An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

learn more… | top users | synonyms

3
votes
2answers
221 views

Backup server categorization in the Open PCI Scoping Toolkit

How are backup servers which host a copy of cardholder data supposed to be categorized according to the Open PCI Scoping Toolkit, given that the backup and storage guidelines from the PCI standards ...
2
votes
2answers
92 views

How much security information to publicise?

Apologies if this in the wrong section, not sure if it should go in Server Fault or not. I am preparing to launch a new web app. We have put a lot of effort into offering good security. From a PR ...
2
votes
2answers
836 views

Why does Amazon ask for the CVC/CVV if it bills without it?

I have a follow-up question relating to this question: How does Amazon bill me wihout the CVC / CVV / CVV2? If amazon.com can bill without the CVV why does it ask for it the first time information ...
2
votes
2answers
310 views

What type of PCI Compliance do I need if I don't hold any card data

I am working with a company that is "PCI Compliant" and in order for them to give me any of their data (customer name, email) they ask that I be "PCI Compliant" even though this data is not credit ...
2
votes
3answers
309 views

Client is not storing Credit Cards Securily (near plain text). How do I convince client to be more secure?

I am writing in regards to PCI-DSS compliance for taking credit cards. A client of mine is not willing / does not want to bump up security beyond what is currently done for their credit card data. All ...
2
votes
2answers
556 views

IS TDE PCI-Compliant?

According to PCI PAN can be stored in the database as long as strong cryptography is used. I couldn't find which cryptography is considered strong according to PCI. Here's the issue: I have PAN ...
2
votes
3answers
534 views

Self Tests for cPanel Server PCI Compliance

(Edited & added more information at the bottom of this question) I've been tasked with "testing" a client's Linux web servers, running cPanel (which they own and mostly manage, until they come to ...
2
votes
3answers
669 views

Vulnerability scanning applicability for PCI DSS

I'm fully up to speed on PCI DSS requirements and have attend the ISA course recently. The course was helpful and I was able to bounce ideas off of the trainer. However I keep coming back to one ...
2
votes
3answers
103 views

Are there any reasons to be concerned about the security of “Coin”? [duplicate]

I just came across this: https://onlycoin.com/ A credit-card sized device that not only holds the info for as many credit and debit and membership cards as you want (they claim) but also can ...
2
votes
3answers
196 views

PCI Compilance - Custom payment processor

Consider following situation: We have location A where we have our online store. We have location B where we have payment processing. Server is dedicated to do only payment processing jobs We can ...
2
votes
2answers
789 views

PCI Compliance network scope

I was wondering if anyone could clarify the scope of PCI compliance with regard to multiple networks. At present, there's one PCI compliant network to which another network connects via VPN. The PCI ...
2
votes
2answers
167 views

Does requiring users to fill out a PDF w/ CC information and mail it back violate PCI compliance?

I'm attempting to place an order with an American company and I reside outside of America. Upon placing the order (and already submitting payment) I received an email asking me to fill out a PDF ...
2
votes
2answers
1k views

Credit card storage, hashes, truncation, encrypted data

I'm trying to figure out a way to meet multiple business requirements that don't seem to go well in hand in terms of security: store encrypted card data associated with customer accounts for ...
2
votes
2answers
75 views

PCI-DSS Is the infrastructure really in-scope?

Say I have an application that takes credit cards, but this is actually a payment gateway on the internet that I don't control. The web site used HTTPS and only returns if the card was authorized or ...
2
votes
1answer
180 views

Is it OK to generate a token for a credit card without the user's permission? Is that PCI compliant?

Is it PCI compliant to generate a token for every card used for processing, regardless of whether the client asked for his card to be saved or not?
2
votes
3answers
168 views

Do we need to use separate IP ?

I want to open and forward SSH port to one of our internal computers. Problem is - it will use the same IP address as PCI-DSS environment (where the HTTPS payment gatway is running) Basically ...
2
votes
3answers
684 views

Can change management for PCI compliance be accomplished via simple emails?

