An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

learn more… | top users | synonyms

4
votes
1answer
2k views

How to decrypt the Encrypted DEK using KEK which are separated in servers?

Decrypting the DEK using KEK under PCI-Standards, which are separated by Servers: Let say for example we have server1 and server2 Server1: It is in East US, called it as Application Server. ...
4
votes
1answer
662 views

PCI-DSS Network Segmentation and encrypted administrative interfaces

I'm using the 3/2/1 network segmentation model from the open pci dss scoping toolkit and I'm running into a bit of a mental roadblock. I have a phone system (Mitel 5000 series, if it matters) that is ...
4
votes
1answer
987 views

Help understanding PCI-DSS when using password based encryption from automatically generated keys

I've inherited the task of self-auditing an e-commerce system for compliance with the PCI-DSS. We are storing the PAN in our database in encrypted form using 256 bit AES algorithm to do the ...
4
votes
3answers
5k views

PCI-DSS compliance for business with only swipe terminals

I support the IT infrastructure for a small retail business which is now required to undergo a PCI-DSS assessment. The payment service and terminal provider (Streamline) has asked that we use ...
4
votes
1answer
304 views

Using EventStore For PCI Compliance?

I have been hearing a lot of good things about EventStore 3 and am looking to upgrade my server event forwarding systems for PCI compliance next year and was wondering if anyone had looked at the ...
4
votes
1answer
121 views

Using Google Cloud Platform to store credit card data

I have made an iPhone app for users to book hotel rooms. A third party provides the service for booking the hotel rooms and charging the credit cards. At the moment, my app makes no attempt to save ...
4
votes
3answers
183 views

Tools to demonstrate NO storage of cardholder data

Our organization has been asked to comply with PCI DSS. As part of IT Department, we need to demonstrate that none of our IT infrastructure stores any carhdolder data nor sensitive authetication ...
4
votes
1answer
3k views

Credit card data security - hashing, truncation and encryption

A question with a similar title has been asked before, but it doesn't answer my specific question here. PCI DSS permits storage of truncated and encrypted data, or hashed and encrypted data. It ...
4
votes
1answer
724 views

PCI-DSS Compliance Management Software?

Does anyone know of PCI compliance management software (specifically PA-DSS, but I'm assuming any kind of PCI-DSS software will do PA-DSS)? Mainly for our application end. We have a 3rd party site but ...
4
votes
3answers
170 views

Dealing with credit card data that is not charged directly

I have a client who is a reseller for vacation packages. For years they've had a payment form on their site where the end user would fill out their credit card data and the information is emailed to ...
3
votes
4answers
3k views

Storing CVC / CVV / CVV2 until payment is processed

I need to store the payment info of a transaction. We have a script that reads which transactions haven't yet been sent to our ERP (the business management software), to then send it. This script ...
3
votes
3answers
1k views

PCI DSS - only one primary function per server

The PCI DSS says that a server can have only one primary function and i'm a little confused over what it means by 'one primary function' we have a webserver with database - web pages and email is ...
3
votes
2answers
102 views

How much security information to publicise?

Apologies if this in the wrong section, not sure if it should go in Server Fault or not. I am preparing to launch a new web app. We have put a lot of effort into offering good security. From a PR ...
3
votes
2answers
1k views

Payment gateway integration, any security considerations?

I'm interested in understanding what security considerations there are around implementing a payment gateway. I have, so far, thought of: having a SSL Cert is a MUST. logging actions is critical. ...
3
votes
2answers
422 views

Verifying credit card ownership

When a fraudulent credit card CNP (Card Not Present) transaction is made, merchant is liable for the chargeback. For that reason, our company implemented a policy where we ask a photo of customer's ...
3
votes
4answers
347 views

Risk management with software code analysis

I am a programmer by day and I am working on a project that is focused around risk management based on PCI-DSS controls within an organisation. I have been thinking lately that a lot of PCI-DSS ...
3
votes
3answers
207 views

Does requiring users to fill out a PDF w/ CC information and mail it back violate PCI compliance?

