An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

learn more… | top users | synonyms

0
votes
5answers
285 views

PCI Policy Management software?

I am working on a project to get our company PCI Compliant. One of the key issues I face is managing PCI/Security policies in the organisation. I am responsible for creating the policies and ...
0
votes
1answer
117 views

PCI onsite QSA Audit Review

Has anyone had any success using video recordings from ObserveIT during a PCI onsite QSA audit review? We are scheduled to be audited in a few months and are considering adding ObserveIT to ...
0
votes
2answers
58 views

PCI compliance and external resources http/https

Firstly, if a site is PCI compliant, and new references to a 3rd-party file (e.g. image, Javascript, CSS, etc…) via http:// instead of https:// are added, does it violate PCI compliance? Secondly, ...
0
votes
1answer
133 views

What can a hacker do with a card number without CVV? [duplicate]

From my experience a card can not be used for online payment without a valid CVV, then why is it still always emphasized that card number must be protected? What can a hacker do, assume that he has ...
0
votes
1answer
50 views

Multiple websites hosted on same server

We have two severs sitting under one load balancer. We run PCI scans on those two servers. Now, when we started, we only had 2 websites running from these two server. But the business is growing ...
0
votes
1answer
75 views

PCI-DSS Requirement for Application Level Security?

Before I arrived at my current company we obtained the services of PCI consultant who gave us some very specific, if questionable, advice on encryption requirements. The particular piece of advice I ...
0
votes
1answer
133 views

Hashing PAN numbers

According to this blog PAN number should be hashed using a "secret salt". What they are doing is basically H(Message+salt). The reason you need this "secret salt" is because PAN numbers are limited to ...
0
votes
2answers
144 views

Senario:SSL Enabled Online Banking Application. Question: Should card numbers be provided back to a user un-masked, when there is a failed login?

For an online banking application with SSL enabled, should card numbers be provided back to the user unmasked, when there is a failed login. Would this be a violation of PCI DSS 3.3 or not as the ...
0
votes
1answer
67 views

PCI payment gateway and store [duplicate]

Consider situation: I made my own payment gateway and it passes vulnerabity tests. My store redirects to this payment gateway. Card details is collected there. Payment is processed there (not ...
0
votes
1answer
78 views

Precedent for an in-house cardholder information server?

My organization is undertaking a project to attempt to reduce the amount of our infrastructure covered under PCI scope. Specifically, we're looking to exclude our web merchandising software from PCI ...
0
votes
1answer
304 views

Configuring IIS SSL for PCI

Is there a clear, concise list of of SSL settings available for IIS which will pass my PCI audit scanning? Preferably something for both IIS 6 and IIS 7 I'm currently running into BEAST issues but ...
0
votes
1answer
167 views

PCI-DSS for VX570 and POS on same network

Have a Point-of-sale (POS) workstation and a VX570 credit card terminal connected via RS232 and both on the same network with internet connection. No card data is transfered to the POS except for ...
0
votes
1answer
138 views

How much does network security audit and patch work? [closed]

how much is reasonable if i'm looking to hire someone FULL TIME to handle security auditing and patching for my network? I need my network to be PCI Compliance and what not as well. MY office have ...
0
votes
2answers
252 views

Signing up on a paid site with a credit card

I'm building a subscription-based website that needs to accept recurring payments. The concept is much like that of Netflix, but there is also a variation between the two. When a user attempts to ...
0
votes
1answer
67 views

Security Modules - Hardware vs. Software

In terms of PCI requirements and compliance, is a software-based key management module like Gazzang zTrustee an acceptable solution to the PCI requirements that a (hardware) HSM solution like AWS ...
-1
votes
1answer
157 views

DSA Generates different signatures with the same data [closed]

I'm using the example given in msdn article about the DSACryptoServiceProvider Class. The problem is that I get a different signature each time I run the code. I tried OpenSSL and didn't get this ...
-1
votes
2answers
403 views

How to use VirtualMerchant without PCI-DSS?

I want to use Elavon VirtualMerchant to make credit card payments on my website. I don't want to do PCI DSS certifications other than SAQ A, so don't want to process or store card data on my site. I ...
-1
votes
1answer
88 views

PCI compliant transparent data encryption at disk/folder level on Windows?

Is there a way to achieve PCI compliant data encryption at disk/folder level in Windows in a way that is transparent to applications(they must be able to write/read to encrypted folders/disks as if ...
-1
votes
0answers
36 views

Any good Alternatives to ControlScan PCI SQA? [on hold]

My company is about to engace ControlScan for their PCI 1,2,3 solution giving us enough to have our hosting and service PCI compliant. Basically We are in need of a good Web Application Firewall, a ...