An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

learn more… | top users | synonyms

0
votes
1answer
23 views

What type of 'security scan' does a PCIDSS compliance check comprise?

Our firm processes CC information on an ad hoc basis. No cardholder data is ever recorded in any of our databases and we do not grant public access to any of our database or business application ...
0
votes
0answers
26 views

Data Model for a Tokenizing Data Storage System

Hashing Strategy for a Tokenizing Data Storage System We are designing the data model (storage at rest, in a database) for a PCI compliant data storage system using Amazon Web Services (AWS) and ...
7
votes
2answers
66 views

Is PCI-DSS Compliance Required with PayPal Donate/Payment Buttons on Websites?

Reading about PCI-DSS 3 recently: Would like confirmation what I am interpreting here - you need PCI-DSS SAQ-A to have credit card associated payment or donation URL links on a merchant's website? ...
2
votes
1answer
66 views

How to not store the card during 3D Secure authentication, to be PCI DSS compliant?

I'm implementing a payment solution where the cardholder enters his card details on our own website. We need to use 3D Secure for extra authentication of the cardholder. Our payment gateway ...
20
votes
3answers
20k views

PCI Compliance Scan Failing for supporting TLS 1.0, but removing support breaks < IE 10

My company is receiving this message causing us to fail our TrustKeeper PCI compliance scan: Note to scan customer: This vulnerability is not recognized in the National Vulnerability Database. TLS ...
5
votes
2answers
947 views

Retention periods for web logs

I work for an ASP that provides banking solutions Card Services Payments ACH Online Banking And others Back Story: Our company provides an "all in one" solution or parts thereof, we are ...
3
votes
1answer
49 views

PCI DSS compliant without private VLAN

I understand that it may be a best practice to hide in-PCI-scope-elements like databases inside a VLAN without a public address and also strict firewall rules. However, my questions is: can ...
3
votes
1answer
39 views

Which SAQ form do I use for PCI DSS compliance?

I run a small business with a Prestashop e-commerce website that sends customers to Sagepay to make a payment using the Presto Chango Sagepay payment module. In my office I also have a one PC ...
3
votes
1answer
91 views

How to design a right VPN connection for an organisation (Interconnected MPLS link or Individual FW)

Thanks in advance for your advice We have to implement VPN connection for nearly 7 countries Option 1 : As we have private MPLS link to all 7 countries. It is been outsourced Third party. They ...
8
votes
2answers
720 views

Unsolicited credit card in email?

I work for an insurance company who will randomly (3-5 times per year) have a consumer who emails their credit card to our customer service department. We don't ask for the number, they just send it ...
1
vote
2answers
2k views

Does sending credit card info over email violates PCI DSS?

Being in the US, I have noticed that more and more companies ask to send sensitive credit card information (all information that is required to make a transaction) over a plain email. I believe that ...
1
vote
1answer
62 views

PCI Penetration Testing - Does the whole infrastructure need to be retested on significant change?

The PCI SCC states the following in their penetration testing guidance: Per PCI DSS Requirements 11.3.1 and 11.3.2, penetration testing must be performed at least annually and after any ...
9
votes
3answers
787 views

PCI Audit: Using “test” cards

I know that the PCI standard does not allow you to use real credit card numbers on test systems. Visa, Mastercard and Amex supply a list of "test" cards to use. Makes perfect sense, and we have been ...
4
votes
1answer
116 views

Banks storing credit card data in plain text?

Are the banks authorized to keep plain text hard copies of full credit card data (Primary account number, CVV, Expiry code, Cardholder name)
1
vote
2answers
39 views

Access Controls on employees handling credit card data

Employee has access to image format of full credit card data on an application (primary account number, cvv, expiry code, name). He copies from this application and enters manually to another ...
1
vote
2answers
85 views

Credit card data sent as a plain image format [closed]

The full Account number data plus Personally Identifiable Information (PII) for a credit card is captured in a document that is scanned as an image for later processing. This image is then uploaded ...
3
votes
2answers
67 views

Clarification of PCI DSS 3.1 requirement 6+8

I'm quite puzzled about the PCI requirements when it comes to session timeouts and scope definitions. The login is the end user/customer login to the public facing control panel in which they can ...
3
votes
2answers
50 views

