An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

learn more… | top users | synonyms

3
votes
2answers
760 views

PCI DSS 11.2.1/11.2.3 - Internal scans scope

I need help about SAQ #C - Are quarterly internal vulnerability scans performed? What is target (scope) for those internal scans? Our configuration: Router with modem (WAN1/LAN1), DMZ, some office ...
2
votes
1answer
75 views

Internet connection for POS of a Third Part

From time to time, our premises and infrastructure is rented temporally for some conventions/meetings. One of these meetings requires an ordinary POS which would require a phone line or internet ...
4
votes
2answers
177 views

Incident Reporting or Notification Policy domain?

I'm writing a company policy on how employees should handle reports of information security related events and notifications that come from vendors, customers, and from people within our organization. ...
3
votes
3answers
400 views

What type of PCI Compliance do I need if I don't hold any card data

I am working with a company that is "PCI Compliant" and in order for them to give me any of their data (customer name, email) they ask that I be "PCI Compliant" even though this data is not credit ...
0
votes
2answers
144 views

Senario:SSL Enabled Online Banking Application. Question: Should card numbers be provided back to a user un-masked, when there is a failed login?

For an online banking application with SSL enabled, should card numbers be provided back to the user unmasked, when there is a failed login. Would this be a violation of PCI DSS 3.3 or not as the ...
0
votes
1answer
67 views

PCI payment gateway and store [duplicate]

Consider situation: I made my own payment gateway and it passes vulnerabity tests. My store redirects to this payment gateway. Card details is collected there. Payment is processed there (not ...
2
votes
3answers
232 views

PCI Compilance - Custom payment processor

Consider following situation: We have location A where we have our online store. We have location B where we have payment processing. Server is dedicated to do only payment processing jobs We can ...
2
votes
1answer
240 views

Normalizing Windows Advanced Firewall rules

How can I best normalize our Windows Advanced Firewall rules while implementing network segmentation? I want them to be as clear and concise as possible for audit purposes. What few examples I've seen ...
4
votes
2answers
198 views

Perl CPAN modules in a PCI-DSS environment

We are currently working on implementing the PCI-DSS ruleset in our IT environment, where all of the inhouse software we use is Perl. We have a Perl dev team of about 10 people (inlcuding me) and ...
1
vote
1answer
150 views

How does a PCI QSA audit a company?

Corporate setups are often complex with data centers in multiple locations, complex ACL's and networks setup between them. How does a PCI auditor actually audit the systems ? How does he get to know ...
2
votes
3answers
972 views

Can change management for PCI compliance be accomplished via simple emails?

Item 6.4.5 of PCI DSS requires the following: 6.4.5 Change control procedures for the implementation of security patches and software modifications. Procedures must include the following: ...
1
vote
1answer
282 views

Requirement 12.1.2 of PCI DSS: Is it enough to point to a standard process?

Item 12.1.2 of PCI DSS requires that the company's security policy: 12.1.2 Includes an annual process that identifies threats, and vulnerabilities, and results in a formal risk assessment. NIST ...
2
votes
1answer
444 views

Are banks required to be PCI compliant?

Since credit card transactions like cash advance can be performed at most ATMs, are banks required to be PCI DSS compliant?
1
vote
3answers
475 views

“Due diligence” in PCI requirement 12.8.3

Item 12.8.3 from the PCI DSS requires the following: 12.8.3 Ensure there is an established process for engaging service providers including proper due diligence prior to engagement. What is ...
3
votes
2answers
419 views

What should I have prepared for a PCI compliance onsite assessment?

The company I'm working for is about the undergo PCI compliance onsite assessment. The PCI DSS has a kind of checklist, but it is all very vague and abstract to me. So I'm not quite sure what I need ...
3
votes
2answers
2k views

How to satisfy requirement 10.6 of PCI DSS?

The company I'm working for is applying for PCI compliance and I'm in charge of writing most of the required procedures and policies. The problem is that I don't have any experience with IT security, ...
2
votes
3answers
393 views

Client is not storing Credit Cards Securily (near plain text). How do I convince client to be more secure?

