An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.
2
votes
2answers
109 views
Security of asymmetrical decrypting proxy
I'm thinking about the safest possible way to store secure data (eg. Credit Card numbers) with a requirement of sending them in clear text to third party API (so hashing doesn't come into play).
I've ...
1
vote
3answers
238 views
What is the best way to get a third party audit done of website security?
I have a website that needs to be PCI compliant. I have coded it using the guidelines but to be safe i wanted to get a third party audit done where this individual who runs a IT security firm and ...
1
vote
3answers
87 views
Self Tests for cPanel Server PCI Compliance
(Edited & added more information at the bottom of this question)
I've been tasked with "testing" a client's Linux web servers, running cPanel (which they own and mostly manage, until they come to ...
1
vote
1answer
229 views
Hybrid key management doing it wrong?
I'm currently working on a project that needs be as secure as possible key-management. My experience with encryption, decryption and key-management are none whatsoever so i did some research on the ...
1
vote
1answer
108 views
How does a PCI QSA audit a company?
Corporate setups are often complex with data centers in multiple locations, complex ACL's and networks setup between them.
How does a PCI auditor actually audit the systems ?
How does he get to know ...
1
vote
2answers
205 views
PCI prohibit direct outbound connections on EC2
I am using EC2 instances to power our web service that needs to be PCI SAQ-C compliant. I am trying to figure out what point 1.3 of the self assessment really means:
1.3 Does the firewall ...
1
vote
2answers
165 views
Am I a Hosting service provider in a sense of PCI-DSS SAQ D Appendix A?
My company provides web applications to third parties. We develop, host and manage the applications ourselves. All access that third parties get is the application itself and a separate ...
1
vote
1answer
71 views
Requirement 12.1.2 of PCI DSS: Is it enough to point to a standard process?
Item 12.1.2 of PCI DSS requires that the company's security policy:
12.1.2 Includes an annual process that identifies threats, and vulnerabilities, and results in a formal risk assessment.
NIST ...
1
vote
2answers
120 views
“Due diligence” in PCI requirement 12.8.3
Item 12.8.3 from the PCI DSS requires the following:
12.8.3 Ensure there is an established process for engaging service providers including proper due diligence prior to engagement.
What is ...
1
vote
1answer
328 views
Storing only BIN part of PAN, does this qualify as a full PAN?
We are looking at becoming PCI-DSS complaint. We wish to minimize the impact it will have on us and our business. As this can be a very expensive exercise. As I understand it if you do not store ...
1
vote
1answer
323 views
Help with scope clarification of PCI requirement 8.5.15
Section 8.5.15 reads:
If a session has been idle for more than 15 minutes, require the user
to re-enter the password to re-activate the terminal.
Section 8 Accompanying note reads:
These ...
1
vote
2answers
113 views
Configuring IIS SSL for PCI
Is there a clear, concise list of of SSL settings available for IIS which will pass my PCI audit scanning?
Preferably something for both IIS 6 and IIS 7
I'm currently running into BEAST issues but ...
1
vote
1answer
137 views
Which PCI DSS SAQ applies when you don't store store but transmit CHD?
We have a merchant website that uses Authorize.net's AIM. Cardholder data (credit card number, expiration date, etc.) is entered at our website. Then it's transmitted to payment gateway and isn't ...
1
vote
2answers
154 views
Oracle Transparent Data Encryption [closed]
Currently we are using Vormetric for Transparent Data Encryption (TDE) in the Oracle Standard product to satisfy PCI-DSS 2.0 requirements. Does anyone have experience with other third party solutions ...
0
votes
2answers
235 views
Is this way of using Authorize.net's CIM PCI compliant?
We have a webapp where Authorize.NET's CIM and AIM are used for payment operations. When user buys something at first time he enters his CC number and other billing information at our site. This ...
0
votes
3answers
231 views
What is the most cost effective way to comply with PCI requirement 6.5, developer training?
We are a small company that is coming increasingly under pressure to be PCI complaint.
Our main product is an API that move cardholder data between a customer and a supplier. I am in the process of ...
0
votes
2answers
222 views
How to safely collect bank account from website?
I want to collect bank account information from my customers on my website.
I'd like to do that through a form, then I will download it to a PC, print it, and then delete it from the website. Or ...
0
votes
5answers
179 views
PCI Policy Management software?
I am working on a project to get our company PCI Compliant. One of the key issues I face is managing PCI/Security policies in the organisation.
I am responsible for creating the policies and ...
0
votes
1answer
94 views
PCI onsite QSA Audit Review
Has anyone had any success using video recordings from ObserveIT during a PCI onsite QSA audit review? We are scheduled to be audited in a few months and are considering adding ObserveIT to ...
0
votes
2answers
97 views
Senario:SSL Enabled Online Banking Application. Question: Should card numbers be provided back to a user un-masked, when there is a failed login?
For an online banking application with SSL enabled, should card numbers be provided back to the user unmasked, when there is a failed login.
Would this be a violation of PCI DSS 3.3 or not as the ...
0
votes
1answer
55 views
PCI payment gateway and store [duplicate]
Consider situation:
I made my own payment gateway and it passes vulnerabity tests.
My store redirects to this payment gateway. Card details is collected there. Payment is processed there (not ...
0
votes
1answer
69 views
Precedent for an in-house cardholder information server?
My organization is undertaking a project to attempt to reduce the amount of our infrastructure covered under PCI scope. Specifically, we're looking to exclude our web merchandising software from PCI ...
0
votes
1answer
103 views
PCI-DSS for VX570 and POS on same network
Have a Point-of-sale (POS) workstation and a VX570 credit card terminal connected via RS232 and both on the same network with internet connection. No card data is transfered to the POS except for ...
0
votes
1answer
115 views
How much does network security audit and patch work? [closed]
how much is reasonable if i'm looking to hire someone FULL TIME to handle security auditing and patching for my network? I need my network to be PCI Compliance and what not as well. MY office have ...
0
votes
0answers
52 views
vendors for internal PCI scan for linux [closed]
Does anybody have a good recommendation for a vendor or software that I can use to comply with PCI internal vulnerability scan requirements?
0
votes
2answers
175 views
Signing up on a paid site with a credit card
I'm building a subscription-based website that needs to accept recurring payments. The concept is much like that of Netflix, but there is also a variation between the two.
When a user attempts to ...
