An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

learn more… | top users | synonyms

3
votes
2answers
1k views

The point of PCI 1.3.1 through 1.3.3

In expansion to my previous question what qualifies as public access? I'm trying to wrap my head around the intent of the points 1.3.1 and 1.3.2 and 1.3.3 of the PCI standard. I have four DMZs at my ...
3
votes
2answers
382 views

Which PCI SAQ would you say to use if you are neither a merchant nor service provider?

Low down: This client does zero with credit card data (no processing, no passing of it, nothing), but they do have a device often placed on the same network segment of a POS (Point of sale) system. ...
3
votes
2answers
50 views

Firewall UDP Packet Source Port 53 Ruleset Bypass

I have a question regarding recent PCI DSS scan performed on our network. On some of the Windows 2008 servers (physical and VM), there is a risk found "Firewall UDP Packet Source Port 53 Ruleset ...
3
votes
1answer
75 views

PCI DSS 3.0: 11.3 - What happens if a low risk vulnerability prevents compliance with another requirement?

As I understand the PCI DSS 3.0/3.1 penetration testing requirements, a company is compliant with 11.3 if the penetration test does not return any high risk vulnerabilities. However, what happens if ...
3
votes
1answer
157 views

How can a very small company handle PCI-DSS requirement 6.4.2?

PCI-DSS 3 requirement 6.4.2 calls for Separation of duties between development/test and production environments. Based on the guidance text and this, answer to another question, it appears ...
3
votes
1answer
282 views

Google Analytics on Checkout

Are there any risks to using Google Analytics on my checkout page? The page is on SSL and I will obviously be serving the analytics script from their secured URL. Thanks.
3
votes
1answer
7k views

How to Encrypt Credit Card number for storing it in sql server database according to PCI DSS Requirement?

According to PCI-DSS 3.4 Requirement: Render PAN unreadable anywhere it is stored by using the below methods: One-way hash Truncation Index tokens and pads Strong cryptography with associated ...
3
votes
2answers
1k views

PCI DSS 11.2.1/11.2.3 - Internal scans scope

I need help about SAQ #C - Are quarterly internal vulnerability scans performed? What is target (scope) for those internal scans? Our configuration: Router with modem (WAN1/LAN1), DMZ, some office ...
3
votes
2answers
67 views

Clarification of PCI DSS 3.1 requirement 6+8

I'm quite puzzled about the PCI requirements when it comes to session timeouts and scope definitions. The login is the end user/customer login to the public facing control panel in which they can ...
3
votes
1answer
39 views

Which SAQ form do I use for PCI DSS compliance?

I run a small business with a Prestashop e-commerce website that sends customers to Sagepay to make a payment using the Presto Chango Sagepay payment module. In my office I also have a one PC ...
3
votes
1answer
116 views

PCI Compliance SAQ-A-EP or SAQ D

Our eCommerce wesbite attracts less than 5000 CC transactions each year and we do no store any CC information in our backend or systems but transmit them to our third party provider. We also use a ...
3
votes
1answer
127 views

What's the advantage of passing credit cards via javascript vs. over the server (without saving it)?

I've noticed current credit card gateways like stripe and wepay encourage sending the credit card number via their js framework (which would use some iframe jsonp magic to pass the data). To my ...
3
votes
1answer
91 views

How to design a right VPN connection for an organisation (Interconnected MPLS link or Individual FW)

Thanks in advance for your advice We have to implement VPN connection for nearly 7 countries Option 1 : As we have private MPLS link to all 7 countries. It is been outsourced Third party. They ...
3
votes
1answer
186 views

Does PCI compliance requires DRP even if we dont store Card data

Our company is does not store any credit card details. We are storing it in a cloud platform which is already PCI compliant. We just require to access the Cloud portal from our company. I understand ...
3
votes
2answers
147 views

Backup procedure for PCI

Our company is does not store any credit card details but we do transmit them. We are storing it in a cloud platform which is already PCI compliant. We just require to access the Cloud portal from ...
3
votes
1answer
1k views

Is RDP susceptible to the BEAST attack?