I'm attempting to place an order with an American company and I reside outside of America. Upon placing the order (and already submitting payment) I received an email asking me to fill out a PDF ...
3
votes
2answers
1k views

Can we print cardholder data under the PCI DSS Compliance framework and stay compliant?

I have a question regarding PCI compliance. There seems to be a valid business need in our company to keep some card holder data, for unsuccessful transaction. An example would be a customer makes a ...
3
votes
3answers
161 views

Credit card processing in mobile app over Stripe - PCI DSS compiant?

after reading a lot of PCI DSS stuff I'm still not sure whether it would be ok for us to use the following process in our app: Get full credit card data from attached card reader Tokenize it using ...
3
votes
2answers
2k views

IS TDE PCI-Compliant?

According to PCI PAN can be stored in the database as long as strong cryptography is used. I couldn't find which cryptography is considered strong according to PCI. Here's the issue: I have PAN ...
3
votes
3answers
2k views

Self Tests for cPanel Server PCI Compliance

(Edited & added more information at the bottom of this question) I've been tasked with "testing" a client's Linux web servers, running cPanel (which they own and mostly manage, until they come to ...
3
votes
3answers
345 views

Where's the security when a payment gateway let website handle Credit Card detail

Has anyone worked with eWay payment gateway before? Basically, there's a service endpoint where you post the customer's detail and credit card details from the web application after the browser sends ...
3
votes
1answer
322 views

card.io & PCI DSS v3.0

I've researched for quite some time now, but I cannot find an answer to this question: If I touch card holder data in any way, I need PCI DSS v3.0 SAQ A-EP certification, which is quite complex to ...
3
votes
3answers
1k views

PCI DSS 2.0 and ssh keys

I know the real answer to the auditor. We are a smaller company under 40 total employees that is also PCI level 1 compliant. We've always used ssh keys on internal servers. You can't ssh in from the ...
3
votes
2answers
3k views

Effective wireless scanning to meet PCI DSS 11.1?

PCI-DSS section 11.2 requires the business to "Test for the presence of wireless access points and detect unauthorized wireless access points". However, this is more easily said than done. Simply ...
3
votes
5answers
565 views

PCI-DSS and salt storage

PCI-DSS states the following: 3.5 Protect any keys used to secure cardholder data against disclosure and misuse I have a service which stores a salted bcrypt hash of the user's PAN. Assuming the ...
3
votes
1answer
43 views

PCI DSS compliant without private VLAN

I understand that it may be a best practice to hide in-PCI-scope-elements like databases inside a VLAN without a public address and also strict firewall rules. However, my questions is: can ...
3
votes
1answer
837 views

Is there a way to process a credit card transaction asychronously and be PCI compliant?

If I had to store credit card details temporarily to shove it to the processor using an asychronous worker, I know that that information must be encrypted. To get it to the worker, however, it must ...
3
votes
1answer
519 views

PCI compliance simple questions

For now I read PCI compliance document and I don't understand any things. I have a program, which takes sensitive and cardholder data as input (some of them are in encrypted form) and then returned ...
3
votes
1answer
267 views

Do I need to purchase a PCI DSS certificate?

I'm creating an e-commerce website and I was wondering, do I need to purchase a PCI DSS certificate or do I just need to comply with the standards?
3
votes
1answer
433 views

Hybrid key management doing it wrong?

I'm currently working on a project that needs be as secure as possible key-management. My experience with encryption, decryption and key-management are none whatsoever so i did some research on the ...
3
votes
3answers
4k views

Any place where I can find some template or base documents for IT/Infosec Compliance?

We're facing an audit and we are sorely lacking in documentation regarding information security policies. I've done some Googling and have been surprised by the difficulty of finding a good "template" ...
3
votes
1answer
445 views

POS still PCI compliant after Single Sign-on?

I have a Point of Sale System that's a web application. I also have a separate reporting system that's a web application and a separate inventory system that's a web application. It's necessary to use ...
3
votes
3answers
403 views

Should I disable TLS 1.0 on my servers?

