An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

learn more… | top users | synonyms

1
vote
3answers
313 views

PCI Compliance Check-list

I'm currently attempting to wrap my head around PCI compliance - and what I need to do for my business to be compliant. I would like some confirmation on what I've found so far. I accept payments in ...
1
vote
3answers
876 views

Am I a Hosting service provider in a sense of PCI-DSS SAQ D Appendix A?

My company provides web applications to third parties. We develop, host and manage the applications ourselves. All access that third parties get is the application itself and a separate ...
1
vote
2answers
50 views

Access Controls on employees handling credit card data

Employee has access to image format of full credit card data on an application (primary account number, cvv, expiry code, name). He copies from this application and enters manually to another ...
1
vote
3answers
282 views

Clickjacking on a site without user accounts

My understanding of clickjacking attacks is that an attacker could embed my site in his. The attacker then uses clever styling to trick the user into performing actions on my site, that they did not ...
1
vote
1answer
491 views

PCI DSS - Recorded Phone Conversations

I am using the using the following image from FishNet Security as a sort of guide for the data flow diagram required by PCI DSS as defined by: 1.1.3 Current diagram that shows all cardholder ...
1
vote
1answer
659 views

What is the difference between Internal and External scan in PCI

Is each firewall interface IP is considered as external IP?. Do we need to scan each interface IP??. What is an internal scan? What are the elements for internal, how we do it?.
1
vote
1answer
1k views

TrustWave PCI Compliance - OpenSSH

First time 'asker' on here, but wanted to say thanks to how much I've used this site and reading answers to questions I've had! Anyway, lately I've been having issues with a customer of ours who's ...
1
vote
2answers
260 views

PCI compliance and external resources http/https

Firstly, if a site is PCI compliant, and new references to a 3rd-party file (e.g. image, Javascript, CSS, etc…) via http:// instead of https:// are added, does it violate PCI compliance? Secondly, ...
1
vote
1answer
159 views

How much information is released when paying with a debit card

How much information is released when paying with a debit card? Is it possible for a vendor to grab your name and address from your debit card and send you things in the mail?
1
vote
2answers
657 views

Can I show PCI compliant Logo

I have just now got 20 of my e-commerce websites scanned and certified by Comodo. I will be submitting them to my banks as well to prove that I am PCI compliant. But is there any regulation on who ...
1
vote
1answer
189 views

Would using Websockets cause PCI compliance failure?

Would utilizing WebSockets cause an issue with obtaining or maintaining PCI compliance?
1
vote
1answer
165 views

How does a PCI QSA audit a company?

Corporate setups are often complex with data centers in multiple locations, complex ACL's and networks setup between them. How does a PCI auditor actually audit the systems ? How does he get to know ...
1
vote
3answers
989 views

“Due diligence” in PCI requirement 12.8.3

Item 12.8.3 from the PCI DSS requires the following: 12.8.3 Ensure there is an established process for engaging service providers including proper due diligence prior to engagement. What is ...
1
vote
1answer
45 views

Call recording PCI-DSS issues

For a non-automated payment card entry system, if a caller is providing a payment card details over the phone to a call centre employee who confirms the number to the caller, does that mean the ...
1
vote
1answer
72 views

Do I need PCI DSS compliance when using PayPal Express Checkout?

If I'm using PayPal Express Checkout on my website, am I required to be PCI DSS compliant? PayPal says "With Website Payments Standard, Online Invoicing, Express Checkout and Website Payments Pro ...
1
vote
3answers
193 views

Do I need an ASV to come out when going for an SAQ?

Our company is going for a SAQ, under PCI DSS 3.1. Do we need to pay a vendor to come out and do an on site scan, or can we use something like Nessus to do the scan on our own?
1
vote
1answer
294 views

Can we use same Active directory / Proxy servers for PCI and Non PCI Segment users?