I am writing in regards to PCI-DSS compliance for taking credit cards. A client of mine is not willing / does not want to bump up security beyond what is currently done for their credit card data. All ...
3
votes
2answers
275 views

Backup server categorization in the Open PCI Scoping Toolkit

How are backup servers which host a copy of cardholder data supposed to be categorized according to the Open PCI Scoping Toolkit, given that the backup and storage guidelines from the PCI standards ...
11
votes
4answers
1k views

PCI-DSS - one application per server?

How do I interpret the 2.2.1 point for PCI-DSS? Is "application server" 'one primary function' or does it need to be "program x server", "program y server" etc? I have a collection of applications ...
5
votes
3answers
385 views

PCI compliance can prevent fines?

We're working really hard to achieve PCI compliance for a project and will likely be spending hundreds of dollars each month, but I was wondering what if, god forbid, something unlikely happens and ...
4
votes
1answer
195 views

Key Management for PCI and Payment automation

We're a bootstrapped startup looking to achieve PCI compliance, we've almost nailed all requirements but I recently came across this blog post which totally derails our plans and efforts : ...
0
votes
1answer
78 views

Precedent for an in-house cardholder information server?

My organization is undertaking a project to attempt to reduce the amount of our infrastructure covered under PCI scope. Specifically, we're looking to exclude our web merchandising software from PCI ...
7
votes
3answers
3k views

What issues arise from sharing a SSL certificate's private key?

Scenario: I am hosting a website for a my client, who we'll call S. S owns the domain s.com and I own the servers that actually host the website. S now wants to enable SSL on their website. I have ...
3
votes
3answers
6k views

BEAST: IIS6: Failing PCI scan - are these ciphers OK?

Our PCI compliance scanner, TrustWave, have failed our Win 2003/IIS6 site on BEAST because of the following cyphers: Cipher Suite: SSLv3 : DES-CBC3-SHA Cipher Suite: SSLv3 : RC4-SHA Cipher Suite: ...
8
votes
2answers
447 views

Key management scheme in PHP that is compliant with NIST SP 800-57

We're working on achieving SAQ-D PCI compliance and along the way we're discovering new things each day. Today: Key Management I wonder if there're any open-source or commercial PHP solutions ...
0
votes
2answers
835 views

PCI prohibit direct outbound connections on EC2

I am using EC2 instances to power our web service that needs to be PCI SAQ-C compliant. I am trying to figure out what point 1.3 of the self assessment really means: 1.3 Does the firewall ...
0
votes
1answer
308 views

Configuring IIS SSL for PCI

Is there a clear, concise list of of SSL settings available for IIS which will pass my PCI audit scanning? Preferably something for both IIS 6 and IIS 7 I'm currently running into BEAST issues but ...
7
votes
3answers
565 views

A bit confused about PCI compliance

I have a client that wants me to build her a simple e-commerce site for her small quilt store. I'm going to use Stripe for the credit card handling. The only info I'm going to keep on my system is ...
2
votes
3answers
254 views

PCI Compliance Problem

My company is trying to become fully PCI Compliant and we are switching our outdated systems to use Authorize.net CIM among other things. But, currently we're all over the place and until our new ...
6
votes
2answers
755 views

Does having a passphrase and SSH key qualify as two factor authentication for PCI?

I am working on getting our company's servers PCI SAQ-C compliant (credit card data passes through our system but is not stored by our system). We have SSH access to administer the servers and all ...
12
votes
2answers
6k views

Can https be used instead of sftp for secure file transfers?

My company works with financials, and we are required to transfer files containing non-public consumer information securely between our company and our clients. The usual solution is to go with sftp ...
3
votes
2answers
239 views

CVE-2012-4448 pci-scan

I'm currently failing a PCI scan due to CVE-2012-4448 The recommended resolution from Security Metrics is to upgrade to a wordpress version higher than 3.4.2, however currently that is the highest ...
3
votes
3answers
120 views

If I host a web form which submits CC details to a provider, are there PCI implications form host?

I'm wondering if anyone has any thoughts on a specific question I have. I read a lot about systems that 'store, process, submit' CC data requiring compliance. If I host a form on my website which ...
2
votes
2answers
172 views

Does requiring users to fill out a PDF w/ CC information and mail it back violate PCI compliance?