I have Windows 2008 R2 servers which are failing a PCI vulnerability scan because they have RDP enabled (needs to be disabled). I have applied the PCI settings of IISCrypto tool, but I have to leave ...
3
votes
2answers
487 views

PCI DSS - mask PAN and log individual access to PAN

How do you re-conciliate two PCI DSS requirements in applications: 3.3 Mask PAN when displayed (the first six and last four digits are the maximum number of digits to be displayed), such that only ...
3
votes
2answers
125 views

Legacy system PCI Compliance

I have a legacy system that collects and stores credit card numbers ( BAD! ). We are in the process of replacing that system in phases. We are going to integrate with a credit card processing system ...
3
votes
2answers
363 views

Backup server categorization in the Open PCI Scoping Toolkit

How are backup servers which host a copy of cardholder data supposed to be categorized according to the Open PCI Scoping Toolkit, given that the backup and storage guidelines from the PCI standards ...
2
votes
3answers
540 views

What is the best way to get a third party audit done of website security?

I have a website that needs to be PCI compliant. I have coded it using the guidelines but to be safe i wanted to get a third party audit done where this individual who runs a IT security firm and ...
2
votes
2answers
2k views

Why does Amazon ask for the CVC/CVV if it bills without it?

I have a follow-up question relating to this question: How does Amazon bill me wihout the CVC / CVV / CVV2? If amazon.com can bill without the CVV why does it ask for it the first time information ...
2
votes
3answers
1k views

Vulnerability scanning applicability for PCI DSS

I'm fully up to speed on PCI DSS requirements and have attend the ISA course recently. The course was helpful and I was able to bounce ideas off of the trainer. However I keep coming back to one ...
2
votes
3answers
845 views

Suggestion on how to be PCI Compliant

I'm working on a system that takes the customers credit card information before sending it to the processor. It requires me to ask the customer for cc#, CVV, date, one at a time and send that to my ...
2
votes
2answers
387 views

Best way to scan for and eliminate earlier versions of SSL/TLS in a production environment

Due to new PCI DSS standards mandating that nothing lower than TLS 1.2 be used in a PCI environment, I am tasked with phasing out anything lower than TLS 1.2 on every device in this environment by our ...
2
votes
3answers
565 views

Client is not storing Credit Cards Securily (near plain text). How do I convince client to be more secure?

I am writing in regards to PCI-DSS compliance for taking credit cards. A client of mine is not willing / does not want to bump up security beyond what is currently done for their credit card data. All ...
2
votes
7answers
423 views

PCI Policy Management software? [closed]

I am working on a project to get our company PCI Compliant. One of the key issues I face is managing PCI/Security policies in the organisation. I am responsible for creating the policies and ...
2
votes
3answers
156 views

Businesses Handling Credit Cards via Email

I have done some I.T. contracting for a medium-sized Australian hotel recently. I am concerned about their credit card handling practices. Customers often email their CC number and expiry date in ...
2
votes
2answers
2k views

What are the insecure Protocols in terms of PCI DSS

What are the insecure protocols which should be disabled according to PCI DSS standard. How to check those are disabled in Firewalls and Servers.
2
votes
2answers
1k views

PCI Compliance network scope

I was wondering if anyone could clarify the scope of PCI compliance with regard to multiple networks. At present, there's one PCI compliant network to which another network connects via VPN. The PCI ...
2
votes
2answers
2k views

If am using Stripe am I SAQ A-EP in PCI V3

We are going through the PCI process at the moment and because v2 goes out of date on December 2014, I opted to use PCI v3. Because with Stripe you put the form inside your application and post to ...
2
votes
1answer
2k views

What level of PCI Compliance do I need to adhere to if I do not store, but transmit data?

I'm doing a bit of research on my level of PCI compliance, and I'm having a difficult time grasping where I'm supposed to be. I have a web service that has recurring billing. The site is created ...
2
votes
3answers
112 views

Are there any reasons to be concerned about the security of “Coin”? [duplicate]

I just came across this: https://onlycoin.com/ A credit-card sized device that not only holds the info for as many credit and debit and membership cards as you want (they claim) but also can ...
2
votes
3answers
322 views

PCI Compilance - Custom payment processor

Consider following situation: We have location A where we have our online store. We have location B where we have payment processing. Server is dedicated to do only payment processing jobs We can ...
2
votes
2answers
2k views

Credit card storage, hashes, truncation, encrypted data

I'm trying to figure out a way to meet multiple business requirements that don't seem to go well in hand in terms of security: store encrypted card data associated with customer accounts for ...
2
votes
1answer
726 views

PCI Compliance - If am eligible to self certify - do I need to use a QSA company in this context?

