An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

learn more… | top users | synonyms

6
votes
1answer
282 views

Open ID, Storing card details, and PCI compliance

If you store payment card details for a user, and you have a 'Login via openID' which includes services like Google and Facebook, is this allowed under PCI Compliance? Or do you need your own distinct ...
6
votes
2answers
1k views

Dual control / key encrypting key required?

I'm trying to get my head around 3.6.3 and 3.6.2 in the PCI-DSS standard, secure cryptographic key storage and distribution. Would having two 256 bit key halves stored in separate, isolated ...
5
votes
3answers
813 views

Cardholder data segmentation for PCI compliance (3.2)

We are currently collecting card holder data in a segmented way. Our system is used by call center agants which I will refer to as channel B Over channel A (mobile carrier) we collect the first 8 ...
5
votes
1answer
9k views

Which is the Best Cipher Mode and Padding Mode for AES Encryption? [closed]

As per PCI-DSS 3.4 requirement: For storing Credit Card Data Strong Cryptography should be used. I decided to use AES Encryption which is a strong and mostly recommended crypto for encrypting ...
5
votes
2answers
257 views

Are any and all software vendors who have stored credit card information in their databases subject to PCI-DSS or only some?

Is a commercial software vendor who sells software for use in the United States, subject to, or legally required to implement PCI-DSS if their software includes a feature which will allow the ...
5
votes
1answer
810 views

PCI - what qualifies as public access?

My development staff is in the process of automating our end of month process. There is a small manual step that needs to be executed. We have been thinking about the PCI ramifications for making ...
5
votes
3answers
334 views

Certifiable standards for server security, besides PCI-DSS?

The Payment Card Industry Data Security Standard is widely used in the financial industry and seems to be a useful requirement from the standpoint of a potential customer (see also Does PCI compliance ...
5
votes
2answers
491 views

Is PCI DSS applicable to other solutions than those dealing with payment cards?

According to this quote from "applicability" section of PCI DSS it's not: The primary account number is the defining factor in the applicability of PCI DSS requirements. PCI DSS requirements ...
5
votes
2answers
1k views

Retention periods for web logs

I work for an ASP that provides banking solutions Card Services Payments ACH Online Banking And others Back Story: Our company provides an "all in one" solution or parts thereof, we are ...
5
votes
3answers
941 views

Online Payment Gateway Requirements

I have been looking at an online payment gateway, authorize.net, and specifically their Direct Post Method. This method would allow me to create a form on my server, then submit the post parameters ...
5
votes
3answers
485 views

PCI compliance can prevent fines?

We're working really hard to achieve PCI compliance for a project and will likely be spending hundreds of dollars each month, but I was wondering what if, god forbid, something unlikely happens and ...
5
votes
3answers
757 views

PCI DSS - VPN network?

My network is segmented into internal (which holds private cardholder data), DMZ and VPN. There is a gateway in between which restricts access, for example: VPN: 10.0.0.0/24 DMZ: 10.1.0.0/24 INT: ...
5
votes
2answers
5k views

Is storing CVV compliant with PCI standards?

From personal, job-related experience I know that many "Booking Engines" store the CVV info for customers' credit cards from the time a reservation is made until the time the guest leaves the hotel. ...
5
votes
3answers
241 views

Cloud Based WAF

I'm currently evaluating different approaches to implement a web application firewall (WAF) in our architecture. We need the WAF due to PCI DSS. I would prefer using a cloud based WAF (e.g. ...
5
votes
1answer
1k views

How can Stripe be PCI-compliant?