Item 6.4.5 of PCI DSS requires the following: 6.4.5 Change control procedures for the implementation of security patches and software modifications. Procedures must include the following: ...
2
votes
3answers
222 views

PCI Compliance Problem

My company is trying to become fully PCI Compliant and we are switching our outdated systems to use Authorize.net CIM among other things. But, currently we're all over the place and until our new ...
2
votes
1answer
529 views

PCI Compliance - If am eligible to self certify - do I need to use a QSA company in this context?

Setting up a new company with ecommerce app, and looking at PCI compliance. What I need to know is if I need to use a pci security assessor to verify the answers to the self assessment questionnaire? ...
2
votes
3answers
910 views

Effectively limiting outgoing firewall traffic to frequently-changing IPs

PCI DSS 1.2.1 states: Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment. Verify that all other inbound and outbound traffic is ...
2
votes
1answer
190 views

Are these merchant integration instructions wrong about server-client interaction?

I'm working with a payment gateway that seems to have a fundamental misunderstanding of "clients" and how to protect sensitive data. The integration instructions are mostly about a "redirect" mode of ...
2
votes
3answers
514 views

Any place where I can find some template or base documents for IT/Infosec Compliance?

We're facing an audit and we are sorely lacking in documentation regarding information security policies. I've done some Googling and have been surprised by the difficulty of finding a good "template" ...
2
votes
2answers
61 views

Is PCI Compliance mandatory?

I recently started working on an eCommerce addition to a site I'm working on.In my research looking for a way to do SSL without a certificate/a free certificate I came across PCI Compliance.I have ...
2
votes
1answer
98 views

After the Cryptoperiod timespan, do we need to encrypt all the data again?

As per PCI-DSS we need to dispose the old keys after the timespan. After the cryptoperiod (lets say one year) time span, do I need to encrypt all (20k card holders) the data once again with the newly ...
2
votes
3answers
187 views

Do I need to be PCI compliant?

We have an internal system and I am trying to determine if the system is in scope for the purposes of PCI-DSS compliance. The system is completely internal, no public access. The system hold user ...
2
votes
1answer
72 views

Internet connection for POS of a Third Part

From time to time, our premises and infrastructure is rented temporally for some conventions/meetings. One of these meetings requires an ordinary POS which would require a phone line or internet ...
2
votes
1answer
349 views

Are banks required to be PCI compliant?

Since credit card transactions like cash advance can be performed at most ATMs, are banks required to be PCI DSS compliant?
2
votes
2answers
139 views

HTML 5 postMessage PCI compliant

We're building an application (App-A) that will allow a user to enter credit card information. This application will live on a non PCI compliant zone. We have another application (App-B) that also ...
2
votes
1answer
286 views

iPhone Credit Card Payment

I am trying to understand what is the best way to implement a credit card payment flow into a native iPhone app. From what I see on the market, most of the apps use a WebView to process the payment. I ...
2
votes
2answers
247 views

PCI Scanning and authenticated user pages

I've just used a security vendor's automated PCI scanning tool to scan my web server. It only has the ability, out of the box, to scan URLs as an un-authenticated user. This means it is only ...
2
votes
1answer
213 views

Normalizing Windows Advanced Firewall rules

How can I best normalize our Windows Advanced Firewall rules while implementing network segmentation? I want them to be as clear and concise as possible for audit purposes. What few examples I've seen ...
2
votes
2answers
133 views

Security of asymmetrical decrypting proxy

I'm thinking about the safest possible way to store secure data (eg. Credit Card numbers) with a requirement of sending them in clear text to third party API (so hashing doesn't come into play). I've ...
1
vote
3answers
322 views

What is the best way to get a third party audit done of website security?

I have a website that needs to be PCI compliant. I have coded it using the guidelines but to be safe i wanted to get a third party audit done where this individual who runs a IT security firm and ...
1
vote
3answers
120 views

Are there any security related rules in PCI-DSS that govern when I can capture a payment?

