1
vote
1answer
108 views

Do I need PCI DSS compliance when using PayPal Express Checkout?

If I'm using PayPal Express Checkout on my website, am I required to be PCI DSS compliant? PayPal says "With Website Payments Standard, Online Invoicing, Express Checkout and Website Payments Pro ...
4
votes
1answer
54 views

ASV scan with reverse proxy

We are PCI compliant as a service provider, however our service port forwards some web traffic at TCP level. Customers use our PCI compliant service and can choose to upload a TLS/SSL certificate to ...
2
votes
2answers
83 views

How do I prevent extra javascript from being added into HTML kiosk in public space?

I'm planning a project which is to be PCI compliant, but I am stuck on a particular vulnerability and I can't think of a way to protect against it. The scenario is that there is a kiosk installed in ...
3
votes
2answers
167 views

How to not store the card during 3D Secure authentication, to be PCI DSS compliant?

I'm implementing a payment solution where the cardholder enters his card details on our own website. We need to use 3D Secure for extra authentication of the cardholder. Our payment gateway ...
7
votes
3answers
7k views

Should I disable TLS 1.0 on my servers?

The PCI Data Security Standard 3.1 recommends disabling "early TLS" along with SSL: SSL and early TLS are not considered strong cryptography and cannot be used as a security control after June 30, ...
1
vote
1answer
52 views

Strong Cryptography in PCI PA-DSS

In PCI PA DSS document, the phrase “Strong Cryptography” is often repeated but I couldn’t find a clear definition for that. Is there any document or PCI standard for that?
1
vote
1answer
39 views

What PCI standard(s) a payment app (for Smartphones) should comply with in order to be approved by PCI SSC?

We are a company developing apps for Payment Service Provider(s) and in one of our apps Card Holders should enter payment Card data (such as PAN, PIN 2, CVV, Expiration Date) to do a CNP (Card Not ...
3
votes
1answer
59 views

Which SAQ form do I use for PCI DSS compliance?

I run a small business with a Prestashop e-commerce website that sends customers to Sagepay to make a payment using the Presto Chango Sagepay payment module. In my office I also have a one PC ...
1
vote
1answer
28 views

How to include third parties in PCI DSS SAQ

When filling in the SAQ for PCI compliance, how do you include requirements covered by a third party provider? Say you're using a PCI compliant VPS provider for example. Do you select 'yes' then ...
2
votes
1answer
235 views

Using a CDN to reduce PCI DSS scope

A common scenario for e-commerce credit card types of transactions is a website with a connection to a third party payment processor. For a number of reasons you might not want to use an iFrame or ...
1
vote
2answers
352 views

Validating security log configuration (rsyslog and syslog-ng) for PCI DSS 10.5

I work for a Level 1 merchant with annual onsite QSA audits, so this is a huge deal. PCI DSS 10.5 requires the entity under test to "Secure audit trails so they cannot be altered". In our Unix and ...
2
votes
2answers
109 views

PCI audits, TLS 1.0, and scoring

I'm new to security in a variety of ways. We have a PCI audit coming up soon. We've put together a risk mitigation/migration plan for TLS 1.0 and have submitted it to the auditors. My boss is ...
2
votes
2answers
75 views

PCI DSS 3.1 and Windows XP

I'm looking for some clarification on the effects of PCI DSS v3.1. In an consumer ecommerce context (e.g amazon.com), I'm assuming that customers attempting to make credit card purchases on the site,...
2
votes
2answers
31 views

What constitutes submitting payment at a different address for PCI-DSS?

I am attempting to use TransArmor PCI Rapid Comply to verify compliance for my small business. At one point, I have two choices: 1) Customers submit payments at a different web address (i.e. ...
1
vote
2answers
50 views

Is it PCI-compliant/kosher to send a credit card number to a 3rd party sever from a mobile client?

I am building a mobile app, and part of the the functionality of the app is to place an order with a 3rd party. The 3rd party server accepts a credit card number string. Can I build a mobile client to ...
4
votes
3answers
564 views

Storing credit card information for later manual processing

I am rebuilding a clients eCommerce site using Wordpress and WooCommerce as the framework. Their current eCommerce site takes the credit card information and stores it for later manual processing. To "...
0
votes
1answer
266 views

PCI Logging Data Elements for Network Devices, Databases and Wireless Networking

What is the best way to figure out what exactly needs to be logged for Network Devices, Databases and Wireless Networking Devices? I'm not an expert in this area but I need to figure out what data ...
3
votes
3answers
372 views

Third party analytics/tracking javascript tags and PCI DSS

Although variants of this question have been asked before, they seem to be about general risk, and I'm interested in the PCI DSS connotations. If an e-commerce site is looking for level 1 or level 2 ...
3
votes
1answer
130 views

Is it ok from the viewpoint of PCI DSS to send credit card info to my own server which then directly sends it to PayPal?

Currently I'm developing an iOS application which has an option to pay an order (clothes cleaning) via scanning credit card info using device camera. I can't use Apple In-App Purchases (IAP) for this, ...
3
votes
3answers
213 views

PCI scanning and penetration testing

We are moving a web app from an internal merchant hosted setup to a general service we can offer to other organisations. The actual credit card data handling is done by a level 1 PCI compliant third ...
3
votes
2answers
118 views

Why are there questions about “media” in a PCI-DSS SAQ A?

The PCI-DSS SAQ A is used in the case where all payments are outsourced to an external vendor (conditions apply). Despite that, section 9 of the questionnaire is about "media" (if they are physically ...
3
votes
1answer
213 views

Using Google Cloud Platform to store credit card data

I have made an iPhone app for users to book hotel rooms. A third party provides the service for booking the hotel rooms and charging the credit cards. At the moment, my app makes no attempt to save ...
4
votes
2answers
90 views

Steps to Become PCI Compliant?

