An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

learn more… | top users | synonyms

3
votes
2answers
1k views

How to satisfy requirement 10.6 of PCI DSS?

The company I'm working for is applying for PCI compliance and I'm in charge of writing most of the required procedures and policies. The problem is that I don't have any experience with IT security, ...
2
votes
3answers
358 views

Client is not storing Credit Cards Securily (near plain text). How do I convince client to be more secure?

I am writing in regards to PCI-DSS compliance for taking credit cards. A client of mine is not willing / does not want to bump up security beyond what is currently done for their credit card data. All ...
3
votes
2answers
248 views

Backup server categorization in the Open PCI Scoping Toolkit

How are backup servers which host a copy of cardholder data supposed to be categorized according to the Open PCI Scoping Toolkit, given that the backup and storage guidelines from the PCI standards ...
10
votes
4answers
1k views

PCI-DSS - one application per server?

How do I interpret the 2.2.1 point for PCI-DSS? Is "application server" 'one primary function' or does it need to be "program x server", "program y server" etc? I have a collection of applications ...
5
votes
3answers
378 views

PCI compliance can prevent fines?

We're working really hard to achieve PCI compliance for a project and will likely be spending hundreds of dollars each month, but I was wondering what if, god forbid, something unlikely happens and ...
4
votes
1answer
193 views

Key Management for PCI and Payment automation

We're a bootstrapped startup looking to achieve PCI compliance, we've almost nailed all requirements but I recently came across this blog post which totally derails our plans and efforts : ...
0
votes
1answer
77 views

Precedent for an in-house cardholder information server?

My organization is undertaking a project to attempt to reduce the amount of our infrastructure covered under PCI scope. Specifically, we're looking to exclude our web merchandising software from PCI ...
6
votes
3answers
2k views

What issues arise from sharing a SSL certificate's private key?

Scenario: I am hosting a website for a my client, who we'll call S. S owns the domain s.com and I own the servers that actually host the website. S now wants to enable SSL on their website. I have ...
3
votes
3answers
5k views

BEAST: IIS6: Failing PCI scan - are these ciphers OK?

Our PCI compliance scanner, TrustWave, have failed our Win 2003/IIS6 site on BEAST because of the following cyphers: Cipher Suite: SSLv3 : DES-CBC3-SHA Cipher Suite: SSLv3 : RC4-SHA Cipher Suite: ...
8
votes
2answers
429 views

Key management scheme in PHP that is compliant with NIST SP 800-57

We're working on achieving SAQ-D PCI compliance and along the way we're discovering new things each day. Today: Key Management I wonder if there're any open-source or commercial PHP solutions ...
0
votes
2answers
761 views

PCI prohibit direct outbound connections on EC2

I am using EC2 instances to power our web service that needs to be PCI SAQ-C compliant. I am trying to figure out what point 1.3 of the self assessment really means: 1.3 Does the firewall ...
0
votes
1answer
294 views

Configuring IIS SSL for PCI

Is there a clear, concise list of of SSL settings available for IIS which will pass my PCI audit scanning? Preferably something for both IIS 6 and IIS 7 I'm currently running into BEAST issues but ...
7
votes
3answers
534 views

A bit confused about PCI compliance

I have a client that wants me to build her a simple e-commerce site for her small quilt store. I'm going to use Stripe for the credit card handling. The only info I'm going to keep on my system is ...
2
votes
3answers
241 views

PCI Compliance Problem

My company is trying to become fully PCI Compliant and we are switching our outdated systems to use Authorize.net CIM among other things. But, currently we're all over the place and until our new ...
6
votes
2answers
696 views

Does having a passphrase and SSH key qualify as two factor authentication for PCI?

I am working on getting our company's servers PCI SAQ-C compliant (credit card data passes through our system but is not stored by our system). We have SSH access to administer the servers and all ...
12
votes
2answers
5k views

Can https be used instead of sftp for secure file transfers?