Is there a PCI-DSS rule that a merchant cannot capture the funds for an order until we have actually shipped it? I can't seem to find an official reference that describes this as a PCI DSS ...
1
vote
2answers
55 views

PCI Definition of “Transmission”

I am working at a company that is PCI compliant, but I believe they have interpreted some of the requirements incorrectly. Because of this, they are laboring to create work-arounds which I suspect are ...
1
vote
3answers
325 views

Suggestion on how to be PCI Compliant

I'm working on a system that takes the customers credit card information before sending it to the processor. It requires me to ask the customer for cc#, CVV, date, one at a time and send that to my ...
1
vote
2answers
108 views

Does server RAM count as storage for PCI Compliance?

We are an eCommerce website. I'm working on our PCI compliance at the moment, and I'm trying, if at all possible, to argue that our organisation falls under SAQ A rather than D. We do not sensitive ...
1
vote
2answers
123 views

PCI DSS - only one primary function per server

The PCI DSS says that a server can have only one primary function and i'm a little confused over what it means by 'one primary function' we have a webserver with database - web pages and email is ...
1
vote
3answers
302 views

Am I a Hosting service provider in a sense of PCI-DSS SAQ D Appendix A?

My company provides web applications to third parties. We develop, host and manage the applications ourselves. All access that third parties get is the application itself and a separate ...
1
vote
2answers
297 views

What level of PCI Compliance do I need to adhere to if I do not store, but transmit data?

I'm doing a bit of research on my level of PCI compliance, and I'm having a difficult time grasping where I'm supposed to be. I have a web service that has recurring billing. The site is created ...
1
vote
1answer
123 views

Would using Websockets cause PCI compliance failure?

Would utilizing WebSockets cause an issue with obtaining or maintaining PCI compliance?
1
vote
1answer
141 views

How does a PCI QSA audit a company?

Corporate setups are often complex with data centers in multiple locations, complex ACL's and networks setup between them. How does a PCI auditor actually audit the systems ? How does he get to know ...
1
vote
3answers
356 views

“Due diligence” in PCI requirement 12.8.3

Item 12.8.3 from the PCI DSS requires the following: 12.8.3 Ensure there is an established process for engaging service providers including proper due diligence prior to engagement. What is ...
1
vote
1answer
42 views

PCI compliance over two domains

We have an eCommerce website hosted on a dedicated server. We get our PCI compliance report from Qualays and there is no problem with that. However, now we want to test something new on Amazon's AWS ...
1
vote
1answer
58 views

PCI DSS compliance for storing PAN and PII in multi-tenant environment

I wanted to know if I can still be PCI compliant if I store card holder and PII information for multiple tenants in the same database? I.e., have an identifier on the table level to identify the ...
1
vote
2answers
100 views

Antivirus / Wireless PCI v2 Controls Scope

Do the Antivirus / Wireless controls within PCI v2 apply for the entire organisation, or just for the PCI scope?
1
vote
1answer
216 views

Requirement 12.1.2 of PCI DSS: Is it enough to point to a standard process?

Item 12.1.2 of PCI DSS requires that the company's security policy: 12.1.2 Includes an annual process that identifies threats, and vulnerabilities, and results in a formal risk assessment. NIST ...
1
vote
1answer
729 views

Storing only BIN part of PAN, does this qualify as a full PAN?

We are looking at becoming PCI-DSS complaint. We wish to minimize the impact it will have on us and our business. As this can be a very expensive exercise. As I understand it if you do not store ...
1
vote
1answer
621 views

Help with scope clarification of PCI requirement 8.5.15

Section 8.5.15 reads: If a session has been idle for more than 15 minutes, require the user to re-enter the password to re-activate the terminal. Section 8 Accompanying note reads: These ...
1
vote
2answers
99 views

Internal / external Penetration testing a webserver - PCI

the PCI DSS document states: 11.3.2 Perform internal penetration testing at least annually and after any significant infrastructure or application upgrade or modification (such as an operating ...