I'm attempting to place an order with an American company and I reside outside of America. Upon placing the order (and already submitting payment) I received an email asking me to fill out a PDF ...
4
votes
1answer
314 views

Conceptual design of vulnerability scanning program in global retail network (PCI DSS)

I am trying to design yearly program to scan for vulnerabilities on a very large network of payment terminals. The company has thousands of retail points all around the world which need to be ...
2
votes
3answers
873 views

Vulnerability scanning applicability for PCI DSS

I'm fully up to speed on PCI DSS requirements and have attend the ISA course recently. The course was helpful and I was able to bounce ideas off of the trainer. However I keep coming back to one ...
4
votes
1answer
610 views

Help understanding PCI-DSS when using password based encryption from automatically generated keys

I've inherited the task of self-auditing an e-commerce system for compliance with the PCI-DSS. We are storing the PAN in our database in encrypted form using 256 bit AES algorithm to do the ...
5
votes
2answers
209 views

Are any and all software vendors who have stored credit card information in their databases subject to PCI-DSS or only some?

Is a commercial software vendor who sells software for use in the United States, subject to, or legally required to implement PCI-DSS if their software includes a feature which will allow the ...
3
votes
1answer
255 views

Payment security on Android App

I am developing an application from which users browse and buy books. The client can be Android ,iOS, Mac. The server is ASP.net Web APIs. I know there are many payment services available. One of ...
4
votes
2answers
172 views

If I storing my own cards in a database. Does this fall under PCI compliance framework?

We want to store some cardholders data in our database. The card we want to store are all connected to our own company account. Does this fall under the PCI framework? For example do I have to comply ...
2
votes
2answers
1k views

Why does Amazon ask for the CVC/CVV if it bills without it?

I have a follow-up question relating to this question: How does Amazon bill me wihout the CVC / CVV / CVV2? If amazon.com can bill without the CVV why does it ask for it the first time information ...
1
vote
2answers
329 views

Oracle Transparent Data Encryption [closed]

Currently we are using Vormetric for Transparent Data Encryption (TDE) in the Oracle Standard product to satisfy PCI-DSS 2.0 requirements. Does anyone have experience with other third party solutions ...
5
votes
1answer
377 views

PCI-DSS Scope with tokenisation

My organisation is now using tokenisation and we are no longer storing any credit card information. I now think I may no longer need some of the following controls:- (there may be others although ...
3
votes
3answers
2k views

Effective wireless scanning to meet PCI DSS 11.1?

PCI-DSS section 11.2 requires the business to "Test for the presence of wireless access points and detect unauthorized wireless access points". However, this is more easily said than done. Simply ...
4
votes
3answers
2k views

PCI-DSS compliance for business with only swipe terminals

I support the IT infrastructure for a small retail business which is now required to undergo a PCI-DSS assessment. The payment service and terminal provider (Streamline) has asked that we use ...
2
votes
2answers
160 views

HTML 5 postMessage PCI compliant

We're building an application (App-A) that will allow a user to enter credit card information. This application will live on a non PCI compliant zone. We have another application (App-B) that also ...
0
votes
5answers
290 views

PCI Policy Management software?

I am working on a project to get our company PCI Compliant. One of the key issues I face is managing PCI/Security policies in the organisation. I am responsible for creating the policies and ...
3
votes
2answers
645 views

Can we print cardholder data under the PCI DSS Compliance framework and stay compliant?

I have a question regarding PCI compliance. There seems to be a valid business need in our company to keep some card holder data, for unsuccessful transaction. An example would be a customer makes a ...
5
votes
1answer
237 views

Open ID, Storing card details, and PCI compliance

If you store payment card details for a user, and you have a 'Login via openID' which includes services like Google and Facebook, is this allowed under PCI Compliance? Or do you need your own distinct ...
6
votes
3answers
1k views

If PCI DSS isn't a law, how can I be prosecuted for not being compliant?

PCI DSS isn't a law. Why can I be prosecuted for not being compliant?