My company works with financials, and we are required to transfer files containing non-public consumer information securely between our company and our clients. The usual solution is to go with sftp ...
3
votes
2answers
233 views

CVE-2012-4448 pci-scan

I'm currently failing a PCI scan due to CVE-2012-4448 The recommended resolution from Security Metrics is to upgrade to a wordpress version higher than 3.4.2, however currently that is the highest ...
3
votes
3answers
116 views

If I host a web form which submits CC details to a provider, are there PCI implications form host?

I'm wondering if anyone has any thoughts on a specific question I have. I read a lot about systems that 'store, process, submit' CC data requiring compliance. If I host a form on my website which ...
2
votes
2answers
172 views

Does requiring users to fill out a PDF w/ CC information and mail it back violate PCI compliance?

I'm attempting to place an order with an American company and I reside outside of America. Upon placing the order (and already submitting payment) I received an email asking me to fill out a PDF ...
4
votes
1answer
305 views

Conceptual design of vulnerability scanning program in global retail network (PCI DSS)

I am trying to design yearly program to scan for vulnerabilities on a very large network of payment terminals. The company has thousands of retail points all around the world which need to be ...
2
votes
3answers
797 views

Vulnerability scanning applicability for PCI DSS

I'm fully up to speed on PCI DSS requirements and have attend the ISA course recently. The course was helpful and I was able to bounce ideas off of the trainer. However I keep coming back to one ...
4
votes
1answer
545 views

Help understanding PCI-DSS when using password based encryption from automatically generated keys

I've inherited the task of self-auditing an e-commerce system for compliance with the PCI-DSS. We are storing the PAN in our database in encrypted form using 256 bit AES algorithm to do the ...
5
votes
2answers
199 views

Are any and all software vendors who have stored credit card information in their databases subject to PCI-DSS or only some?

Is a commercial software vendor who sells software for use in the United States, subject to, or legally required to implement PCI-DSS if their software includes a feature which will allow the ...
3
votes
1answer
242 views

Payment security on Android App

I am developing an application from which users browse and buy books. The client can be Android ,iOS, Mac. The server is ASP.net Web APIs. I know there are many payment services available. One of ...
4
votes
2answers
167 views

If I storing my own cards in a database. Does this fall under PCI compliance framework?

We want to store some cardholders data in our database. The card we want to store are all connected to our own company account. Does this fall under the PCI framework? For example do I have to comply ...
2
votes
2answers
948 views

Why does Amazon ask for the CVC/CVV if it bills without it?

I have a follow-up question relating to this question: How does Amazon bill me wihout the CVC / CVV / CVV2? If amazon.com can bill without the CVV why does it ask for it the first time information ...
1
vote
2answers
308 views

Oracle Transparent Data Encryption [closed]

Currently we are using Vormetric for Transparent Data Encryption (TDE) in the Oracle Standard product to satisfy PCI-DSS 2.0 requirements. Does anyone have experience with other third party solutions ...
5
votes
1answer
350 views

PCI-DSS Scope with tokenisation

My organisation is now using tokenisation and we are no longer storing any credit card information. I now think I may no longer need some of the following controls:- (there may be others although ...
3
votes
3answers
2k views

Effective wireless scanning to meet PCI DSS 11.1?

PCI-DSS section 11.2 requires the business to "Test for the presence of wireless access points and detect unauthorized wireless access points". However, this is more easily said than done. Simply ...
4
votes
3answers
2k views

PCI-DSS compliance for business with only swipe terminals

I support the IT infrastructure for a small retail business which is now required to undergo a PCI-DSS assessment. The payment service and terminal provider (Streamline) has asked that we use ...
2
votes
2answers
149 views

HTML 5 postMessage PCI compliant

We're building an application (App-A) that will allow a user to enter credit card information. This application will live on a non PCI compliant zone. We have another application (App-B) that also ...
0
votes
5answers
274 views

PCI Policy Management software?

I am working on a project to get our company PCI Compliant. One of the key issues I face is managing PCI/Security policies in the organisation. I am responsible for creating the policies and ...
3
votes
2answers
592 views

Can we print cardholder data under the PCI DSS Compliance framework and stay compliant?

