An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

learn more… | top users | synonyms

0
votes
1answer
311 views

Hashing PAN numbers

According to this blog PAN number should be hashed using a "secret salt". What they are doing is basically H(Message+salt). The reason you need this "secret salt" is because PAN numbers are limited to ...
1
vote
2answers
123 views

PCI Definition of “Transmission”

I am working at a company that is PCI compliant, but I believe they have interpreted some of the requirements incorrectly. Because of this, they are laboring to create work-arounds which I suspect are ...
4
votes
2answers
140 views

Are invalid card numbers under PCI compliance

If a merchant sends an invalid card number to the bank, will the bank have to secure the information to be PCI compliant?
7
votes
2answers
476 views

Unsolicited credit card in email?

I work for an insurance company who will randomly (3-5 times per year) have a consumer who emails their credit card to our customer service department. We don't ask for the number, they just send it ...
1
vote
0answers
120 views

Test S/KEY support for PCI compliance - CVE-2007-2243

In order for our business to be PCI compliant, we need to prove that we are not vulnerable to CVE-2007-2243. This states that: OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is ...
1
vote
2answers
536 views

Internal / external Penetration testing a webserver - PCI

the PCI DSS document states: 11.3.2 Perform internal penetration testing at least annually and after any significant infrastructure or application upgrade or modification (such as an operating ...
1
vote
1answer
3k views

Which is the Best Cipher Mode and Padding Mode for AES Encryption? [closed]

As per PCI-DSS 3.4 requirement: For storing Credit Card Data Strong Cryptography should be used. I decided to use AES Encryption which is a strong and mostly recommended crypto for encrypting ...
1
vote
0answers
30 views

How to store Initialization Vector securely for AES Encryption? [duplicate]

I'm using AES Encryption for encrypting credit card details and so I will store my DEK in Ecnrypted form and do we need to encrypt the Initialization vector for storage?
8
votes
1answer
622 views

What is the difference between HSM and Key server?

As per PCI-DSS requirements, we have to use either HSM (Hardware Security Module), or Key Server to store the KEK (Key Encryption Key). If I'm storing encrypted DEK (Data Encryption Key) in an App ...
6
votes
2answers
450 views

What does the PCI-DSS statement “Store separately from the data encrypting key” mean?

As per the PCI-DSS 3.5.2 requirement Encrypted with a key-encrypting key that is at least as strong as the data-encrypting key, and that is stored separately from the data encrypting key. Does this ...
3
votes
1answer
981 views

How to decrypt the Encrypted DEK using KEK which are separated in servers?

Decrypting the DEK using KEK under PCI-Standards, which are separated by Servers: Let say for example we have server1 and server2 Server1: It is in East US, called it as Application Server. ...
3
votes
1answer
398 views

Is it safe to save customer information from Stripe? Do we need to be PCI compliant?

Following their tutorial, Stripe allows to save customer and charge them later. But, does one have to be PCI compliant? In their API Reference, it seems they give lot of information to be stored ...
0
votes
1answer
342 views

What is the diffference between HSM and PTS-approved point-of-interaction device?

According to PCI-DSS requirement 3.5.2: We should store secret keys in a cryptographic device. Cryptographic devices: 1.HSM 2.PTS-approved point of interaction device My questions: I have some ...
0
votes
2answers
642 views

How to implement PCI DSS requirement 3.5.2?

According to PCI-DSS requirement 3.5.2: Secret and private keys used to encrypt /decrypt cardholder data should be stored in one of the following forms at all times: Encrypted with a key-encrypting ...
3
votes
4answers
287 views

Risk management with software code analysis

I am a programmer by day and I am working on a project that is focused around risk management based on PCI-DSS controls within an organisation. I have been thinking lately that a lot of PCI-DSS ...
3
votes
2answers
98 views

Legacy system PCI Compliance

I have a legacy system that collects and stores credit card numbers ( BAD! ). We are in the process of replacing that system in phases. We are going to integrate with a credit card processing system ...
0
votes
1answer
360 views

What is an offsite facility as per PCI DSS requirement 9.5.1?

