An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

learn more… | top users | synonyms

0
votes
2answers
96 views

Security Modules - Hardware vs. Software

In terms of PCI requirements and compliance, is a software-based key management module like Gazzang zTrustee an acceptable solution to the PCI requirements that a (hardware) HSM solution like AWS ...
1
vote
1answer
107 views

Can I show PCI compliant Logo

I have just now got 20 of my e-commerce websites scanned and certified by Comodo. I will be submitting them to my banks as well to prove that I am PCI compliant. But is there any regulation on who ...
2
votes
2answers
79 views

Internal Update Server in PCI environment

I am curious to know if we require separate update server in our cloud based PCI environment. In our current setup webserver, appserver, dbserver, logserver, and jump server are independent instance. ...
2
votes
1answer
261 views

Field-level encryption vs disk encryption for PCI compliance

We are in the process of setting up a PCI compliant server (with Firehost's help). We are using MongoDB as our primary database. I am having some concerns about the encryption, though. Are there any ...
0
votes
1answer
61 views

Multiple websites hosted on same server

We have two severs sitting under one load balancer. We run PCI scans on those two servers. Now, when we started, we only had 2 websites running from these two server. But the business is growing ...
0
votes
1answer
81 views

PCI-DSS Requirement for Application Level Security?

Before I arrived at my current company we obtained the services of PCI consultant who gave us some very specific, if questionable, advice on encryption requirements. The particular piece of advice I ...
2
votes
2answers
163 views

Is PCI Compliance mandatory?

I recently started working on an eCommerce addition to a site I'm working on.In my research looking for a way to do SSL without a certificate/a free certificate I came across PCI Compliance.I have ...
1
vote
1answer
65 views

PCI compliance over two domains

We have an eCommerce website hosted on a dedicated server. We get our PCI compliance report from Qualays and there is no problem with that. However, now we want to test something new on Amazon's AWS ...
0
votes
1answer
197 views

Hashing PAN numbers

According to this blog PAN number should be hashed using a "secret salt". What they are doing is basically H(Message+salt). The reason you need this "secret salt" is because PAN numbers are limited to ...
1
vote
2answers
99 views

PCI Definition of “Transmission”

I am working at a company that is PCI compliant, but I believe they have interpreted some of the requirements incorrectly. Because of this, they are laboring to create work-arounds which I suspect are ...
4
votes
2answers
114 views

Are invalid card numbers under PCI compliance

If a merchant sends an invalid card number to the bank, will the bank have to secure the information to be PCI compliant?
7
votes
2answers
294 views

Unsolicited credit card in email?

I work for an insurance company who will randomly (3-5 times per year) have a consumer who emails their credit card to our customer service department. We don't ask for the number, they just send it ...
1
vote
0answers
92 views

Test S/KEY support for PCI compliance - CVE-2007-2243

In order for our business to be PCI compliant, we need to prove that we are not vulnerable to CVE-2007-2243. This states that: OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is ...
1
vote
2answers
389 views

Internal / external Penetration testing a webserver - PCI

the PCI DSS document states: 11.3.2 Perform internal penetration testing at least annually and after any significant infrastructure or application upgrade or modification (such as an operating ...
1
vote
1answer
1k views

Which is the Best Cipher Mode and Padding Mode for AES Encryption? [closed]

As per PCI-DSS 3.4 requirement: For storing Credit Card Data Strong Cryptography should be used. I decided to use AES Encryption which is a strong and mostly recommended crypto for encrypting ...
1
vote
0answers
25 views

How to store Initialization Vector securely for AES Encryption? [duplicate]

I'm using AES Encryption for encrypting credit card details and so I will store my DEK in Ecnrypted form and do we need to encrypt the Initialization vector for storage?
8
votes
1answer
296 views

What is the difference between HSM and Key server?

As per PCI-DSS requirements, we have to use either HSM (Hardware Security Module), or Key Server to store the KEK (Key Encryption Key). If I'm storing encrypted DEK (Data Encryption Key) in an App ...
5
votes
1answer
279 views

What does the PCI-DSS statement “Store separately from the data encrypting key” mean?

