An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

learn more… | top users | synonyms

3
votes
2answers
921 views

Secure Mobile Payments using HTTPS Web App

I'm hoping an expert with PCI compliance knowledge can help answer this question. We're looking at integrating mobile payments with our application which is HTML5-based for cross-platform reasons. ...
3
votes
1answer
5k views

SSL certificate fails to adhere to basic constraints and PCI compliance

We have an SSL cert from GoDaddy and tried to run a PCI compliance check using McAfee's scan. The one problem they found was that the basic constraints / path length is not configured. Here's what ...
3
votes
3answers
920 views

PCI DSS 2.0 and ssh keys

I know the real answer to the auditor. We are a smaller company under 40 total employees that is also PCI level 1 compliant. We've always used ssh keys on internal servers. You can't ssh in from the ...
3
votes
1answer
743 views

Is there a way to process a credit card transaction asychronously and be PCI compliant?

If I had to store credit card details temporarily to shove it to the processor using an asychronous worker, I know that that information must be encrypted. To get it to the worker, however, it must ...
3
votes
1answer
462 views

PCI compliance simple questions

For now I read PCI compliance document and I don't understand any things. I have a program, which takes sensitive and cardholder data as input (some of them are in encrypted form) and then returned ...
3
votes
1answer
262 views

Do I need to purchase a PCI DSS certificate?

I'm creating an e-commerce website and I was wondering, do I need to purchase a PCI DSS certificate or do I just need to comply with the standards?
3
votes
1answer
408 views

Hybrid key management doing it wrong?

I'm currently working on a project that needs be as secure as possible key-management. My experience with encryption, decryption and key-management are none whatsoever so i did some research on the ...
3
votes
1answer
378 views

POS still PCI compliant after Single Sign-on?

I have a Point of Sale System that's a web application. I also have a separate reporting system that's a web application and a separate inventory system that's a web application. It's necessary to use ...
3
votes
3answers
101 views

How is truncation according to PCI DSS secure?

In section 3.3 of the PCI standard, it says that when displaying PANs, limiting visibility to the first 6 and last 4 digits of the PAN is considered secure. Doing some quick math, on a 16 digit PAN, ...
3
votes
1answer
163 views

Level 4 merchants becoming PCI Compliant

I was prompted recently to take a deeper look into some of the PCI requirement information, and I have found some pretty serious discrepancies with regard to the reporting obligations of Level 4 ...
3
votes
1answer
449 views

Is it safe to save customer information from Stripe? Do we need to be PCI compliant?

Following their tutorial, Stripe allows to save customer and charge them later. But, does one have to be PCI compliant? In their API Reference, it seems they give lot of information to be stored ...
3
votes
2answers
719 views

Does PCI ban using MD5 to store sensitive data?

Just had a vendor tell me that because their PCI auditors did not recommend banning the use of unsalted MD5 to store sensitive data at this time with with their current level of PCI compliance that ...
3
votes
2answers
627 views

What should I have prepared for a PCI compliance onsite assessment?

The company I'm working for is about the undergo PCI compliance onsite assessment. The PCI DSS has a kind of checklist, but it is all very vague and abstract to me. So I'm not quite sure what I need ...
3
votes
2answers
3k views

How to satisfy requirement 10.6 of PCI DSS?

The company I'm working for is applying for PCI compliance and I'm in charge of writing most of the required procedures and policies. The problem is that I don't have any experience with IT security, ...
3
votes
2answers
256 views

CVE-2012-4448 pci-scan

I'm currently failing a PCI scan due to CVE-2012-4448 The recommended resolution from Security Metrics is to upgrade to a wordpress version higher than 3.4.2, however currently that is the highest ...
3
votes
3answers
168 views

If I host a web form which submits CC details to a provider, are there PCI implications form host?

I'm wondering if anyone has any thoughts on a specific question I have. I read a lot about systems that 'store, process, submit' CC data requiring compliance. If I host a form on my website which ...
3
votes
1answer
302 views

Payment security on Android App

I am developing an application from which users browse and buy books. The client can be Android ,iOS, Mac. The server is ASP.net Web APIs. I know there are many payment services available. One of ...
3
votes
1answer
294 views

PCI Compliance guidance

I am in the middle of setting up an ecommerce solution on a commercial website. My system will store card number in the form of : xxxx-xxxx-xxxx-4000 (just the last 4 digits) and XXX (nothing) for the ...
3
votes
3answers
2k views

Any place where I can find some template or base documents for IT/Infosec Compliance?