PCI DSS Version 3.0, Requirement 9.5.1 says that we have to store media backups in a secure location, preferably an off-site facility such as an alternative or backup site or a commercial storage ...
2
votes
3answers
809 views

PCI DSS - only one primary function per server

The PCI DSS says that a server can have only one primary function and i'm a little confused over what it means by 'one primary function' we have a webserver with database - web pages and email is ...
0
votes
3answers
1k views

Is it PCI compliant to send credit card details to the server without saving them there?

Considering I use SSL the whole process. I have an IOS client that I want to use to enter the user's credit card details. I want to do the whole charging and processing on the server side, so I send ...
1
vote
2answers
264 views

Does server RAM count as storage for PCI Compliance?

We are an eCommerce website. I'm working on our PCI compliance at the moment, and I'm trying, if at all possible, to argue that our organisation falls under SAQ A rather than D. We do not sensitive ...
2
votes
1answer
196 views

PCI DSS compliance for storing PAN and PII in multi-tenant environment

I wanted to know if I can still be PCI compliant if I store card holder and PII information for multiple tenants in the same database? I.e., have an identifier on the table level to identify the ...
2
votes
1answer
967 views

How to process or manage Key-Encryption-Key using HSM?

Let's consider two Encryption keys: 1.Data-Encryption-Key(DEK) 2.Key-Encryption-Key(KEK) KEK will be securely stored in HSM, which will be encrypted using master key. Data Encryption Key will be ...
1
vote
1answer
4k views

How to Encrypt Credit Card number for storing it in sql server database according to PCI DSS Requirement?

According to PCI-DSS 3.4 Requirement: Render PAN unreadable anywhere it is stored by using the below methods: One-way hash Truncation Index tokens and pads Strong cryptography with associated ...
1
vote
1answer
178 views

Which is best DPAPI or HSM?

Can you please explain what's is the main difference between for this both DPAPI and HSM? As far as I understand both protecting the data, the way of protection is difference HSM is physical device ...
2
votes
1answer
169 views

After the Cryptoperiod timespan, do we need to encrypt all the data again?

As per PCI-DSS we need to dispose the old keys after the timespan. After the cryptoperiod (lets say one year) time span, do I need to encrypt all (20k card holders) the data once again with the newly ...
0
votes
1answer
277 views

LDAP and anonymous bind for PCI compliance

We have to setup a central auth for PCI compliance and I'm wondering if it's ok to allow anonymous bind or should I create a user to do the bind for the services needing ldap?
0
votes
1answer
321 views

When does a PA-DSS certified application expire?

When you search the PCI website for validated payment applications it shows a re-validation date and an expiry date. There is also two categories of payment applications, "Acceptable for new ...
3
votes
3answers
794 views

PCI DSS 2.0 and ssh keys

I know the real answer to the auditor. We are a smaller company under 40 total employees that is also PCI level 1 compliant. We've always used ssh keys on internal servers. You can't ssh in from the ...
3
votes
2answers
98 views

How much security information to publicise?

Apologies if this in the wrong section, not sure if it should go in Server Fault or not. I am preparing to launch a new web app. We have put a lot of effort into offering good security. From a PR ...
0
votes
1answer
294 views

DSA Generates different signatures with the same data [closed]

I'm using the example given in msdn article about the DSACryptoServiceProvider Class. The problem is that I get a different signature each time I run the code. I tried OpenSSL and didn't get this ...
0
votes
2answers
732 views

Encryption of PCI data, and PCI-DSS scoping

I read another question which made me think... If you encrypt PCI data (credit card numbers, etc.) using PGP or AES and send it through a firewall, is that firewall in scope? Alternatively, what ...
2
votes
2answers
141 views

PCI-DSS Is the infrastructure really in-scope?

Say I have an application that takes credit cards, but this is actually a payment gateway on the internet that I don't control. The web site used HTTPS and only returns if the card was authorized or ...
2
votes
2answers
1k views

What level of PCI Compliance do I need to adhere to if I do not store, but transmit data?