Setting up a new company with ecommerce app, and looking at PCI compliance. What I need to know is if I need to use a pci security assessor to verify the answers to the self assessment questionnaire? ...
2
votes
1answer
402 views

PCI - prohibiting direct connections to the Cardholder Data Environment

In PCI 1.3.3 it states: Are direct connections prohibited for inbound or outbound traffic between the Internet and the cardholder data environment? A Cardholder Data Environment (CDE) ...
2
votes
4answers
91 views

Is PCI-DSS compliance required for non-credit card payment source?

We have a banking application that allows you to pay your bills (using your savings/checking account) -- including your credit card bills. However our system was set up such that you enter the credit ...
2
votes
3answers
538 views

How are HSMs used in payment processing on the server?

I came to know recently that HSMs are used in credit card processing on the server side but since I don't work in that space and stumped as to why its needed. I can see it used in an ATM machine - ...
2
votes
2answers
177 views

PCI-DSS Is the infrastructure really in-scope?

Say I have an application that takes credit cards, but this is actually a payment gateway on the internet that I don't control. The web site used HTTPS and only returns if the card was authorized or ...
2
votes
1answer
642 views

Is it OK to generate a token for a credit card without the user's permission? Is that PCI compliant?

Is it PCI compliant to generate a token for every card used for processing, regardless of whether the client asked for his card to be saved or not?
2
votes
3answers
268 views

Do we need to use separate IP ?

I want to open and forward SSH port to one of our internal computers. Problem is - it will use the same IP address as PCI-DSS environment (where the HTTPS payment gatway is running) Basically ...
2
votes
3answers
2k views

Can change management for PCI compliance be accomplished via simple emails?

Item 6.4.5 of PCI DSS requires the following: 6.4.5 Change control procedures for the implementation of security patches and software modifications. Procedures must include the following: ...
2
votes
3answers
345 views

PCI Compliance Problem

My company is trying to become fully PCI Compliant and we are switching our outdated systems to use Authorize.net CIM among other things. But, currently we're all over the place and until our new ...
2
votes
2answers
89 views

PCI DSS 3.0 and card swipe terminals for our merchants

We run an online software service that collects and transmits card transactions for small merchants. They use card swipe terminals connected to their business PCs that direct the traffic straight ...
2
votes
1answer
97 views

For PCI compliance, does every request need to be logged regardless of how it affects system performance?

Our cloud based service is currently undergoing changes with a view towards PCI compliance. It is a high throughput service, and there are concerns that enabling the right amount of logging on our ...
2
votes
1answer
128 views

Handling unencrypted HTTP data for a PCI compliant system - in scope for PCI DSS v3 but not v2?

We currently have a custom, cloud based application that can analyse then route HTTP and HTTPS traffic through to a domain. So if a client wants to use our service, they re-point their DNS to our ...
2
votes
1answer
152 views

How much information is released when paying with a debit card

How much information is released when paying with a debit card? Is it possible for a vendor to grab your name and address from your debit card and send you things in the mail?
2
votes
1answer
2k views

How to process or manage Key-Encryption-Key using HSM?

Let's consider two Encryption keys: 1.Data-Encryption-Key(DEK) 2.Key-Encryption-Key(KEK) KEK will be securely stored in HSM, which will be encrypted using master key. Data Encryption Key will be ...
2
votes
1answer
2k views

Storing only BIN part of PAN, does this qualify as a full PAN?

We are looking at becoming PCI-DSS complaint. We wish to minimize the impact it will have on us and our business. As this can be a very expensive exercise. As I understand it if you do not store ...
2
votes
1answer
324 views

Are these merchant integration instructions wrong about server-client interaction?

I'm working with a payment gateway that seems to have a fundamental misunderstanding of "clients" and how to protect sensitive data. The integration instructions are mostly about a "redirect" mode of ...