The PCI Data Security Standard 3.1 recommends disabling "early TLS" along with SSL: SSL and early TLS are not considered strong cryptography and cannot be used as a security control after June 30, ...
3
votes
3answers
111 views

Third party analytics/tracking javascript tags and PCI DSS

Although variants of this question have been asked before, they seem to be about general risk, and I'm interested in the PCI DSS connotations. If an e-commerce site is looking for level 1 or level 2 ...
3
votes
3answers
124 views

PCI scanning and penetration testing

We are moving a web app from an internal merchant hosted setup to a general service we can offer to other organisations. The actual credit card data handling is done by a level 1 PCI compliant third ...
3
votes
2answers
68 views

Why are there questions about “media” in a PCI-DSS SAQ A?

The PCI-DSS SAQ A is used in the case where all payments are outsourced to an external vendor (conditions apply). Despite that, section 9 of the questionnaire is about "media" (if they are physically ...
3
votes
3answers
238 views

How is truncation according to PCI DSS secure?

In section 3.3 of the PCI standard, it says that when displaying PANs, limiting visibility to the first 6 and last 4 digits of the PAN is considered secure. Doing some quick math, on a 16 digit PAN, ...
3
votes
1answer
204 views

Level 4 merchants becoming PCI Compliant

I was prompted recently to take a deeper look into some of the PCI requirement information, and I have found some pretty serious discrepancies with regard to the reporting obligations of Level 4 ...
3
votes
1answer
594 views

Is it safe to save customer information from Stripe? Do we need to be PCI compliant?

Following their tutorial, Stripe allows to save customer and charge them later. But, does one have to be PCI compliant? In their API Reference, it seems they give lot of information to be stored ...
3
votes
2answers
886 views

Does PCI ban using MD5 to store sensitive data?

Just had a vendor tell me that because their PCI auditors did not recommend banning the use of unsalted MD5 to store sensitive data at this time with with their current level of PCI compliance that ...
3
votes
2answers
748 views

What should I have prepared for a PCI compliance onsite assessment?

The company I'm working for is about the undergo PCI compliance onsite assessment. The PCI DSS has a kind of checklist, but it is all very vague and abstract to me. So I'm not quite sure what I need ...
3
votes
2answers
3k views

How to satisfy requirement 10.6 of PCI DSS?

The company I'm working for is applying for PCI compliance and I'm in charge of writing most of the required procedures and policies. The problem is that I don't have any experience with IT security, ...
3
votes
2answers
262 views

CVE-2012-4448 pci-scan

I'm currently failing a PCI scan due to CVE-2012-4448 The recommended resolution from Security Metrics is to upgrade to a wordpress version higher than 3.4.2, however currently that is the highest ...
3
votes
3answers
203 views

If I host a web form which submits CC details to a provider, are there PCI implications form host?

I'm wondering if anyone has any thoughts on a specific question I have. I read a lot about systems that 'store, process, submit' CC data requiring compliance. If I host a form on my website which ...
3
votes
1answer
322 views

Payment security on Android App

I am developing an application from which users browse and buy books. The client can be Android ,iOS, Mac. The server is ASP.net Web APIs. I know there are many payment services available. One of ...
3
votes
1answer
303 views

PCI Compliance guidance

I am in the middle of setting up an ecommerce solution on a commercial website. My system will store card number in the form of : xxxx-xxxx-xxxx-4000 (just the last 4 digits) and XXX (nothing) for the ...
3
votes
3answers
349 views

Are credit card number look ups more secure with a hash function than with a deterministic encryption algorithm?

I understand PCI DSS 3.0 allows hashes of cardnumbers to be stored separately from encrypted values, but I'm startled at the efficiency of tools like hashcat in discovering card numbers from hashed ...
3
votes
3answers
286 views

What is the job of an IT auditor?

I am going through training in information security, as a part of the course they included compliance standards like: PCI DSS ISO 27001-2005 Cobit framework So after searching over Google, I came ...
3
votes
2answers
319 views

How can I report an ecommerce site in violation of security practices?

I ordered a product from a website and found that their invoice display page is completely un-protected with the order id in the query string and merely incrementing the number exposes every order. ...