As per the PCI-DSS 3.5.2 requirement Encrypted with a key-encrypting key that is at least as strong as the data-encrypting key, and that is stored separately from the data encrypting key. Does this ...
3
votes
1answer
585 views

How to decrypt the Encrypted DEK using KEK which are separated in servers?

Decrypting the DEK using KEK under PCI-Standards, which are separated by Servers: Let say for example we have server1 and server2 Server1: It is in East US, called it as Application Server. ...
3
votes
1answer
257 views

Is it safe to save customer information from Stripe? Do we need to be PCI compliant?

Following their tutorial, Stripe allows to save customer and charge them later. But, does one have to be PCI compliant? In their API Reference, it seems they give lot of information to be stored ...
0
votes
1answer
152 views

What is the diffference between HSM and PTS-approved point-of-interaction device?

According to PCI-DSS requirement 3.5.2: We should store secret keys in a cryptographic device. Cryptographic devices: 1.HSM 2.PTS-approved point of interaction device My questions: I have some ...
0
votes
2answers
363 views

How to implement PCI DSS requirement 3.5.2?

According to PCI-DSS requirement 3.5.2: Secret and private keys used to encrypt /decrypt cardholder data should be stored in one of the following forms at all times: Encrypted with a key-encrypting ...
3
votes
4answers
211 views

Risk management with software code analysis

I am a programmer by day and I am working on a project that is focused around risk management based on PCI-DSS controls within an organisation. I have been thinking lately that a lot of PCI-DSS ...
3
votes
2answers
83 views

Legacy system PCI Compliance

I have a legacy system that collects and stores credit card numbers ( BAD! ). We are in the process of replacing that system in phases. We are going to integrate with a credit card processing system ...
0
votes
1answer
220 views

What is an offsite facility as per PCI DSS requirement 9.5.1?

PCI DSS Version 3.0, Requirement 9.5.1 says that we have to store media backups in a secure location, preferably an off-site facility such as an alternative or backup site or a commercial storage ...
1
vote
2answers
430 views

PCI DSS - only one primary function per server

The PCI DSS says that a server can have only one primary function and i'm a little confused over what it means by 'one primary function' we have a webserver with database - web pages and email is ...
0
votes
2answers
576 views

Is it PCI compliant to send credit card details to the server without saving them there?

Considering I use SSL the whole process. I have an IOS client that I want to use to enter the user's credit card details. I want to do the whole charging and processing on the server side, so I send ...
1
vote
2answers
194 views

Does server RAM count as storage for PCI Compliance?

We are an eCommerce website. I'm working on our PCI compliance at the moment, and I'm trying, if at all possible, to argue that our organisation falls under SAQ A rather than D. We do not sensitive ...
1
vote
1answer
136 views

PCI DSS compliance for storing PAN and PII in multi-tenant environment

I wanted to know if I can still be PCI compliant if I store card holder and PII information for multiple tenants in the same database? I.e., have an identifier on the table level to identify the ...
1
vote
1answer
504 views

How to process or manage Key-Encryption-Key using HSM?

Let's consider two Encryption keys: 1.Data-Encryption-Key(DEK) 2.Key-Encryption-Key(KEK) KEK will be securely stored in HSM, which will be encrypted using master key. Data Encryption Key will be ...
1
vote
1answer
3k views

How to Encrypt Credit Card number for storing it in sql server database according to PCI DSS Requirement?

According to PCI-DSS 3.4 Requirement: Render PAN unreadable anywhere it is stored by using the below methods: One-way hash Truncation Index tokens and pads Strong cryptography with associated ...
1
vote
1answer
142 views

Which is best DPAPI or HSM?

Can you please explain what's is the main difference between for this both DPAPI and HSM? As far as I understand both protecting the data, the way of protection is difference HSM is physical device ...
2
votes
1answer
131 views

After the Cryptoperiod timespan, do we need to encrypt all the data again?