According to the Stripe FAQ, they are PCI-compliant. Also, in their API documentation, one of the parameters to create a new card is the CVC (although, granted, it is optional). So, I assume they ...
5
votes
2answers
682 views

How to submit credit card info to a separate server/website (PCI)

My company has a website/service that stores/processes credit cards and is PCI compliant (Site A). We also have websites with storefronts that need to submit credit card data to that site for ...
5
votes
1answer
738 views

PCI Compliance and PayPal

First, please forgive my ignorance. Until this week, the only "credit card security" I understood was how to hack systems and why to write PHP pages with the types of features I do (msqli, pdo, ...
5
votes
2answers
287 views

Source code scanning - PCI Requirement - Service Provider

I've been doing a lot of research regarding the requirements for source code scanning but haven't found anything conclusive when it comes to my question below. So I need some guidance from PCI Experts ...
5
votes
2answers
424 views

Clarification on being PCI compliant

So let's say we have a production site that requires VPN access to the datacenter. We also have a dev/qa datacenter in a separate datacenter with it's own VPN connection. When we're sitting in the ...
5
votes
3answers
225 views

Determining PCI DSS SAQ level

I have a B2B SaaS that my clients then use with their own customers to gather data in a face-to-face scenario with iPads, I would like to expand it to take credit card details. The credit card details ...
5
votes
1answer
695 views

PCI-DSS Network Segmentation and encrypted administrative interfaces

I'm using the 3/2/1 network segmentation model from the open pci dss scoping toolkit and I'm running into a bit of a mental roadblock. I have a phone system (Mitel 5000 series, if it matters) that is ...
5
votes
1answer
548 views

PCI-DSS Scope with tokenisation

My organisation is now using tokenisation and we are no longer storing any credit card information. I now think I may no longer need some of the following controls:- (there may be others although ...
5
votes
1answer
315 views

Store To Store communication through MPLS VPN

In a PCI environment with an MPLS VPN network setup should you allow store to store communication? Do you think that an MPLS network would be consider secure enough for this? why or why not?
5
votes
1answer
160 views

PCI 3.1 - SAQ D - Supporting Servers

For the past year and a half now, I've been working as the sole individual at a small retail hardware store trying to attain proper (read: not checkbox) compliance, and I am beginning to enter the ...
5
votes
1answer
168 views

Distributed tokenization for credit card numbers

I have two locations within the same firm that hold credit card numbers. I want to be able to "join" on credit card number to do business analytics after transmitting card number-linked data from one ...
5
votes
1answer
1k views

Are Linux vendor-supplied security updates enough for PCI Compliance?

I have several systems that require PCI compliance, all of them are running CentOS 6.4 with all security updates applied daily. However, PCI compliance scanning will often reject detected versions of ...
5
votes
3answers
171 views

My client needs credit card details emailed to them, will an encrypted file work?

I have a new client who is a reseller for vacation packages. They have multiple wholesalers, and my client is instructed by the wholesalers to sign into their wholesale account, and enter their ...
4
votes
3answers
589 views

What type of PCI Compliance do I need if I don't hold any card data

I am working with a company that is "PCI Compliant" and in order for them to give me any of their data (customer name, email) they ask that I be "PCI Compliant" even though this data is not credit ...
4
votes
3answers
660 views

What are the security implications of a device like Coin?

Coin is a new device aimed at replacing up to 8 credit cards in your wallet with a single device. It apparently works by scanning the credit card data into a mobile application that syncs with the ...
4
votes
3answers
3k views

Should I disable TLS 1.0 on my servers?

The PCI Data Security Standard 3.1 recommends disabling "early TLS" along with SSL: SSL and early TLS are not considered strong cryptography and cannot be used as a security control after June 30, ...
4
votes
3answers
11k views

BEAST: IIS6: Failing PCI scan - are these ciphers OK?

Our PCI compliance scanner, TrustWave, have failed our Win 2003/IIS6 site on BEAST because of the following cyphers: Cipher Suite: SSLv3 : DES-CBC3-SHA Cipher Suite: SSLv3 : RC4-SHA Cipher Suite: ...
4
votes
1answer
6k views

SSL certificate fails to adhere to basic constraints and PCI compliance

We have an SSL cert from GoDaddy and tried to run a PCI compliance check using McAfee's scan. The one problem they found was that the basic constraints / path length is not configured. Here's what ...
4
votes
1answer
412 views

Conceptual design of vulnerability scanning program in global retail network (PCI DSS)

I am trying to design yearly program to scan for vulnerabilities on a very large network of payment terminals. The company has thousands of retail points all around the world which need to be ...
4
votes
3answers
6k views