We're facing an audit and we are sorely lacking in documentation regarding information security policies. I've done some Googling and have been surprised by the difficulty of finding a good "template" ...
3
votes
1answer
173 views

Is Heroku PCI Compliant?

Obviously Heroku wants you to think they're PCI compliant by telling you "Heroku’s infrastructure provider is PCI Level 1 compliant" (AWS). https://www.heroku.com/policy/security But since Heroku ...
3
votes
3answers
270 views

Are credit card number look ups more secure with a hash function than with a deterministic encryption algorithm?

I understand PCI DSS 3.0 allows hashes of cardnumbers to be stored separately from encrypted values, but I'm startled at the efficiency of tools like hashcat in discovering card numbers from hashed ...
3
votes
3answers
231 views

What is the job of an IT auditor?

I am going through training in information security, as a part of the course they included compliance standards like: PCI DSS ISO 27001-2005 Cobit framework So after searching over Google, I came ...
3
votes
3answers
3k views

Effective wireless scanning to meet PCI DSS 11.1?

PCI-DSS section 11.2 requires the business to "Test for the presence of wireless access points and detect unauthorized wireless access points". However, this is more easily said than done. Simply ...
3
votes
2answers
286 views

How can I report an ecommerce site in violation of security practices?

I ordered a product from a website and found that their invoice display page is completely un-protected with the order id in the query string and merely incrementing the number exposes every order. ...
3
votes
2answers
1k views

The point of PCI 1.3.1 through 1.3.3

In expansion to my previous question what qualifies as public access? I'm trying to wrap my head around the intent of the points 1.3.1 and 1.3.2 and 1.3.3 of the PCI standard. I have four DMZs at my ...
3
votes
2answers
374 views

Which PCI SAQ would you say to use if you are neither a merchant nor service provider?

Low down: This client does zero with credit card data (no processing, no passing of it, nothing), but they do have a device often placed on the same network segment of a POS (Point of sale) system. ...
3
votes
1answer
37 views

PCI DSS 3.0, 11.3 - What happens if a low risk vulnerability prevents compliance with another requirement?

As I understand the PCI DSS 3.0/3.1 penetration testing requirements, a company is compliant with 11.3 if the penetration test does not return any high risk vulnerabilities. However, what happens if ...
3
votes
1answer
114 views

How can a very small company handle PCI-DSS requirement 6.4.2?

PCI-DSS 3 requirement 6.4.2 calls for Separation of duties between development/test and production environments. Based on the guidance text and this, answer to another question, it appears ...
3
votes
1answer
1k views

How to decrypt the Encrypted DEK using KEK which are separated in servers?

Decrypting the DEK using KEK under PCI-Standards, which are separated by Servers: Let say for example we have server1 and server2 Server1: It is in East US, called it as Application Server. ...
3
votes
2answers
1k views

PCI DSS 11.2.1/11.2.3 - Internal scans scope

I need help about SAQ #C - Are quarterly internal vulnerability scans performed? What is target (scope) for those internal scans? Our configuration: Router with modem (WAN1/LAN1), DMZ, some office ...
3
votes
1answer
86 views

What's the advantage of passing credit cards via javascript vs. over the server (without saving it)?

I've noticed current credit card gateways like stripe and wepay encourage sending the credit card number via their js framework (which would use some iframe jsonp magic to pass the data). To my ...
3
votes
2answers
93 views

Backup procedure for PCI

Our company is does not store any credit card details but we do transmit them. We are storing it in a cloud platform which is already PCI compliant. We just require to access the Cloud portal from ...
3
votes
1answer
829 views

Is RDP susceptible to the BEAST attack?

