An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

learn more… | top users | synonyms

5
votes
2answers
640 views

Dual control / key encrypting key required?

I'm trying to get my head around 3.6.3 and 3.6.2 in the PCI-DSS standard, secure cryptographic key storage and distribution. Would having two 256 bit key halves stored in separate, isolated ...
5
votes
1answer
368 views

PCI-DSS Scope with tokenisation

My organisation is now using tokenisation and we are no longer storing any credit card information. I now think I may no longer need some of the following controls:- (there may be others although ...
5
votes
1answer
234 views

Open ID, Storing card details, and PCI compliance

If you store payment card details for a user, and you have a 'Login via openID' which includes services like Google and Facebook, is this allowed under PCI Compliance? Or do you need your own distinct ...
4
votes
2answers
1k views

Storing account numbers and sort codes online

There are a lot of questions on storing credit card information, and of how PCI SSC/PA-DSS regulations apply to such activities and systems. I have read a lot of these, but my question relates to a ...
4
votes
1answer
309 views

Conceptual design of vulnerability scanning program in global retail network (PCI DSS)

I am trying to design yearly program to scan for vulnerabilities on a very large network of payment terminals. The company has thousands of retail points all around the world which need to be ...
4
votes
3answers
4k views

Groupon SG is Storing Customers' Credit Card Information

Today I was purchasing a gift from Singapore Groupon website. And then I realized that what I have to do is simply login and hit the "submit order" button, because they store my credit card ...
4
votes
2answers
466 views

How to pass PCI DSS 2.0 anti-virus requirement (5.1) on Linux?

PCI DSS 2.0 Requirement 5.1 states: 5.1 Deploy anti-virus software on all systems commonly affected by malicious software (particularly personal computers and servers). This requirement ...
4
votes
1answer
477 views

Nessus HTML5 version 5.0.3 - PCI Scan

I've been searching for a couple days, even contacting support, to find out if Nessus has a bundle that scans for PCI compliance. It selects all 44 categories and regardless of what kind of scan I ...
4
votes
2answers
332 views

Is PCI DSS applicable to other solutions than those dealing with payment cards?

According to this quote from "applicability" section of PCI DSS it's not: The primary account number is the defining factor in the applicability of PCI DSS requirements. PCI DSS requirements ...
4
votes
2answers
63 views

SAQ A-EP Requirements for VPS Hosting

We are hosting a site on a self-managed Digital Ocean VPS ("Droplet") that will be taking payments via Stripe using their stripe.js API. According to PCI, we have determined that we fall under the SAQ ...
4
votes
2answers
92 views

Are invalid card numbers under PCI compliance

If a merchant sends an invalid card number to the bank, will the bank have to secure the information to be PCI compliant?
4
votes
2answers
172 views

Incident Reporting or Notification Policy domain?

I'm writing a company policy on how employees should handle reports of information security related events and notifications that come from vendors, customers, and from people within our organization. ...
4
votes
2answers
193 views

Perl CPAN modules in a PCI-DSS environment

We are currently working on implementing the PCI-DSS ruleset in our IT environment, where all of the inhouse software we use is Perl. We have a Perl dev team of about 10 people (inlcuding me) and ...
4
votes
1answer
194 views

Key Management for PCI and Payment automation

We're a bootstrapped startup looking to achieve PCI compliance, we've almost nailed all requirements but I recently came across this blog post which totally derails our plans and efforts : ...
4
votes
2answers
169 views

If I storing my own cards in a database. Does this fall under PCI compliance framework?

We want to store some cardholders data in our database. The card we want to store are all connected to our own company account. Does this fall under the PCI framework? For example do I have to comply ...
4
votes
3answers
2k views

PCI-DSS compliance for business with only swipe terminals

I support the IT infrastructure for a small retail business which is now required to undergo a PCI-DSS assessment. The payment service and terminal provider (Streamline) has asked that we use ...
4
votes
3answers
2k views

How can I report PCI-DSS violations?

