An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

learn more… | top users | synonyms

0
votes
1answer
667 views

Can someone please briefly explain HIPPA compliance?

I worked in web hosting for several years, particularly security. I am familiar with PCI compliance and I would say the "short and sweet" guide to PCI for an eCommerce store is as follows: Client ...
0
votes
5answers
341 views

PCI Policy Management software?

I am working on a project to get our company PCI Compliant. One of the key issues I face is managing PCI/Security policies in the organisation. I am responsible for creating the policies and ...
0
votes
1answer
123 views

PCI onsite QSA Audit Review

Has anyone had any success using video recordings from ObserveIT during a PCI onsite QSA audit review? We are scheduled to be audited in a few months and are considering adding ObserveIT to ...
0
votes
1answer
86 views

IP whitelisting as two factor authentication method for server access under PCI DSS

In the answer to my question: Two factor authentication for web application under PCI DSS gowenfawr stated: I have seen other methods used for 2FA than those you mention; IP whitelisting and ...
0
votes
1answer
66 views

Two factor authentication for web application under PCI DSS

PCI DSS 8.2 is stated as follows 8.2 In addition to assigning a unique ID, ensure proper user-authentication management for non-consumer users and administrators on all system components by ...
0
votes
1answer
37 views

Can we share a folder across regions for PCI Users

We need to be PCI compliant for a small setup. We need to share a folder which should be accessible by other regions as well. We have Private MPLS Connection. PCI users will be having only READ ...
0
votes
2answers
119 views

Can Amazon's AWS Identity and Access Management (IAM) be used to manage server access?

Requirement 8.1.1 of PCI DSS states: Assign all users a unique ID before allowing them to access system components or cardholder data. Using Amazon IAM I can set up individual accounts for users ...
0
votes
1answer
63 views

PCI Compliant Secure Vault Design and Implementation

I often see the phrase “Secure Vault” in PCI DSS documentations and I want to know if a “Secure Vault” must be a highly protected file with sophisticated technologies stored on a very secure hardware ...
0
votes
1answer
72 views

PCI Compliance - Antivirus in host and virtual environment?

We have a couple servers with a host system, and virtual DB and Web instances. Is it possible to be compliant with PCI if you install the Antivirus only on the host system, or does it need to be ...
0
votes
2answers
84 views

Storing CardHolder Data using RC2 encryption

I would like to know if storing credit cardholder data using RC2 encryption requires to be compliant with PCI DSS. Currently the 16 digit PAN number and expiry date is stored in the database. The PAN ...
0
votes
1answer
179 views

masking credit cards PAN with zeros

The PCI-DSS only requires you to protect the PAN if you are storing MORE THAN the first six and last four digits. Can an all zero mask be used? E.g. 4111 1100 0000 1234 to make it PCI compliant / not ...
0
votes
2answers
121 views

PCI compliance and external resources http/https

Firstly, if a site is PCI compliant, and new references to a 3rd-party file (e.g. image, Javascript, CSS, etc…) via http:// instead of https:// are added, does it violate PCI compliance? Secondly, ...
0
votes
1answer
609 views

What can a hacker do with a card number without CVV? [duplicate]

From my experience a card can not be used for online payment without a valid CVV, then why is it still always emphasized that card number must be protected? What can a hacker do, assume that he has ...
0
votes
1answer
69 views

Multiple websites hosted on same server

We have two severs sitting under one load balancer. We run PCI scans on those two servers. Now, when we started, we only had 2 websites running from these two server. But the business is growing ...
0
votes
1answer
86 views

PCI-DSS Requirement for Application Level Security?

Before I arrived at my current company we obtained the services of PCI consultant who gave us some very specific, if questionable, advice on encryption requirements. The particular piece of advice I ...
0
votes
1answer
296 views

Hashing PAN numbers

According to this blog PAN number should be hashed using a "secret salt". What they are doing is basically H(Message+salt). The reason you need this "secret salt" is because PAN numbers are limited to ...
0
votes
2answers
149 views

Senario:SSL Enabled Online Banking Application. Question: Should card numbers be provided back to a user un-masked, when there is a failed login?

