An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.
3
votes
1answer
196 views
POS still PCI compliant after Single Sign-on?
I have a Point of Sale System that's a web application. I also have a separate reporting system that's a web application and a separate inventory system that's a web application. It's necessary to use ...
3
votes
2answers
438 views
Payment gateway integration, any security considerations?
I'm interested in understanding what security considerations there are around implementing a payment gateway. I have, so far, thought of:
having a SSL Cert is a MUST.
logging actions is critical.
...
7
votes
7answers
2k views
Storing credit cards for automatic payments?
I have no experience with storing credit cards and I do not know anything about the legal end of this.
The company I work for / develop for wants to store credit cards to process auto payments for ...
5
votes
3answers
237 views
Certifiable standards for server security, besides PCI-DSS?
The Payment Card Industry Data Security Standard is widely used in the financial industry and seems to be a useful requirement from the standpoint of a potential customer (see also Does PCI compliance ...
6
votes
7answers
789 views
Is this set-up PCI-Compliant?
Question: Is there a way to store credit card information on a shared hosting server AND be PCI compliant?
Here is the setup:
1) SSL is being implemented for the whole checkout process and for the ...
4
votes
2answers
618 views
Storing account numbers and sort codes online
There are a lot of questions on storing credit card information, and of how PCI SSC/PA-DSS regulations apply to such activities and systems. I have read a lot of these, but my question relates to a ...
5
votes
3answers
464 views
Where do I securely store the key for a system where the source is visible?
I have a customer with an Access database (ugh!) in which credit cards are stored in plaintext (yikes!), so amongst other changes I'm doing in the app, I'm applying some encryption in there.
I've ...
18
votes
1answer
1k views
Has anyone achieved PCI compliance on AWS?
All the FAQs, documents and statements published by AWS aside, did any Level 1 merchant or service provider actually achieve PCI compliance on AWS yet? We're evaluating moving some of our services to ...
12
votes
3answers
545 views
Whistleblowing, business ethics and credit card data
I'm writing this post as I'm facing a personal, ethical dillemma and I would like feedback on the best way to approach this situation, particularly from a philosophical point of view.
I work for a ...
8
votes
4answers
1k views
PCI restrictions on using using (hashed) credit card number to identify a repeat customer?
Question for any PCI experts out there:
Airport ticket kiosks can use your credit card to find your reservation at checkin time. So clearly PCI must allow use of credit card numbers to identify ...
4
votes
2answers
241 views
Is PCI DSS applicable to other solutions than those dealing with payment cards?
According to this quote from "applicability" section of PCI DSS it's not:
The primary account number is the
defining factor in the applicability
of PCI DSS requirements. PCI DSS
requirements ...
4
votes
1answer
152 views
Store To Store communication through MPLS VPN
In a PCI environment with an MPLS VPN network setup should you allow store to store communication?
Do you think that an MPLS network would be consider secure enough for this? why or why not?
9
votes
4answers
588 views
New credit card security standards regarding PA-DSS Compliance
The new credit card standards including PA-DSS can be quite confusing for software companies.
My question is this: If your software company designs a POS software system (like we do) which utilizes ...
2
votes
1answer
422 views
PCI Compliance - If am eligible to self certify - do I need to use a QSA company in this context?
Setting up a new company with ecommerce app, and looking at PCI compliance.
What I need to know is if I need to use a pci security assessor to verify the answers to the self assessment questionnaire?
...
7
votes
1answer
808 views
Is there a way for a consumer to report PCI non compliance?
Is there a way for a consumer to report PCI non compliance?
4
votes
2answers
377 views
How to submit credit card info to a separate server/website (PCI)
My company has a website/service that stores/processes credit cards and is PCI compliant (Site A). We also have websites with storefronts that need to submit credit card data to that site for ...
17
votes
4answers
1k views
Why doesn't the client's web browser need to be PCI compliant?
A hypothetical online store that accepts credit card payment will have to be PCI compliant because it receives (transmit), process and possibly store credit card numbers.
But the client's web browser ...
5
votes
1answer
314 views
Does PA-DSS apply to a SaaS eCommerce system?
My company develops and hosts a custom eCommerce and CMS system. We provide this only under a hosted, software-as-a-service model. We are in full control of the hosting environment, and our customers ...
7
votes
4answers
1k views
Is Facebook Connect or Twitter OAuth PCI Compliant?
We have a system that stores credit cards securely on file. We'd love to allow users to sign up using Facebook Connect or Twitter.
Obviously this wouldn't be secure if we were trusting just any old ...
3
votes
2answers
291 views
Which PCI SAQ would you say to use if you are neither a merchant nor service provider?
Low down: This client does zero with credit card data (no processing, no passing of it, nothing), but they do have a device often placed on the same network segment of a POS (Point of sale) system.
...
12
votes
3answers
2k views
Nessus vs third-party scans
As part of our PCI-DSS compliance process we get scans done by a third party. Based on the form and wording of the output, it's pretty clear they're using Nessus for most of their heavy lifting. Same ...
20
votes
5answers
2k views
PCI Encryption Key Management
(Full disclosure: I'm already an active participant here and at StackOverflow, but for reasons that should hopefully be obvious, I'm choosing to ask this particular question anonymously).
I currently ...
9
votes
2answers
468 views
logging requirements for PCI for web applications
Does PCI dictate how much should be logged at an application level or simply what shouldn't be logged?
I'm struggling with too much logging right now and some people who think we should have it. From ...
7
votes
3answers
175 views
Securing an E-commerce site
I'm building a custom e-commerce site, and the user will input their credit card details on the site instead of being directed to the payment gateway's site.
I'm confused as to what the critical ...
17
votes
5answers
730 views
Does PCI compliance really reduce risk and improve security?
Might as well bring this hot topic to here!
For those not in the know: https://www.pcisecuritystandards.org/
7
votes
4answers
388 views
Wireless Activity Monitoring for PCI DSS Compliance
In an effort to be PCI DSS compliant, I took a trustkeeper.net questionnaire. I failed the question that asks
Is the presence of wireless access points tested for by using a wireless analyzer at ...