I have Windows 2008 R2 servers which are failing a PCI vulnerability scan because they have RDP enabled (needs to be disabled). I have applied the PCI settings of IISCrypto tool, but I have to leave ...
3
votes
2answers
298 views

PCI DSS - mask PAN and log individual access to PAN

How do you re-conciliate two PCI DSS requirements in applications: 3.3 Mask PAN when displayed (the first six and last four digits are the maximum number of digits to be displayed), such that only ...
3
votes
2answers
108 views

Legacy system PCI Compliance

I have a legacy system that collects and stores credit card numbers ( BAD! ). We are in the process of replacing that system in phases. We are going to integrate with a credit card processing system ...
3
votes
2answers
339 views

Backup server categorization in the Open PCI Scoping Toolkit

How are backup servers which host a copy of cardholder data supposed to be categorized according to the Open PCI Scoping Toolkit, given that the backup and storage guidelines from the PCI standards ...
2
votes
2answers
1k views

Why does Amazon ask for the CVC/CVV if it bills without it?

I have a follow-up question relating to this question: How does Amazon bill me wihout the CVC / CVV / CVV2? If amazon.com can bill without the CVV why does it ask for it the first time information ...
2
votes
3answers
1k views

Vulnerability scanning applicability for PCI DSS

I'm fully up to speed on PCI DSS requirements and have attend the ISA course recently. The course was helpful and I was able to bounce ideas off of the trainer. However I keep coming back to one ...
2
votes
3answers
505 views

Client is not storing Credit Cards Securily (near plain text). How do I convince client to be more secure?

I am writing in regards to PCI-DSS compliance for taking credit cards. A client of mine is not willing / does not want to bump up security beyond what is currently done for their credit card data. All ...
2
votes
3answers
103 views

Businesses Handling Credit Cards via Email

I have done some I.T. contracting for a medium-sized Australian hotel recently. I am concerned about their credit card handling practices. Customers often email their CC number and expiry date in ...
2
votes
2answers
1k views

What are the insecure Protocols in terms of PCI DSS

What are the insecure protocols which should be disabled according to PCI DSS standard. How to check those are disabled in Firewalls and Servers.
2
votes
2answers
2k views

IS TDE PCI-Compliant?

According to PCI PAN can be stored in the database as long as strong cryptography is used. I couldn't find which cryptography is considered strong according to PCI. Here's the issue: I have PAN ...
2
votes
2answers
1k views

PCI Compliance network scope

I was wondering if anyone could clarify the scope of PCI compliance with regard to multiple networks. At present, there's one PCI compliant network to which another network connects via VPN. The PCI ...
2
votes
2answers
1k views

If am using Stripe am I SAQ A-EP in PCI V3

We are going through the PCI process at the moment and because v2 goes out of date on December 2014, I opted to use PCI v3. Because with Stripe you put the form inside your application and post to ...
2
votes
3answers
110 views

Are there any reasons to be concerned about the security of “Coin”? [duplicate]

I just came across this: https://onlycoin.com/ A credit-card sized device that not only holds the info for as many credit and debit and membership cards as you want (they claim) but also can ...
2
votes
3answers
286 views

PCI Compilance - Custom payment processor

Consider following situation: We have location A where we have our online store. We have location B where we have payment processing. Server is dedicated to do only payment processing jobs We can ...
2
votes
1answer
151 views

card.io & PCI DSS v3.0

I've researched for quite some time now, but I cannot find an answer to this question: If I touch card holder data in any way, I need PCI DSS v3.0 SAQ A-EP certification, which is quite complex to ...
2
votes
4answers
2k views

Storing CVC / CVV / CVV2 until payment is processed

I need to store the payment info of a transaction. We have a script that reads which transactions haven't yet been sent to our ERP (the business management software), to then send it. This script ...
2
votes
2answers
2k views

What level of PCI Compliance do I need to adhere to if I do not store, but transmit data?

I'm doing a bit of research on my level of PCI compliance, and I'm having a difficult time grasping where I'm supposed to be. I have a web service that has recurring billing. The site is created ...
2
votes
2answers
2k views

Credit card storage, hashes, truncation, encrypted data

I'm trying to figure out a way to meet multiple business requirements that don't seem to go well in hand in terms of security: store encrypted card data associated with customer accounts for ...