For an online banking application with SSL enabled, should card numbers be provided back to the user unmasked, when there is a failed login. Would this be a violation of PCI DSS 3.3 or not as the ...
0
votes
1answer
72 views

PCI payment gateway and store [duplicate]

Consider situation: I made my own payment gateway and it passes vulnerabity tests. My store redirects to this payment gateway. Card details is collected there. Payment is processed there (not ...
0
votes
1answer
80 views

Precedent for an in-house cardholder information server?

My organization is undertaking a project to attempt to reduce the amount of our infrastructure covered under PCI scope. Specifically, we're looking to exclude our web merchandising software from PCI ...
0
votes
1answer
394 views

Configuring IIS SSL for PCI

Is there a clear, concise list of of SSL settings available for IIS which will pass my PCI audit scanning? Preferably something for both IIS 6 and IIS 7 I'm currently running into BEAST issues but ...
0
votes
1answer
183 views

PCI-DSS for VX570 and POS on same network

Have a Point-of-sale (POS) workstation and a VX570 credit card terminal connected via RS232 and both on the same network with internet connection. No card data is transfered to the POS except for ...
0
votes
1answer
141 views

How much does network security audit and patch work? [closed]

how much is reasonable if i'm looking to hire someone FULL TIME to handle security auditing and patching for my network? I need my network to be PCI Compliance and what not as well. MY office have ...
0
votes
2answers
288 views

Signing up on a paid site with a credit card

I'm building a subscription-based website that needs to accept recurring payments. The concept is much like that of Netflix, but there is also a variation between the two. When a user attempts to ...
0
votes
0answers
17 views

SAD storage prior to authorization [on hold]

Does anyone know of any FAQ's or articles written by PCI SSC in regards to sensitive authorization data storage, namely track data, in RAM before processing? The use would be storage within the ...
0
votes
1answer
35 views

PCI compliant RSA key generation and getting value of private exponent

Is it possible to generate RSA key and get its private exponent in clear and to be compliant with the following PCI requirement?: Keys must be generated so that it is not feasible to determine that ...
0
votes
0answers
37 views

Backup procedure for PCI

Our company is does not store any credit card details. We are storing it in a cloud platform which is already PCI compliant. We just require to access the Cloud portal from our company. I understand ...
0
votes
0answers
122 views

PCI-DSS: Recomendations for Mixed-Mode Virtual Environments

We are PCI-DSS 2.0 compliant. We have three internal networks: GENERAL (workstations, app file servers) workstations can RDP to the PCI servers in order to work on the cardholder data. MANAGEMENT ...
0
votes
2answers
209 views

Security Modules - Hardware vs. Software

In terms of PCI requirements and compliance, is a software-based key management module like Gazzang zTrustee an acceptable solution to the PCI requirements that a (hardware) HSM solution like AWS ...
-1
votes
1answer
109 views

How does SAQ A-EP apply in the situation where no I frames are used

I'm really disappointed in SAQ A-EP. I feel that as a web developer, there are just way too many questions that go over my head and I couldn't possibly know. I use primarily Stripe and Braintree in ...
-1
votes
1answer
96 views

iFrame or Tokenization for Credit card transactions [closed]

My company is currently processing less than 4000 Credit Card transactions a year and we are a level 4 organization. I see that we are storing the credit card data in one of our databases but the PAN ...
-1
votes
2answers
489 views

How to use VirtualMerchant without PCI-DSS?

I want to use Elavon VirtualMerchant to make credit card payments on my website. I don't want to do PCI DSS certifications other than SAQ A, so don't want to process or store card data on my site. I ...
-1
votes
2answers
87 views

Tools to check the firewall Configurations as per PCI standards [closed]

How do you audit the Firewall rules and configuration policies as per PCI standard. What are the tools used for it.
-1
votes
1answer
204 views

PCI compliant transparent data encryption at disk/folder level on Windows?

Is there a way to achieve PCI compliant data encryption at disk/folder level in Windows in a way that is transparent to applications(they must be able to write/read to encrypted folders/disks as if ...