Can we use the same AD server for both PCI VLAN user and Non PCI VLAN users? How about proxy, we have a Proxy but both PCI and Non PCI user's traffic are flowing through those Proxy. But we have ...
1
vote
1answer
233 views

Transmitting Credit Card Information

I want to know how secure it is to transmit Credit Card details as plain text to the payment gateway from my website using HTTPS. We are not storing any details in our database but I read that ...
1
vote
2answers
164 views

Shared Database and PCI Compliance

Say we have a cloud based web application which is SaaS. This application is to be made PCI compliant as a service provider, as client card data passes through the application. This application uses a ...
1
vote
1answer
154 views

PCI Compliance for attachment in email

I am wondering if they are any PCI compliance issues around users of a service sending email with attachments that may or may not contain sensitive information through said service? As an example, if ...
1
vote
1answer
122 views

My app is asking for card details, but does not stores them. Do I need PCI compliance?

I plan to build an Android/iPhone app. The app will contain a few forms and status screens. One of the screens will ask the user for their card details. Once they'll click submit they'll be sent over ...
1
vote
2answers
168 views

pci compliance and temporary files

Does storing temporarily a non-encrypted file containing some PANs violate pci requirements? (for example because it is being processed by an application, or to open it on a file editor)
1
vote
2answers
82 views

Using Free AV to meet PCI Requirement 5

I am looking for some opinions on using free AV for meet PCI requirement 5. The way I read this for version 2.0 is that it's entirely possible for a client to meet their AV needs with the modern free ...
1
vote
1answer
679 views

is it illegal to share customer credit card data

I have an app where users can enter credit card data and it is stored using a 3rd party toservice like BluePay or Authorize.net, I do not and will not save it in my system. Trying to get this point ...
1
vote
1answer
278 views

Does PCI DSS 1.4 include tablets and smartphones?

1.4 install personal firewall software on any mobile and/or employee-owned computers with direct connectivity to the Internet (for example, laptops used by employees), which are used to access the ...
1
vote
1answer
129 views

PCI compliance over two domains

We have an eCommerce website hosted on a dedicated server. We get our PCI compliance report from Qualays and there is no problem with that. However, now we want to test something new on Amazon's AWS ...
1
vote
1answer
348 views

PCI DSS compliance for storing PAN and PII in multi-tenant environment

I wanted to know if I can still be PCI compliant if I store card holder and PII information for multiple tenants in the same database? I.e., have an identifier on the table level to identify the ...
1
vote
2answers
113 views

Antivirus / Wireless PCI v2 Controls Scope

Do the Antivirus / Wireless controls within PCI v2 apply for the entire organisation, or just for the PCI scope?
1
vote
1answer
434 views

Requirement 12.1.2 of PCI DSS: Is it enough to point to a standard process?

Item 12.1.2 of PCI DSS requires that the company's security policy: 12.1.2 Includes an annual process that identifies threats, and vulnerabilities, and results in a formal risk assessment. NIST ...
1
vote
1answer
1k views

Help with scope clarification of PCI requirement 8.5.15

Section 8.5.15 reads: If a session has been idle for more than 15 minutes, require the user to re-enter the password to re-activate the terminal. Section 8 Accompanying note reads: These ...
1
vote
2answers
36 views

PA-DSS & DTMF application

If the payment application is not storing any credit card information, does it needs to be PA-DSS? The application takes the Credit card information using DTMF and pass-through via secure XML for ...
1
vote
1answer
74 views

PCI: Does CHD or SAD still need to be protected after implementing a P2PE solution?

The promise of a good (even certified) PCI P2PE v2 solution is that the merchant does not have access to the keys which encrypted the Card Holder Data (CHD) and the Sensitive Authentication Data (SAD) ...
1
vote
1answer
35 views

What PCI standard(s) a payment app (for Smartphones) should comply with in order to be approved by PCI SSC?

We are a company developing apps for Payment Service Provider(s) and in one of our apps Card Holders should enter payment Card data (such as PAN, PIN 2, CVV, Expiration Date) to do a CNP (Card Not ...
1
vote
1answer
26 views

How to include third parties in PCI DSS SAQ

When filling in the SAQ for PCI compliance, how do you include requirements covered by a third party provider? Say you're using a PCI compliant VPS provider for example. Do you select 'yes' then ...
1
vote
2answers
49 views

Is it PCI-compliant/kosher to send a credit card number to a 3rd party sever from a mobile client?

