An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

learn more… | top users | synonyms

3
votes
1answer
288 views

PCI Compliance guidance

I am in the middle of setting up an ecommerce solution on a commercial website. My system will store card number in the form of : xxxx-xxxx-xxxx-4000 (just the last 4 digits) and XXX (nothing) for the ...
3
votes
3answers
1k views

Any place where I can find some template or base documents for IT/Infosec Compliance?

We're facing an audit and we are sorely lacking in documentation regarding information security policies. I've done some Googling and have been surprised by the difficulty of finding a good "template" ...
3
votes
3answers
185 views

What is the job of an IT auditor?

I am going through training in information security, as a part of the course they included compliance standards like: PCI DSS ISO 27001-2005 Cobit framework So after searching over Google, I came ...
3
votes
3answers
2k views

Effective wireless scanning to meet PCI DSS 11.1?

PCI-DSS section 11.2 requires the business to "Test for the presence of wireless access points and detect unauthorized wireless access points". However, this is more easily said than done. Simply ...
3
votes
3answers
1k views

Effectively limiting outgoing firewall traffic to frequently-changing IPs

PCI DSS 1.2.1 states: Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment. Verify that all other inbound and outbound traffic is ...
3
votes
2answers
251 views

How can I report an ecommerce site in violation of security practices?

I ordered a product from a website and found that their invoice display page is completely un-protected with the order id in the query string and merely incrementing the number exposes every order. ...
3
votes
2answers
898 views

The point of PCI 1.3.1 through 1.3.3

In expansion to my previous question what qualifies as public access? I'm trying to wrap my head around the intent of the points 1.3.1 and 1.3.2 and 1.3.3 of the PCI standard. I have four DMZs at my ...
3
votes
2answers
315 views

Which PCI SAQ would you say to use if you are neither a merchant nor service provider?

Low down: This client does zero with credit card data (no processing, no passing of it, nothing), but they do have a device often placed on the same network segment of a POS (Point of sale) system. ...
3
votes
1answer
585 views

How to decrypt the Encrypted DEK using KEK which are separated in servers?

Decrypting the DEK using KEK under PCI-Standards, which are separated by Servers: Let say for example we have server1 and server2 Server1: It is in East US, called it as Application Server. ...
3
votes
1answer
451 views

PCI-DSS Network Segmentation and encrypted administrative interfaces

I'm using the 3/2/1 network segmentation model from the open pci dss scoping toolkit and I'm running into a bit of a mental roadblock. I have a phone system (Mitel 5000 series, if it matters) that is ...
3
votes
2answers
829 views

PCI DSS 11.2.1/11.2.3 - Internal scans scope

I need help about SAQ #C - Are quarterly internal vulnerability scans performed? What is target (scope) for those internal scans? Our configuration: Router with modem (WAN1/LAN1), DMZ, some office ...
3
votes
2answers
83 views

Legacy system PCI Compliance

I have a legacy system that collects and stores credit card numbers ( BAD! ). We are in the process of replacing that system in phases. We are going to integrate with a credit card processing system ...
3
votes
1answer
459 views

How can Stripe be PCI-compliant?

According to the Stripe FAQ, they are PCI-compliant. Also, in their API documentation, one of the parameters to create a new card is the CVC (although, granted, it is optional). So, I assume they ...
3
votes
2answers
286 views

Backup server categorization in the Open PCI Scoping Toolkit

How are backup servers which host a copy of cardholder data supposed to be categorized according to the Open PCI Scoping Toolkit, given that the backup and storage guidelines from the PCI standards ...
3
votes
1answer
37 views

Dealing with credit card data that is not charged directly

I have a client who is a reseller for vacation packages. For years they've had a payment form on their site where the end user would fill out their credit card data and the information is emailed to ...
2
votes
2answers
1k views

Why does Amazon ask for the CVC/CVV if it bills without it?