As per PCI-DSS we need to dispose the old keys after the timespan. After the cryptoperiod (lets say one year) time span, do I need to encrypt all (20k card holders) the data once again with the newly ...
0
votes
1answer
176 views

LDAP and anonymous bind for PCI compliance

We have to setup a central auth for PCI compliance and I'm wondering if it's ok to allow anonymous bind or should I create a user to do the bind for the services needing ldap?
0
votes
1answer
237 views

When does a PA-DSS certified application expire?

When you search the PCI website for validated payment applications it shows a re-validation date and an expiry date. There is also two categories of payment applications, "Acceptable for new ...
0
votes
2answers
493 views

PCI DSS 2.0 and ssh keys

I know the real answer to the auditor. We are a smaller company under 40 total employees that is also PCI level 1 compliant. We've always used ssh keys on internal servers. You can't ssh in from the ...
3
votes
2answers
97 views

How much security information to publicise?

Apologies if this in the wrong section, not sure if it should go in Server Fault or not. I am preparing to launch a new web app. We have put a lot of effort into offering good security. From a PR ...
-1
votes
1answer
202 views

DSA Generates different signatures with the same data [closed]

I'm using the example given in msdn article about the DSACryptoServiceProvider Class. The problem is that I get a different signature each time I run the code. I tried OpenSSL and didn't get this ...
0
votes
2answers
502 views

Encryption of PCI data, and PCI-DSS scoping

I read another question which made me think... If you encrypt PCI data (credit card numbers, etc.) using PGP or AES and send it through a firewall, is that firewall in scope? Alternatively, what ...
2
votes
2answers
116 views

PCI-DSS Is the infrastructure really in-scope?

Say I have an application that takes credit cards, but this is actually a payment gateway on the internet that I don't control. The web site used HTTPS and only returns if the card was authorized or ...
2
votes
2answers
1k views

What level of PCI Compliance do I need to adhere to if I do not store, but transmit data?

I'm doing a bit of research on my level of PCI compliance, and I'm having a difficult time grasping where I'm supposed to be. I have a web service that has recurring billing. The site is created ...
1
vote
2answers
247 views

PCI Compliance Distibution

I run a small e-commerce website hosted on a dedicated server with Debian 6 Squeeze. I need to become PCI compliant (the card industry standard for security). Therefore I have registered with ...
2
votes
3answers
109 views

Are there any reasons to be concerned about the security of “Coin”? [duplicate]

I just came across this: https://onlycoin.com/ A credit-card sized device that not only holds the info for as many credit and debit and membership cards as you want (they claim) but also can ...
3
votes
3answers
591 views

What are the security implications of a device like Coin?

Coin is a new device aimed at replacing up to 8 credit cards in your wallet with a single device. It apparently works by scanning the credit card data into a mobile application that syncs with the ...
1
vote
1answer
327 views

Does a PCI DSS category 2x device require the same physical security as a 1a/b?

I am trying to further understand the scope of my environment. I have a group of category 2x devices that are used to manage a category 1b device through a category 2a device. I understand my group ...
1
vote
2answers
207 views

PCI-DSS - key-based shell access to internal servers?

In the following PCI 2.0 requirement, I am not sure how to interpret computer access to internal machines (not remotely accessible): Requirement 8: Assign a unique ID to each person with computer ...
1
vote
3answers
126 views

Are there any security related rules in PCI-DSS that govern when I can capture a payment?

Is there a PCI-DSS rule that a merchant cannot capture the funds for an order until we have actually shipped it? I can't seem to find an official reference that describes this as a PCI DSS ...
1
vote
2answers
107 views

Antivirus / Wireless PCI v2 Controls Scope

Do the Antivirus / Wireless controls within PCI v2 apply for the entire organisation, or just for the PCI scope?
0
votes
1answer
495 views

Can someone please briefly explain HIPPA compliance?

I worked in web hosting for several years, particularly security. I am familiar with PCI compliance and I would say the "short and sweet" guide to PCI for an eCommerce store is as follows: Client ...
0
votes
2answers
531 views

Does using Bcrypt to encrypt credit card numbers satisfy PCI compliance?

I understand that using MD5 is not safe and is not PCI compliant. Does using BCrypt satisfy PCI compliance