I'm doing a bit of research on my level of PCI compliance, and I'm having a difficult time grasping where I'm supposed to be. I have a web service that has recurring billing. The site is created ...
1
vote
2answers
358 views

PCI Compliance Distibution

I run a small e-commerce website hosted on a dedicated server with Debian 6 Squeeze. I need to become PCI compliant (the card industry standard for security). Therefore I have registered with ...
2
votes
3answers
109 views

Are there any reasons to be concerned about the security of “Coin”? [duplicate]

I just came across this: https://onlycoin.com/ A credit-card sized device that not only holds the info for as many credit and debit and membership cards as you want (they claim) but also can ...
4
votes
3answers
624 views

What are the security implications of a device like Coin?

Coin is a new device aimed at replacing up to 8 credit cards in your wallet with a single device. It apparently works by scanning the credit card data into a mobile application that syncs with the ...
1
vote
1answer
553 views

Does a PCI DSS category 2x device require the same physical security as a 1a/b?

I am trying to further understand the scope of my environment. I have a group of category 2x devices that are used to manage a category 1b device through a category 2a device. I understand my group ...
1
vote
2answers
250 views

PCI-DSS - key-based shell access to internal servers?

In the following PCI 2.0 requirement, I am not sure how to interpret computer access to internal machines (not remotely accessible): Requirement 8: Assign a unique ID to each person with computer ...
1
vote
3answers
130 views

Are there any security related rules in PCI-DSS that govern when I can capture a payment?

Is there a PCI-DSS rule that a merchant cannot capture the funds for an order until we have actually shipped it? I can't seem to find an official reference that describes this as a PCI DSS ...
1
vote
2answers
109 views

Antivirus / Wireless PCI v2 Controls Scope

Do the Antivirus / Wireless controls within PCI v2 apply for the entire organisation, or just for the PCI scope?
0
votes
1answer
691 views

Can someone please briefly explain HIPPA compliance?

I worked in web hosting for several years, particularly security. I am familiar with PCI compliance and I would say the "short and sweet" guide to PCI for an eCommerce store is as follows: Client ...
0
votes
2answers
651 views

Does using Bcrypt to encrypt credit card numbers satisfy PCI compliance?

I understand that using MD5 is not safe and is not PCI compliant. Does using BCrypt satisfy PCI compliance
1
vote
0answers
81 views

PCI Compliance customer data being made available to another system?

Not completely au fait with PCI compliance, however we have our server checked each month by our host to check it is PCI compliant, because we have to keep it PCI Compliant for a specific ...
6
votes
2answers
2k views

Is SSL terminated at a load balancer PCI compliant?

I've read this nice question: Should SSL be terminated at a load balancer? And I have the same question, but with PCI-DSS compliance in mind. Is SSL terminated at the load balancer, with clear ...
1
vote
1answer
569 views

ReverseProxy and PCI Compliance

My company has a PCI compliant billing gateway and they expose a service for submitting credit card payment details. I am writing a (Single Page Application/end-to-end javascript) website for them ...
3
votes
1answer
700 views

Is there a way to process a credit card transaction asychronously and be PCI compliant?

If I had to store credit card details temporarily to shove it to the processor using an asychronous worker, I know that that information must be encrypted. To get it to the worker, however, it must ...
3
votes
3answers
214 views

What is the job of an IT auditor?

I am going through training in information security, as a part of the course they included compliance standards like: PCI DSS ISO 27001-2005 Cobit framework So after searching over Google, I came ...
2
votes
1answer
442 views

Is it OK to generate a token for a credit card without the user's permission? Is that PCI compliant?

Is it PCI compliant to generate a token for every card used for processing, regardless of whether the client asked for his card to be saved or not?
1
vote
3answers
705 views

Suggestion on how to be PCI Compliant

I'm working on a system that takes the customers credit card information before sending it to the processor. It requires me to ask the customer for cc#, CVV, date, one at a time and send that to my ...
3
votes
2answers
648 views

Does PCI ban using MD5 to store sensitive data?

Just had a vendor tell me that because their PCI auditors did not recommend banning the use of unsalted MD5 to store sensitive data at this time with with their current level of PCI compliance that ...