I have a follow-up question relating to this question: How does Amazon bill me wihout the CVC / CVV / CVV2? If amazon.com can bill without the CVV why does it ask for it the first time information ...
2
votes
3answers
931 views

Vulnerability scanning applicability for PCI DSS

I'm fully up to speed on PCI DSS requirements and have attend the ISA course recently. The course was helpful and I was able to bounce ideas off of the trainer. However I keep coming back to one ...
2
votes
3answers
425 views

Client is not storing Credit Cards Securily (near plain text). How do I convince client to be more secure?

I am writing in regards to PCI-DSS compliance for taking credit cards. A client of mine is not willing / does not want to bump up security beyond what is currently done for their credit card data. All ...
2
votes
2answers
1k views

IS TDE PCI-Compliant?

According to PCI PAN can be stored in the database as long as strong cryptography is used. I couldn't find which cryptography is considered strong according to PCI. Here's the issue: I have PAN ...
2
votes
3answers
918 views

Self Tests for cPanel Server PCI Compliance

(Edited & added more information at the bottom of this question) I've been tasked with "testing" a client's Linux web servers, running cPanel (which they own and mostly manage, until they come to ...
2
votes
2answers
86 views

What are the insecure Protocols in terms of PCI DSS

What are the insecure protocols which should be disabled according to PCI DSS standard. How to check those are disabled in Firewalls and Servers.
2
votes
3answers
109 views

Are there any reasons to be concerned about the security of “Coin”? [duplicate]

I just came across this: https://onlycoin.com/ A credit-card sized device that not only holds the info for as many credit and debit and membership cards as you want (they claim) but also can ...
2
votes
3answers
245 views

PCI Compilance - Custom payment processor

Consider following situation: We have location A where we have our online store. We have location B where we have payment processing. Server is dedicated to do only payment processing jobs We can ...
2
votes
2answers
981 views

PCI Compliance network scope

I was wondering if anyone could clarify the scope of PCI compliance with regard to multiple networks. At present, there's one PCI compliant network to which another network connects via VPN. The PCI ...
2
votes
2answers
1k views

What level of PCI Compliance do I need to adhere to if I do not store, but transmit data?

I'm doing a bit of research on my level of PCI compliance, and I'm having a difficult time grasping where I'm supposed to be. I have a web service that has recurring billing. The site is created ...
2
votes
2answers
175 views

Does requiring users to fill out a PDF w/ CC information and mail it back violate PCI compliance?

I'm attempting to place an order with an American company and I reside outside of America. Upon placing the order (and already submitting payment) I received an email asking me to fill out a PDF ...
2
votes
2answers
2k views

Credit card storage, hashes, truncation, encrypted data

I'm trying to figure out a way to meet multiple business requirements that don't seem to go well in hand in terms of security: store encrypted card data associated with customer accounts for ...
2
votes
1answer
38 views

PCI - prohibiting direct connections to the Cardholder Data Environment

In PCI 1.3.3 it states: Are direct connections prohibited for inbound or outbound traffic between the Internet and the cardholder data environment? A Cardholder Data Environment (CDE) ...
2
votes
2answers
116 views

PCI-DSS Is the infrastructure really in-scope?

Say I have an application that takes credit cards, but this is actually a payment gateway on the internet that I don't control. The web site used HTTPS and only returns if the card was authorized or ...
2
votes
1answer
295 views

Is it OK to generate a token for a credit card without the user's permission? Is that PCI compliant?

Is it PCI compliant to generate a token for every card used for processing, regardless of whether the client asked for his card to be saved or not?
2
votes
3answers
200 views

Do we need to use separate IP ?

I want to open and forward SSH port to one of our internal computers. Problem is - it will use the same IP address as PCI-DSS environment (where the HTTPS payment gatway is running) Basically ...
2
votes
3answers
1k views

Can change management for PCI compliance be accomplished via simple emails?

Item 6.4.5 of PCI DSS requires the following: 6.4.5 Change control procedures for the implementation of security patches and software modifications. Procedures must include the following: ...
2
votes
3answers
277 views

PCI Compliance Problem

My company is trying to become fully PCI Compliant and we are switching our outdated systems to use Authorize.net CIM among other things. But, currently we're all over the place and until our new ...
2
votes
1answer
583 views

PCI Compliance - If am eligible to self certify - do I need to use a QSA company in this context?

