An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

learn more… | top users | synonyms

1
vote
1answer
156 views

How does a PCI QSA audit a company?

Corporate setups are often complex with data centers in multiple locations, complex ACL's and networks setup between them. How does a PCI auditor actually audit the systems ? How does he get to know ...
1
vote
3answers
726 views

“Due diligence” in PCI requirement 12.8.3

Item 12.8.3 from the PCI DSS requires the following: 12.8.3 Ensure there is an established process for engaging service providers including proper due diligence prior to engagement. What is ...
1
vote
1answer
81 views

Can we use same Active directory / Proxy servers for PCI and Non PCI Segment users?

Can we use the same AD server for both PCI VLAN user and Non PCI VLAN users? How about proxy, we have a Proxy but both PCI and Non PCI user's traffic are flowing through those Proxy. But we have ...
1
vote
2answers
96 views

Shared Database and PCI Compliance

Say we have a cloud based web application which is SaaS. This application is to be made PCI compliant as a service provider, as client card data passes through the application. This application uses a ...
1
vote
1answer
68 views

PCI Compliance for attachment in email

I am wondering if they are any PCI compliance issues around users of a service sending email with attachments that may or may not contain sensitive information through said service? As an example, if ...
1
vote
1answer
93 views

My app is asking for card details, but does not stores them. Do I need PCI compliance?

I plan to build an Android/iPhone app. The app will contain a few forms and status screens. One of the screens will ask the user for their card details. Once they'll click submit they'll be sent over ...
1
vote
2answers
92 views

pci compliance and temporary files

Does storing temporarily a non-encrypted file containing some PANs violate pci requirements? (for example because it is being processed by an application, or to open it on a file editor)
1
vote
2answers
67 views

Using Free AV to meet PCI Requirement 5

I am looking for some opinions on using free AV for meet PCI requirement 5. The way I read this for version 2.0 is that it's entirely possible for a client to meet their AV needs with the modern free ...
1
vote
1answer
384 views

is it illegal to share customer credit card data

I have an app where users can enter credit card data and it is stored using a 3rd party toservice like BluePay or Authorize.net, I do not and will not save it in my system. Trying to get this point ...
1
vote
1answer
156 views

Does PCI DSS 1.4 include tablets and smartphones?

1.4 install personal firewall software on any mobile and/or employee-owned computers with direct connectivity to the Internet (for example, laptops used by employees), which are used to access the ...
1
vote
1answer
99 views

PCI compliance over two domains

We have an eCommerce website hosted on a dedicated server. We get our PCI compliance report from Qualays and there is no problem with that. However, now we want to test something new on Amazon's AWS ...
1
vote
2answers
110 views

Antivirus / Wireless PCI v2 Controls Scope

Do the Antivirus / Wireless controls within PCI v2 apply for the entire organisation, or just for the PCI scope?
1
vote
1answer
346 views

Requirement 12.1.2 of PCI DSS: Is it enough to point to a standard process?

Item 12.1.2 of PCI DSS requires that the company's security policy: 12.1.2 Includes an annual process that identifies threats, and vulnerabilities, and results in a formal risk assessment. NIST ...
1
vote
1answer
1k views

Storing only BIN part of PAN, does this qualify as a full PAN?

We are looking at becoming PCI-DSS complaint. We wish to minimize the impact it will have on us and our business. As this can be a very expensive exercise. As I understand it if you do not store ...
1
vote
1answer
933 views

Help with scope clarification of PCI requirement 8.5.15

Section 8.5.15 reads: If a session has been idle for more than 15 minutes, require the user to re-enter the password to re-activate the terminal. Section 8 Accompanying note reads: These ...
1
vote
1answer
65 views

Can Windows 8 be PCI compliant?

I am in the process of getting PCI. I am in the last step in which I would need a secure PC on my internal network. All the scans I must run are only available through a plugin in browsers for Windows ...
1
vote
1answer
29 views

Card Present PCI Requirements

We are using an IDTECH card reader for iPhone that is not encrypted, our application is web based and runs inside of an iOS app to pull the data off the card. We are then using a client side ...
1
vote
3answers
53 views

Do I need an ASV to come out when going for an SAQ?