A large supermarket chain in the UK, are storing their passwords in plaintext. Apparently, Mastercard's security department are already involved. I'd like to report them for violating PCI-DSS, since ...
4
votes
1answer
568 views

Help understanding PCI-DSS when using password based encryption from automatically generated keys

I've inherited the task of self-auditing an e-commerce system for compliance with the PCI-DSS. We are storing the PAN in our database in encrypted form using 256 bit AES algorithm to do the ...
4
votes
1answer
250 views

Using EventStore For PCI Compliance?

I have been hearing a lot of good things about EventStore 3 and am looking to upgrade my server event forwarding systems for PCI compliance next year and was wondering if anyone had looked at the ...
4
votes
1answer
2k views

Credit card data security - hashing, truncation and encryption

A question with a similar title has been asked before, but it doesn't answer my specific question here. PCI DSS permits storage of truncated and encrypted data, or hashed and encrypted data. It ...
4
votes
1answer
495 views

PCI-DSS Compliance Management Software?

Does anyone know of PCI compliance management software (specifically PA-DSS, but I'm assuming any kind of PCI-DSS software will do PA-DSS)? Mainly for our application end. We have a 3rd party site but ...
4
votes
1answer
189 views

Store To Store communication through MPLS VPN

In a PCI environment with an MPLS VPN network setup should you allow store to store communication? Do you think that an MPLS network would be consider secure enough for this? why or why not?
3
votes
3answers
559 views

What are the security implications of a device like Coin?

Coin is a new device aimed at replacing up to 8 credit cards in your wallet with a single device. It apparently works by scanning the credit card data into a mobile application that syncs with the ...
3
votes
2answers
998 views

Payment gateway integration, any security considerations?

I'm interested in understanding what security considerations there are around implementing a payment gateway. I have, so far, thought of: having a SSL Cert is a MUST. logging actions is critical. ...
3
votes
4answers
185 views

Risk management with software code analysis

I am a programmer by day and I am working on a project that is focused around risk management based on PCI-DSS controls within an organisation. I have been thinking lately that a lot of PCI-DSS ...
3
votes
3answers
5k views

BEAST: IIS6: Failing PCI scan - are these ciphers OK?

Our PCI compliance scanner, TrustWave, have failed our Win 2003/IIS6 site on BEAST because of the following cyphers: Cipher Suite: SSLv3 : DES-CBC3-SHA Cipher Suite: SSLv3 : RC4-SHA Cipher Suite: ...
3
votes
3answers
270 views

Where's the security when a payment gateway let website handle Credit Card detail

Has anyone worked with eWay payment gateway before? Basically, there's a service endpoint where you post the customer's detail and credit card details from the web application after the browser sends ...
3
votes
2answers
618 views

Can we print cardholder data under the PCI DSS Compliance framework and stay compliant?

I have a question regarding PCI compliance. There seems to be a valid business need in our company to keep some card holder data, for unsuccessful transaction. An example would be a customer makes a ...
3
votes
5answers
373 views

PCI-DSS and salt storage

PCI-DSS states the following: 3.5 Protect any keys used to secure cardholder data against disclosure and misuse I have a service which stores a salted bcrypt hash of the user's PAN. Assuming the ...
3
votes
2answers
674 views

Secure Mobile Payments using HTTPS Web App

I'm hoping an expert with PCI compliance knowledge can help answer this question. We're looking at integrating mobile payments with our application which is HTML5-based for cross-platform reasons. ...
3
votes
1answer
4k views

SSL certificate fails to adhere to basic constraints and PCI compliance

We have an SSL cert from GoDaddy and tried to run a PCI compliance check using McAfee's scan. The one problem they found was that the basic constraints / path length is not configured. Here's what ...
3
votes
1answer
424 views

Is there a way to process a credit card transaction asychronously and be PCI compliant?

If I had to store credit card details temporarily to shove it to the processor using an asychronous worker, I know that that information must be encrypted. To get it to the worker, however, it must ...
3
votes
1answer
276 views

PCI compliance simple questions

For now I read PCI compliance document and I don't understand any things. I have a program, which takes sensitive and cardholder data as input (some of them are in encrypted form) and then returned ...
3
votes
1answer
252 views

Do I need to purchase a PCI DSS certificate?