Groupon SG is Storing Customers' Credit Card Information

Today I was purchasing a gift from Singapore Groupon website. And then I realized that what I have to do is simply login and hit the "submit order" button, because they store my credit card ...
4
votes
1answer
438 views

card.io & PCI DSS v3.0

I've researched for quite some time now, but I cannot find an answer to this question: If I touch card holder data in any way, I need PCI DSS v3.0 SAQ A-EP certification, which is quite complex to ...
4
votes
1answer
672 views

Nessus HTML5 version 5.0.3 - PCI Scan

I've been searching for a couple days, even contacting support, to find out if Nessus has a bundle that scans for PCI compliance. It selects all 44 categories and regardless of what kind of scan I ...
4
votes
2answers
1k views

Secure Mobile Payments using HTTPS Web App

I'm hoping an expert with PCI compliance knowledge can help answer this question. We're looking at integrating mobile payments with our application which is HTML5-based for cross-platform reasons. ...
4
votes
1answer
488 views

POS still PCI compliant after Single Sign-on?

I have a Point of Sale System that's a web application. I also have a separate reporting system that's a web application and a separate inventory system that's a web application. It's necessary to use ...
4
votes
1answer
53 views

ASV scan with reverse proxy

We are PCI compliant as a service provider, however our service port forwards some web traffic at TCP level. Customers use our PCI compliant service and can choose to upload a TLS/SSL certificate to ...
4
votes
1answer
668 views

Is it safe to save customer information from Stripe? Do we need to be PCI compliant?

Following their tutorial, Stripe allows to save customer and charge them later. But, does one have to be PCI compliant? In their API Reference, it seems they give lot of information to be stored ...
4
votes
1answer
6k views

Is using RC4-MD5/RC4-SHA as SSL ciphers enough for most purpose?

In the AWS ELB, I have uploaded a cert and only selected "RC4-MD5" + "RC4-SHA" as the ciphers and scored A in the ssltest [1] If I using the default ELB setting, I can only score a C Since I am not ...
4
votes
1answer
549 views

Is Heroku PCI Compliant?

Obviously Heroku wants you to think they're PCI compliant by telling you "Heroku’s infrastructure provider is PCI Level 1 compliant" (AWS). https://www.heroku.com/policy/security But since Heroku ...
4
votes
3answers
879 views

PCI compliance if not storing or transmitting credit card data

I have a networked product that we install on customer networks. The device is does not pass any of the CC data, but only sits on the same network (think Nest or Dropcam). The customer networks ...
4
votes
3answers
406 views

Storing credit card information for later manual processing

I am rebuilding a clients eCommerce site using Wordpress and WooCommerce as the framework. Their current eCommerce site takes the credit card information and stores it for later manual processing. To ...
4
votes
2answers
83 views

Steps to Become PCI Compliant?

I have a small business, and I'm in the process of building a new website. My card processing company says I need to be PCI compliant. I know I did this once before years ago and had the Compliance ...
4
votes
2answers
228 views

Are invalid card numbers under PCI compliance

If a merchant sends an invalid card number to the bank, will the bank have to secure the information to be PCI compliant?
4
votes
2answers
236 views

Incident Reporting or Notification Policy domain?

I'm writing a company policy on how employees should handle reports of information security related events and notifications that come from vendors, customers, and from people within our organization. ...
4
votes
2answers
307 views

Perl CPAN modules in a PCI-DSS environment

We are currently working on implementing the PCI-DSS ruleset in our IT environment, where all of the inhouse software we use is Perl. We have a Perl dev team of about 10 people (inlcuding me) and ...
4
votes
1answer
237 views

Key Management for PCI and Payment automation

We're a bootstrapped startup looking to achieve PCI compliance, we've almost nailed all requirements but I recently came across this blog post which totally derails our plans and efforts : ...
4
votes
2answers
206 views

If I storing my own cards in a database. Does this fall under PCI compliance framework?

We want to store some cardholders data in our database. The card we want to store are all connected to our own company account. Does this fall under the PCI framework? For example do I have to comply ...