Our company is going for a SAQ, under PCI DSS 3.1. Do we need to pay a vendor to come out and do an on site scan, or can we use something like Nessus to do the scan on our own?
1
vote
1answer
81 views

Is zinc.io PCI compliant (/does it need to be)?

zinc.io provides shopping API to programmatically purchase items on Amazon, Best Buy, and Walmart to name a few. A brief observation of its API tells us credit card information is definitely being ...
1
vote
1answer
39 views

Multiple Bank Accounts on one payment gateway or merchant account

I'm looking to use PCI compliant payment gateways such as Authorize.net or Spreedly.com in my website. However in my particular case (hotel, tour, events reservations), we will serve as an ...
1
vote
2answers
56 views

PCI DSS and ssh keys for root

Referring to this PCI DSS 2.0 and ssh keys I want to ask Is this PCI section 8.2 only for individual users or also valid if a user connects via ssh to a root account? I prefer to ssh root@localhost ...
1
vote
1answer
157 views

PCI DSS 3.0 - Is restricting SSH and/or RDP outbound required?

This question comes up a lot as I do evaluations for different customers. I currently recommend the following: All outbound SSH & RDP blocked by default from user network (non-CDE) All outbound ...
1
vote
1answer
127 views

Code deployment in PCI CDE

The PCI DSS v3 standard states the following: Network Segmentation To be considered out of scope for PCI DSS, a system component must be properly isolated (segmented) from the CDE, such that ...
1
vote
2answers
554 views

Internal / external Penetration testing a webserver - PCI

the PCI DSS document states: 11.3.2 Perform internal penetration testing at least annually and after any significant infrastructure or application upgrade or modification (such as an operating ...
1
vote
1answer
5k views

How to Encrypt Credit Card number for storing it in sql server database according to PCI DSS Requirement?

According to PCI-DSS 3.4 Requirement: Render PAN unreadable anywhere it is stored by using the below methods: One-way hash Truncation Index tokens and pads Strong cryptography with associated ...
1
vote
1answer
198 views

Which is best DPAPI or HSM?

Can you please explain what's is the main difference between for this both DPAPI and HSM? As far as I understand both protecting the data, the way of protection is difference HSM is physical device ...
1
vote
1answer
591 views

Does a PCI DSS category 2x device require the same physical security as a 1a/b?

I am trying to further understand the scope of my environment. I have a group of category 2x devices that are used to manage a category 1b device through a category 2a device. I understand my group ...
1
vote
2answers
267 views

PCI-DSS - key-based shell access to internal servers?

In the following PCI 2.0 requirement, I am not sure how to interpret computer access to internal machines (not remotely accessible): Requirement 8: Assign a unique ID to each person with computer ...
1
vote
1answer
621 views

ReverseProxy and PCI Compliance

My company has a PCI compliant billing gateway and they expose a service for submitting credit card payment details. I am writing a (Single Page Application/end-to-end javascript) website for them ...
1
vote
1answer
419 views

Which PCI DSS SAQ applies when you don't store store but transmit CHD?

We have a merchant website that uses Authorize.net's AIM. Cardholder data (credit card number, expiration date, etc.) is entered at our website. Then it's transmitted to payment gateway and isn't ...
1
vote
2answers
67 views

Can I show Credit Card Data to final customers and be PCI Compliant?

I work with reservation management syatems. In the hospitality industry there is the concept of credit card as guarantee. By it when making any kind of reservation you are asked for your credit card ...
1
vote
0answers
25 views

Non-trad bus model: I pay suppliers directly with client CC info. Need to be able to securely collect and read info [closed]

I'm a home-based travel agent. It is against my contract with my host agency (and I think the law actually) to directly accept payment from clients. Instead, we use customer CC information to pay ...
1
vote
0answers
39 views

Internal Vulnerability scans - defining the applicability

If a service provider has a network with thin clients, and they use a citrix portal to access a PCI complaint service provider's cardholder data environment. If the environment is very similar to tho ...
1
vote
1answer
60 views

PCI DSS - Network Design - users connect to internet via proxy;Should we place it at the last hop or before FW?