I'm creating an e-commerce website and I was wondering, do I need to purchase a PCI DSS certificate or do I just need to comply with the standards?
3
votes
1answer
342 views

Hybrid key management doing it wrong?

I'm currently working on a project that needs be as secure as possible key-management. My experience with encryption, decryption and key-management are none whatsoever so i did some research on the ...
3
votes
1answer
296 views

POS still PCI compliant after Single Sign-on?

I have a Point of Sale System that's a web application. I also have a separate reporting system that's a web application and a separate inventory system that's a web application. It's necessary to use ...
3
votes
1answer
176 views

Is it safe to save customer information from Stripe? Do we need to be PCI compliant?

Following their tutorial, Stripe allows to save customer and charge them later. But, does one have to be PCI compliant? In their API Reference, it seems they give lot of information to be stored ...
3
votes
2answers
409 views

Does PCI ban using MD5 to store sensitive data?

Just had a vendor tell me that because their PCI auditors did not recommend banning the use of unsalted MD5 to store sensitive data at this time with with their current level of PCI compliance that ...
3
votes
1answer
3k views

Is using RC4-MD5/RC4-SHA as SSL ciphers enough for most purpose?

In the AWS ELB, I have uploaded a cert and only selected "RC4-MD5" + "RC4-SHA" as the ciphers and scored A in the ssltest [1] If I using the default ELB setting, I can only score a C Since I am not ...
3
votes
2answers
389 views

What should I have prepared for a PCI compliance onsite assessment?

The company I'm working for is about the undergo PCI compliance onsite assessment. The PCI DSS has a kind of checklist, but it is all very vague and abstract to me. So I'm not quite sure what I need ...
3
votes
2answers
1k views

How to satisfy requirement 10.6 of PCI DSS?

The company I'm working for is applying for PCI compliance and I'm in charge of writing most of the required procedures and policies. The problem is that I don't have any experience with IT security, ...
3
votes
2answers
237 views

CVE-2012-4448 pci-scan

I'm currently failing a PCI scan due to CVE-2012-4448 The recommended resolution from Security Metrics is to upgrade to a wordpress version higher than 3.4.2, however currently that is the highest ...
3
votes
3answers
119 views

If I host a web form which submits CC details to a provider, are there PCI implications form host?

I'm wondering if anyone has any thoughts on a specific question I have. I read a lot about systems that 'store, process, submit' CC data requiring compliance. If I host a form on my website which ...
3
votes
1answer
248 views

Payment security on Android App

I am developing an application from which users browse and buy books. The client can be Android ,iOS, Mac. The server is ASP.net Web APIs. I know there are many payment services available. One of ...
3
votes
3answers
2k views

Effective wireless scanning to meet PCI DSS 11.1?

PCI-DSS section 11.2 requires the business to "Test for the presence of wireless access points and detect unauthorized wireless access points". However, this is more easily said than done. Simply ...
3
votes
1answer
283 views

PCI Compliance guidance

I am in the middle of setting up an ecommerce solution on a commercial website. My system will store card number in the form of : xxxx-xxxx-xxxx-4000 (just the last 4 digits) and XXX (nothing) for the ...
3
votes
3answers
905 views

Any place where I can find some template or base documents for IT/Infosec Compliance?

We're facing an audit and we are sorely lacking in documentation regarding information security policies. I've done some Googling and have been surprised by the difficulty of finding a good "template" ...
3
votes
3answers
175 views

What is the job of an IT auditor?

I am going through training in information security, as a part of the course they included compliance standards like: PCI DSS ISO 27001-2005 Cobit framework So after searching over Google, I came ...
3
votes
2answers
236 views

How can I report an ecommerce site in violation of security practices?

I ordered a product from a website and found that their invoice display page is completely un-protected with the order id in the query string and merely incrementing the number exposes every order. ...
3
votes
2answers
813 views

The point of PCI 1.3.1 through 1.3.3

In expansion to my previous question what qualifies as public access? I'm trying to wrap my head around the intent of the points 1.3.1 and 1.3.2 and 1.3.3 of the PCI standard. I have four DMZs at my ...