Setting up a new company with ecommerce app, and looking at PCI compliance. What I need to know is if I need to use a pci security assessor to verify the answers to the self assessment questionnaire? ...
2
votes
1answer
72 views

Transmitting Credit Card Information

I want to know how secure it is to transmit Credit Card details as plain text to the payment gateway from my website using HTTPS. We are not storing any details in our database but I read that ...
2
votes
1answer
57 views

Handling unencrypted HTTP data for a PCI compliant system - in scope for PCI DSS v3 but not v2?

We currently have a custom, cloud based application that can analyse then route HTTP and HTTPS traffic through to a domain. So if a client wants to use our service, they re-point their DNS to our ...
2
votes
1answer
100 views

How much information is released when paying with a debit card

How much information is released when paying with a debit card? Is it possible for a vendor to grab your name and address from your debit card and send you things in the mail?
2
votes
1answer
248 views

Are these merchant integration instructions wrong about server-client interaction?

I'm working with a payment gateway that seems to have a fundamental misunderstanding of "clients" and how to protect sensitive data. The integration instructions are mostly about a "redirect" mode of ...
2
votes
1answer
261 views

Field-level encryption vs disk encryption for PCI compliance

We are in the process of setting up a PCI compliant server (with Firehost's help). We are using MongoDB as our primary database. I am having some concerns about the encryption, though. Are there any ...
2
votes
2answers
163 views

Is PCI Compliance mandatory?

I recently started working on an eCommerce addition to a site I'm working on.In my research looking for a way to do SSL without a certificate/a free certificate I came across PCI Compliance.I have ...
2
votes
1answer
130 views

After the Cryptoperiod timespan, do we need to encrypt all the data again?

As per PCI-DSS we need to dispose the old keys after the timespan. After the cryptoperiod (lets say one year) time span, do I need to encrypt all (20k card holders) the data once again with the newly ...
2
votes
3answers
208 views

Do I need to be PCI compliant?

We have an internal system and I am trying to determine if the system is in scope for the purposes of PCI-DSS compliance. The system is completely internal, no public access. The system hold user ...
2
votes
1answer
77 views

Internet connection for POS of a Third Part

From time to time, our premises and infrastructure is rented temporally for some conventions/meetings. One of these meetings requires an ordinary POS which would require a phone line or internet ...
2
votes
1answer
476 views

Are banks required to be PCI compliant?

Since credit card transactions like cash advance can be performed at most ATMs, are banks required to be PCI DSS compliant?
2
votes
2answers
169 views

HTML 5 postMessage PCI compliant

We're building an application (App-A) that will allow a user to enter credit card information. This application will live on a non PCI compliant zone. We have another application (App-B) that also ...
2
votes
1answer
309 views

iPhone Credit Card Payment

I am trying to understand what is the best way to implement a credit card payment flow into a native iPhone app. From what I see on the market, most of the apps use a WebView to process the payment. I ...
2
votes
2answers
283 views

PCI Scanning and authenticated user pages

I've just used a security vendor's automated PCI scanning tool to scan my web server. It only has the ability, out of the box, to scan URLs as an un-authenticated user. This means it is only ...
2
votes
1answer
58 views

Conversant, CNAME, Cookies, and PCI complaince

We have been asked to evaluate Conversant Tracking. http://www.conversantmedia.com/solutions/enterprise-solutions From what I can tell its pretty straight forward tracking, like google re-marketing, ...
2
votes
2answers
79 views

Internal Update Server in PCI environment

I am curious to know if we require separate update server in our cloud based PCI environment. In our current setup webserver, appserver, dbserver, logserver, and jump server are independent instance. ...
2
votes
1answer
248 views

Normalizing Windows Advanced Firewall rules

How can I best normalize our Windows Advanced Firewall rules while implementing network segmentation? I want them to be as clear and concise as possible for audit purposes. What few examples I've seen ...