We need to be PCI compliant. PCI user VLAN is connecting to Internet via proxy but i need confirmation about the location of the proxy. PCI user traffic flow PC ==> ASA FW ==> IPS(integrated with ...
1
vote
1answer
59 views

Does PCI compliance requires DRP even if we dont store Card data

Our company is does not store any credit card details. We are storing it in a cloud platform which is already PCI compliant. We just require to access the Cloud portal from our company. I understand ...
1
vote
0answers
161 views

OSSEC not detecting deleted files?

I have configured 3 VMs: ossec server and two agents in CentOS 6 and Windows 2k8 R2. I have completed the setup and FIM and Log Management works smoothly. It also reports the new files. However, it ...
1
vote
0answers
133 views

Test S/KEY support for PCI compliance - CVE-2007-2243

In order for our business to be PCI compliant, we need to prove that we are not vulnerable to CVE-2007-2243. This states that: OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is ...
1
vote
0answers
30 views

How to store Initialization Vector securely for AES Encryption? [duplicate]

I'm using AES Encryption for encrypting credit card details and so I will store my DEK in Ecnrypted form and do we need to encrypt the Initialization vector for storage?
1
vote
0answers
83 views

PCI Compliance customer data being made available to another system?

Not completely au fait with PCI compliance, however we have our server checked each month by our host to check it is PCI compliant, because we have to keep it PCI Compliant for a specific ...
1
vote
2answers
420 views

Oracle Transparent Data Encryption [closed]

Currently we are using Vormetric for Transparent Data Encryption (TDE) in the Oracle Standard product to satisfy PCI-DSS 2.0 requirements. Does anyone have experience with other third party solutions ...
0
votes
1answer
315 views

How can American Express Serve login be PCI-DSS compliant?

Today I went to log into my American Express Serve account at https://secure.serve.com/ and accidentally discovered what appears to be a huge hole in their login process. Here are the steps involved: ...
0
votes
1answer
190 views

How does SAQ A-EP apply in the situation where no I frames are used

I'm really disappointed in SAQ A-EP. I feel that as a web developer, there are just way too many questions that go over my head and I couldn't possibly know. I use primarily Stripe and Braintree in ...
0
votes
5answers
629 views

Using a Public-Key-Encryption browser side to avoid PCI compliance

We're developing a web application in which certain not logged users (clients) need to send their credit card details to other users (merchants) - which, we'll assume, are PCI compliant. We are ...
0
votes
2answers
667 views

Is this way of using Authorize.net's CIM PCI compliant?

We have a webapp where Authorize.NET's CIM and AIM are used for payment operations. When user buys something at first time he enters his CC number and other billing information at our site. This ...
0
votes
3answers
195 views

PCI Compliance Check-list

I'm currently attempting to wrap my head around PCI compliance - and what I need to do for my business to be compliant. I would like some confirmation on what I've found so far. I accept payments in ...
0
votes
3answers
782 views

What is the most cost effective way to comply with PCI requirement 6.5, developer training?

We are a small company that is coming increasingly under pressure to be PCI complaint. Our main product is an API that move cardholder data between a customer and a supplier. I am in the process of ...
0
votes
2answers
625 views

How to safely collect bank account from website?

I want to collect bank account information from my customers on my website. I'd like to do that through a form, then I will download it to a PC, print it, and then delete it from the website. Or ...
0
votes
1answer
54 views

PCI DSS Compliance for a Level 4 organization

We are a small company and process less than 500 Credit Card transactions each year so we fall under Level 4 category merchants. The company heads wants to make sure that we are PCI compliant at all ...
0
votes
3answers
1k views

Is it PCI compliant to send credit card details to the server without saving them there?

Considering I use SSL the whole process. I have an IOS client that I want to use to enter the user's credit card details. I want to do the whole charging and processing on the server side, so I send ...
0
votes
1answer
297 views

LDAP and anonymous bind for PCI compliance

We have to setup a central auth for PCI compliance and I'm wondering if it's ok to allow anonymous bind or should I create a user to do the bind for the services needing ldap?