Firewall UDP Packet Source Port 53 Ruleset Bypass

I have a question regarding recent PCI DSS scan performed on our network. On some of the Windows 2008 servers (physical and VM), there is a risk found "Firewall UDP Packet Source Port 53 Ruleset ...
3
votes
4answers
3k views

Storing CVC / CVV / CVV2 until payment is processed

I need to store the payment info of a transaction. We have a script that reads which transactions haven't yet been sent to our ERP (the business management software), to then send it. This script ...
4
votes
1answer
48 views

ASV scan with reverse proxy

We are PCI compliant as a service provider, however our service port forwards some web traffic at TCP level. Customers use our PCI compliant service and can choose to upload a TLS/SSL certificate to ...
1
vote
1answer
46 views

Do I need PCI DSS compliance when using PayPal Express Checkout?

If I'm using PayPal Express Checkout on my website, am I required to be PCI DSS compliant? PayPal says "With Website Payments Standard, Online Invoicing, Express Checkout and Website Payments Pro ...
3
votes
1answer
116 views

PCI Compliance SAQ-A-EP or SAQ D

Our eCommerce wesbite attracts less than 5000 CC transactions each year and we do no store any CC information in our backend or systems but transmit them to our third party provider. We also use a ...
19
votes
5answers
1k views

Does PCI compliance really reduce risk and improve security?

Might as well bring this hot topic to here! For those not in the know: https://www.pcisecuritystandards.org/
5
votes
1answer
138 views

PCI 3.1 - SAQ D - Supporting Servers

For the past year and a half now, I've been working as the sole individual at a small retail hardware store trying to attain proper (read: not checkbox) compliance, and I am beginning to enter the ...
3
votes
3answers
119 views

Third party analytics/tracking javascript tags and PCI DSS

Although variants of this question have been asked before, they seem to be about general risk, and I'm interested in the PCI DSS connotations. If an e-commerce site is looking for level 1 or level 2 ...
2
votes
2answers
74 views

How do I prevent extra javascript from being added into HTML kiosk in public space?

I'm planning a project which is to be PCI compliant, but I am stuck on a particular vulnerability and I can't think of a way to protect against it. The scenario is that there is a kiosk installed in ...
3
votes
1answer
186 views

Does PCI compliance requires DRP even if we dont store Card data

Our company is does not store any credit card details. We are storing it in a cloud platform which is already PCI compliant. We just require to access the Cloud portal from our company. I understand ...
2
votes
1answer
65 views

What is “cardholder data” in PCI-DSS SAQ A context?

The PCI-DSS SAQ-A questionnaire mentions on page iii that SAQ A merchants confirm that, for this payment channel: (...) Your company retains only paper reports or receipts with ...
1
vote
1answer
244 views

Is zinc.io PCI compliant (/does it need to be)?

zinc.io provides shopping API to programmatically purchase items on Amazon, Best Buy, and Walmart to name a few. A brief observation of its API tells us credit card information is definitely being ...
2
votes
7answers
423 views

PCI Policy Management software? [closed]

I am working on a project to get our company PCI Compliant. One of the key issues I face is managing PCI/Security policies in the organisation. I am responsible for creating the policies and ...
2
votes
2answers
387 views

Best way to scan for and eliminate earlier versions of SSL/TLS in a production environment

Due to new PCI DSS standards mandating that nothing lower than TLS 1.2 be used in a PCI environment, I am tasked with phasing out anything lower than TLS 1.2 on every device in this environment by our ...
3
votes
1answer
75 views

PCI DSS 3.0: 11.3 - What happens if a low risk vulnerability prevents compliance with another requirement?

As I understand the PCI DSS 3.0/3.1 penetration testing requirements, a company is compliant with 11.3 if the penetration test does not return any high risk vulnerabilities. However, what happens if ...
1
vote
1answer
29 views

What PCI standard(s) a payment app (for Smartphones) should comply with in order to be approved by PCI SSC?

We are a company developing apps for Payment Service Provider(s) and in one of our apps Card Holders should enter payment Card data (such as PAN, PIN 2, CVV, Expiration Date) to do a CNP (Card Not ...
2
votes
2answers
26 views

What constitutes submitting payment at a different address for PCI-DSS?