I have a small business, and I'm in the process of building a new website. My card processing company says I need to be PCI compliant. I know I did this once before years ago and had the Compliance ...
5
votes
3answers
189 views

My client needs credit card details emailed to them, will an encrypted file work?

I have a new client who is a reseller for vacation packages. They have multiple wholesalers, and my client is instructed by the wholesalers to sign into their wholesale account, and enter their ...
2
votes
1answer
103 views

What is “cardholder data” in PCI-DSS SAQ A context?

The PCI-DSS SAQ-A questionnaire mentions on page iii that SAQ A merchants confirm that, for this payment channel: (...) Your company retains only paper reports or receipts with ...
2
votes
4answers
91 views

PCI-DSS 3 SAQ - uncertain of level

We are having a debate internally about which SAQ we need to fill in for PCI - our QSA questionnaire says D (and I tend to agree) but company director says SAQ C from reading the guidelines. The way ...
3
votes
3answers
324 views

Credit card processing in mobile app over Stripe - PCI DSS compiant?

after reading a lot of PCI DSS stuff I'm still not sure whether it would be ok for us to use the following process in our app: Get full credit card data from attached card reader Tokenize it using ...
0
votes
1answer
56 views

PCI SAQ C 1.2.1, 1.3.5 and remote server/software

I'm hoping someone here can help me. I'm attempting to get the small nonprofit I work at PCI compliant, as we have been paying an additional $20/month in noncompliance fees to our processor since we ...
0
votes
1answer
3k views

PCI DSS v3.1: clarification about usage of TLS v1.1

PCI DSS v3.1 recommends usage of TLS v1.1 or greater: https://www.pcisecuritystandards.org/documents/Migrating_from_SSL_Early_TLS_Information%20Supplement_v1.pdf … it is therefore strongly ...
2
votes
2answers
522 views

Best way to scan for and eliminate earlier versions of SSL/TLS in a production environment

Due to new PCI DSS standards mandating that nothing lower than TLS 1.2 be used in a PCI environment, I am tasked with phasing out anything lower than TLS 1.2 on every device in this environment by our ...
3
votes
1answer
210 views

PCI Compliance SAQ-A-EP or SAQ D

Our eCommerce wesbite attracts less than 5000 CC transactions each year and we do no store any CC information in our backend or systems but transmit them to our third party provider. We also use a ...
0
votes
2answers
107 views

What is the PCI requirement for tracking software installation on workstations?

We have a task open right now to implement UAC and matching event log tracking for our devs installing software on their machines. I've been asked whether storing/parsing these logs centrally is a ...
0
votes
1answer
360 views

PCI requirement 8.3 - 2FA for all network access originating outside the network

Requirement 8.3: Incorporate two-factor authentication for remote network access originating from outside the network by personnel (including users and administrators) and all third parties, (...
5
votes
3answers
1k views

PCI DSS - VPN network?

My network is segmented into internal (which holds private cardholder data), DMZ and VPN. There is a gateway in between which restricts access, for example: VPN: 10.0.0.0/24 DMZ: 10.1.0.0/24 INT: 10....
5
votes
2answers
330 views

Source code scanning - PCI Requirement - Service Provider

I've been doing a lot of research regarding the requirements for source code scanning but haven't found anything conclusive when it comes to my question below. So I need some guidance from PCI Experts ...
5
votes
1answer
171 views

PCI 3.1 - SAQ D - Supporting Servers

For the past year and a half now, I've been working as the sole individual at a small retail hardware store trying to attain proper (read: not checkbox) compliance, and I am beginning to enter the ...
3
votes
1answer
96 views

PCI DSS 3.0: 11.3 - What happens if a low risk vulnerability prevents compliance with another requirement?

As I understand the PCI DSS 3.0/3.1 penetration testing requirements, a company is compliant with 11.3 if the penetration test does not return any high risk vulnerabilities. However, what happens if ...
5
votes
1answer
191 views

Distributed tokenization for credit card numbers

I have two locations within the same firm that hold credit card numbers. I want to be able to "join" on credit card number to do business analytics after transmitting card number-linked data from one ...
2
votes
5answers
180 views

PCI Compliance and fines

Our organisation has validated compliance with PCI DSS. What are the consequences to us if we had been breached by a security incident related to credit card information, considering we have validated ...
4
votes
3answers
209 views

Tools to demonstrate NO storage of cardholder data

Our organization has been asked to comply with PCI DSS. As part of IT Department, we need to demonstrate that none of our IT infrastructure stores any carhdolder data nor sensitive authetication data....
1
vote
1answer
122 views

Can Windows 8 be PCI compliant?

I am in the process of getting PCI. I am in the last step in which I would need a secure PC on my internal network. All the scans I must run are only available through a plugin in browsers for Windows ...
1
vote
1answer
55 views

Card Present PCI Requirements

We are using an IDTECH card reader for iPhone that is not encrypted, our application is web based and runs inside of an iOS app to pull the data off the card. We are then using a client side ...
1
vote
3answers
215 views

Do I need an ASV to come out when going for an SAQ?

Our company is going for a SAQ, under PCI DSS 3.1. Do we need to pay a vendor to come out and do an on site scan, or can we use something like Nessus to do the scan on our own?
6
votes
5answers
204 views

Can I show Credit Card Data to final customers and be PCI Compliant?

I work with reservation management syatems. In the hospitality industry there is the concept of credit card as guarantee. By it when making any kind of reservation you are asked for your credit card ...