I have a question regarding PCI compliance. There seems to be a valid business need in our company to keep some card holder data, for unsuccessful transaction. An example would be a customer makes a ...
5
votes
1answer
230 views

Open ID, Storing card details, and PCI compliance

If you store payment card details for a user, and you have a 'Login via openID' which includes services like Google and Facebook, is this allowed under PCI Compliance? Or do you need your own distinct ...
6
votes
3answers
1k views

If PCI DSS isn't a law, how can I be prosecuted for not being compliant?

PCI DSS isn't a law. Why can I be prosecuted for not being compliant?
1
vote
1answer
345 views

Which PCI DSS SAQ applies when you don't store store but transmit CHD?

We have a merchant website that uses Authorize.net's AIM. Cardholder data (credit card number, expiration date, etc.) is entered at our website. Then it's transmitted to payment gateway and isn't ...
23
votes
2answers
10k views

Minimum requrements for storing last 4 digits of credit card number?

We have a merchant website that uses Autorize.net's CIM and AIM. Our users may have multiple credit cards so we'd want to give them opportunity to distinguish between credit cards that they use on ...
0
votes
2answers
475 views

Is this way of using Authorize.net's CIM PCI compliant?

We have a webapp where Authorize.NET's CIM and AIM are used for payment operations. When user buys something at first time he enters his CC number and other billing information at our site. This ...
2
votes
3answers
1k views

Effectively limiting outgoing firewall traffic to frequently-changing IPs

PCI DSS 1.2.1 states: Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment. Verify that all other inbound and outbound traffic is ...
0
votes
1answer
161 views

PCI-DSS for VX570 and POS on same network

Have a Point-of-sale (POS) workstation and a VX570 credit card terminal connected via RS232 and both on the same network with internet connection. No card data is transfered to the POS except for ...
25
votes
4answers
2k views

Convince the company not to store credit card numbers in our webapp

The company I work for needs a system to perform monthly credit card charges to customer accounts. Customers will be able to update their credit card information from an online interface written in ...
0
votes
1answer
137 views

How much does network security audit and patch work? [closed]

how much is reasonable if i'm looking to hire someone FULL TIME to handle security auditing and patching for my network? I need my network to be PCI Compliance and what not as well. MY office have ...
3
votes
1answer
250 views

Do I need to purchase a PCI DSS certificate?

I'm creating an e-commerce website and I was wondering, do I need to purchase a PCI DSS certificate or do I just need to comply with the standards?
0
votes
3answers
503 views

What is the most cost effective way to comply with PCI requirement 6.5, developer training?

We are a small company that is coming increasingly under pressure to be PCI complaint. Our main product is an API that move cardholder data between a customer and a supplier. I am in the process of ...
4
votes
3answers
2k views

How can I report PCI-DSS violations?

A large supermarket chain in the UK, are storing their passwords in plaintext. Apparently, Mastercard's security department are already involved. I'd like to report them for violating PCI-DSS, since ...
1
vote
1answer
879 views

Storing only BIN part of PAN, does this qualify as a full PAN?

We are looking at becoming PCI-DSS complaint. We wish to minimize the impact it will have on us and our business. As this can be a very expensive exercise. As I understand it if you do not store ...
3
votes
5answers
364 views

PCI-DSS and salt storage

PCI-DSS states the following: 3.5 Protect any keys used to secure cardholder data against disclosure and misuse I have a service which stores a salted bcrypt hash of the user's PAN. Assuming the ...
2
votes
2answers
887 views

PCI Compliance network scope

I was wondering if anyone could clarify the scope of PCI compliance with regard to multiple networks. At present, there's one PCI compliant network to which another network connects via VPN. The PCI ...
5
votes
1answer
3k views

Does storing bank account-routing number combinations fall under PCI DSS Level 1 compliance rules?

I've looked at a number of question/answer threads and docs about PCI compliance, including various results on Google and have not found a definitive answer to this question: Does a web app fall ...
0
votes
2answers
430 views

How to safely collect bank account from website?

I want to collect bank account information from my customers on my website. I'd like to do that through a form, then I will download it to a PC, print it, and then delete it from the website. Or ...