I am building a mobile app, and part of the the functionality of the app is to place an order with a 3rd party. The 3rd party server accepts a credit card number string. Can I build a mobile client to ...
1
vote
1answer
116 views

Can Windows 8 be PCI compliant?

I am in the process of getting PCI. I am in the last step in which I would need a secure PC on my internal network. All the scans I must run are only available through a plugin in browsers for Windows ...
1
vote
1answer
53 views

Card Present PCI Requirements

We are using an IDTECH card reader for iPhone that is not encrypted, our application is web based and runs inside of an iOS app to pull the data off the card. We are then using a client side ...
1
vote
1answer
323 views

Is zinc.io PCI compliant (/does it need to be)?

zinc.io provides shopping API to programmatically purchase items on Amazon, Best Buy, and Walmart to name a few. A brief observation of its API tells us credit card information is definitely being ...
1
vote
1answer
406 views

Multiple Bank Accounts on one payment gateway or merchant account

I'm looking to use PCI compliant payment gateways such as Authorize.net or Spreedly.com in my website. However in my particular case (hotel, tour, events reservations), we will serve as an ...
1
vote
1answer
280 views

PCI DSS 3.0 - Is restricting SSH and/or RDP outbound required?

This question comes up a lot as I do evaluations for different customers. I currently recommend the following: All outbound SSH & RDP blocked by default from user network (non-CDE) All outbound ...
1
vote
1answer
260 views

Code deployment in PCI CDE

The PCI DSS v3 standard states the following: Network Segmentation To be considered out of scope for PCI DSS, a system component must be properly isolated (segmented) from the CDE, such that ...
1
vote
1answer
272 views

Which is best DPAPI or HSM?

Can you please explain what's is the main difference between for this both DPAPI and HSM? As far as I understand both protecting the data, the way of protection is difference HSM is physical device ...
1
vote
1answer
947 views

Does a PCI DSS category 2x device require the same physical security as a 1a/b?

I am trying to further understand the scope of my environment. I have a group of category 2x devices that are used to manage a category 1b device through a category 2a device. I understand my group ...
1
vote
2answers
374 views

PCI-DSS - key-based shell access to internal servers?

In the following PCI 2.0 requirement, I am not sure how to interpret computer access to internal machines (not remotely accessible): Requirement 8: Assign a unique ID to each person with computer ...
1
vote
1answer
973 views

ReverseProxy and PCI Compliance

My company has a PCI compliant billing gateway and they expose a service for submitting credit card payment details. I am writing a (Single Page Application/end-to-end javascript) website for them ...
1
vote
1answer
467 views

Which PCI DSS SAQ applies when you don't store store but transmit CHD?

We have a merchant website that uses Authorize.net's AIM. Cardholder data (credit card number, expiration date, etc.) is entered at our website. Then it's transmitted to payment gateway and isn't ...
1
vote
0answers
14 views

Would the following practice make email PCI compliant?

If a system applied to the following three practice/technologies to each e-mail, would it rate as PCI compliant? The email itself is encrypted Encryption is applied end-to-end in the transport layer ...
1
vote
0answers
34 views

Approved Certificate Authorities for certification/compliance with HIPAA, PCI etc

Are there any requirements in PCI or HIPAA, or other security standards that may impact general government, payment processing, healthcare, that would disqualify any CA vendors that are trusted by the ...
1
vote
0answers
19 views

PCI-DSS Helping customers with a third-party booking service

My clients are able to pay for services through a website EXAMPLE.COM. Sometimes, a client will call on the phone looking to pay for services over the phone. I would like to use a device to visit ...
1
vote
0answers
34 views

SAQ D PCI Compliance for Custom Shopping Cart

We use a custom developed open-source e-commerce software. We are SAQ D and I am trying to figure out which of these requirements applies to our cart if: We aren't storing credit card information We ...