I am attempting to use TransArmor PCI Rapid Comply to verify compliance for my small business. At one point, I have two choices: 1) Customers submit payments at a different web address (i.e. ...
16
votes
6answers
12k views

Can https be used instead of sftp for secure file transfers?

My company works with financials, and we are required to transfer files containing non-public consumer information securely between our company and our clients. The usual solution is to go with sftp ...
3
votes
3answers
502 views

Should I disable TLS 1.0 on my servers?

The PCI Data Security Standard 3.1 recommends disabling "early TLS" along with SSL: SSL and early TLS are not considered strong cryptography and cannot be used as a security control after June 30, ...
1
vote
1answer
31 views

Strong Cryptography in PCI PA-DSS

In PCI PA DSS document, the phrase “Strong Cryptography” is often repeated but I couldn’t find a clear definition for that. Is there any document or PCI standard for that?
4
votes
1answer
124 views

Using Google Cloud Platform to store credit card data

I have made an iPhone app for users to book hotel rooms. A third party provides the service for booking the hotel rooms and charging the credit cards. At the moment, my app makes no attempt to save ...
1
vote
1answer
24 views

How to include third parties in PCI DSS SAQ

When filling in the SAQ for PCI compliance, how do you include requirements covered by a third party provider? Say you're using a PCI compliant VPS provider for example. Do you select 'yes' then ...
2
votes
2answers
157 views

Using a CDN to reduce PCI DSS scope

A common scenario for e-commerce credit card types of transactions is a website with a connection to a third party payment processor. For a number of reasons you might not want to use an iFrame or ...
4
votes
3answers
306 views

Storing credit card information for later manual processing

I am rebuilding a clients eCommerce site using Wordpress and WooCommerce as the framework. Their current eCommerce site takes the credit card information and stores it for later manual processing. To ...
1
vote
2answers
143 views

Validating security log configuration (rsyslog and syslog-ng) for PCI DSS 10.5

I work for a Level 1 merchant with annual onsite QSA audits, so this is a huge deal. PCI DSS 10.5 requires the entity under test to "Secure audit trails so they cannot be altered". In our Unix and ...
21
votes
5answers
4k views

PCI Encryption Key Management

(Full disclosure: I'm already an active participant here and at StackOverflow, but for reasons that should hopefully be obvious, I'm choosing to ask this particular question anonymously). I currently ...
2
votes
2answers
81 views

PCI audits, TLS 1.0, and scoring

I'm new to security in a variety of ways. We have a PCI audit coming up soon. We've put together a risk mitigation/migration plan for TLS 1.0 and have submitted it to the auditors. My boss is ...
4
votes
3answers
185 views

Tools to demonstrate NO storage of cardholder data

Our organization has been asked to comply with PCI DSS. As part of IT Department, we need to demonstrate that none of our IT infrastructure stores any carhdolder data nor sensitive authetication ...
2
votes
1answer
50 views

PCI DSS 3.1 and Windows XP

I'm looking for some clarification on the effects of PCI DSS v3.1. In an consumer ecommerce context (e.g amazon.com), I'm assuming that customers attempting to make credit card purchases on the ...
1
vote
2answers
41 views

Is it PCI-compliant/kosher to send a credit card number to a 3rd party sever from a mobile client?

I am building a mobile app, and part of the the functionality of the app is to place an order with a 3rd party. The 3rd party server accepts a credit card number string. Can I build a mobile client to ...
0
votes
1answer
262 views

PCI Logging Data Elements for Network Devices, Databases and Wireless Networking

What is the best way to figure out what exactly needs to be logged for Network Devices, Databases and Wireless Networking Devices? I'm not an expert in this area but I need to figure out what data ...
2
votes
4answers
71 views

PCI-DSS 3 SAQ - uncertain of level

We are having a debate internally about which SAQ we need to fill in for PCI - our QSA questionnaire says D (and I tend to agree) but company director says SAQ C from reading the guidelines. The way ...
1
vote
1answer
43 views

PCI SAQ C 1.2.1, 1.3.5 and remote server/software

I'm hoping someone here can help me. I'm attempting to get the small nonprofit I work at PCI compliant, as we have been paying an additional $20/month in noncompliance fees to our processor since we ...