An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

learn more… | top users | synonyms

3
votes
1answer
63 views

Is a Linux environment PCI compliant if the swap file is not encrypted and PANs are loaded into RAM?

Is a Linux environment PCI compliant if the swap partition/file is not encrypted and PANs are loaded into RAM by an application?
0
votes
1answer
29 views

PCI compliant transparent data encryption at disk/folder level on windows?

Is there a way to achieve pci compliant data encryption at disk/folder level in windows in a way that is transparent to applications(they must be able to write/read to encrypted folders/disks as if ...
3
votes
1answer
376 views

How can Stripe be PCI-compliant?

According to the Stripe FAQ, they are PCI-compliant. Also, in their API documentation, one of the parameters to create a new card is the CVC (although, granted, it is optional). So, I assume they ...
1
vote
2answers
34 views

pci compliance and temporary files

Does storing temporarily a non-encrypted file containing some PANs violate pci requirements? (for example because it is being processed by an application, or to open it on a file editor)
1
vote
2answers
45 views

Using Free AV to meet PCI Requirement 5

I am looking for some opinions on using free AV for meet PCI requirement 5. The way I read this for version 2.0 is that it's entirely possible for a client to meet their AV needs with the modern free ...
1
vote
2answers
45 views

Internal Update Server in PCI environment

I am curious to know if we require separate update server in our cloud based PCI environment. In our current setup webserver, appserver, dbserver, logserver, and jump server are independent instance. ...
1
vote
4answers
124 views

Storing CVC / CVV / CVV2 until payment is processed

I need to store the payment info of a transaction. We have a script that reads which transactions haven't yet been sent to our ERP (the business management software), to then send it. This script ...
1
vote
1answer
79 views

If am using Stripe am I SAQ A-EP in PCI V3

We are going through the PCI process at the moment and because v2 goes out of date on December 2014, I opted to use PCI v3. Because with Stripe you put the form inside your application and post to ...
2
votes
1answer
92 views

How much information is released when paying with a debit card

How much information is released when paying with a debit card? Is it possible for a vendor to grab your name and address from your debit card and send you things in the mail?
1
vote
1answer
123 views

is it illegal to share customer credit card data

I have an app where users can enter credit card data and it is stored using a 3rd party toservice like BluePay or Authorize.net, I do not and will not save it in my system. Trying to get this point ...
0
votes
1answer
23 views

PCI questions regarding software

As a software company who is looking at writing something that could handle debit cards can I self certify my software or do I have to have it tested by a 3rd party company?
16
votes
3answers
1k views

How to store credit card information for repeated transactions and still be PCI compliant?

I'm overhauling our absolute time-bomb of an order processing system that would put us out of business tomorrow were we audited for PCI compliance. It's so amateur it's scary. I'm planning on making ...
0
votes
1answer
330 views

Can someone please briefly explain HIPPA compliance?

I worked in web hosting for several years, particularly security. I am familiar with PCI compliance and I would say the "short and sweet" guide to PCI for an eCommerce store is as follows: Client ...
1
vote
1answer
40 views

Does PCI DSS 1.4 include tablets and smartphones?

1.4 install personal firewall software on any mobile and/or employee-owned computers with direct connectivity to the Internet (for example, laptops used by employees), which are used to access the ...
3
votes
2answers
292 views

How to pass PCI DSS 2.0 anti-virus requirement (5.1) on Linux?

PCI DSS 2.0 Requirement 5.1 states: 5.1 Deploy anti-virus software on all systems commonly affected by malicious software (particularly personal computers and servers). This requirement ...
0
votes
1answer
57 views

Security Modules - Hardware vs. Software

In terms of PCI requirements and compliance, is a software-based key management module like Gazzang zTrustee an acceptable solution to the PCI requirements that a (hardware) HSM solution like AWS ...
1
vote
1answer
77 views

Can I show PCI compliant Logo

I have just now got 20 of my e-commerce websites scanned and certified by Comodo. I will be submitting them to my banks as well to prove that I am PCI compliant. But is there any regulation on who ...
2
votes
3answers
802 views

Vulnerability scanning applicability for PCI DSS

I'm fully up to speed on PCI DSS requirements and have attend the ISA course recently. The course was helpful and I was able to bounce ideas off of the trainer. However I keep coming back to one ...
2
votes
1answer
152 views

Field-level encryption vs disk encryption for PCI compliance

We are in the process of setting up a PCI compliant server (with Firehost's help). We are using MongoDB as our primary database. I am having some concerns about the encryption, though. Are there any ...
0
votes
1answer
49 views

Multiple websites hosted on same server

We have two severs sitting under one load balancer. We run PCI scans on those two servers. Now, when we started, we only had 2 websites running from these two server. But the business is growing ...
0
votes
1answer
70 views

PCI-DSS Requirement for Application Level Security?

Before I arrived at my current company we obtained the services of PCI consultant who gave us some very specific, if questionable, advice on encryption requirements. The particular piece of advice I ...
2
votes
2answers
87 views

Is PCI Compliance mandatory?

I recently started working on an eCommerce addition to a site I'm working on.In my research looking for a way to do SSL without a certificate/a free certificate I came across PCI Compliance.I have ...
1
vote
1answer
55 views

PCI compliance over two domains

We have an eCommerce website hosted on a dedicated server. We get our PCI compliance report from Qualays and there is no problem with that. However, now we want to test something new on Amazon's AWS ...
0
votes
1answer
99 views

Hashing PAN numbers

According to this blog PAN number should be hashed using a "secret salt". What they are doing is basically H(Message+salt). The reason you need this "secret salt" is because PAN numbers are limited to ...
1
vote
2answers
78 views

PCI Definition of “Transmission”

I am working at a company that is PCI compliant, but I believe they have interpreted some of the requirements incorrectly. Because of this, they are laboring to create work-arounds which I suspect are ...
4
votes
2answers
87 views

Are invalid card numbers under PCI compliance

If a merchant sends an invalid card number to the bank, will the bank have to secure the information to be PCI compliant?
7
votes
2answers
202 views

Unsolicited credit card in email?

I work for an insurance company who will randomly (3-5 times per year) have a consumer who emails their credit card to our customer service department. We don't ask for the number, they just send it ...
19
votes
1answer
2k views

Has anyone achieved PCI compliance on AWS?

All the FAQs, documents and statements published by AWS aside, did any Level 1 merchant or service provider actually achieve PCI compliance on AWS yet? We're evaluating moving some of our services to ...
1
vote
0answers
61 views

Test S/KEY support for PCI compliance - CVE-2007-2243

In order for our business to be PCI compliant, we need to prove that we are not vulnerable to CVE-2007-2243. This states that: OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is ...
1
vote
2answers
235 views

Internal / external Penetration testing a webserver - PCI

the PCI DSS document states: 11.3.2 Perform internal penetration testing at least annually and after any significant infrastructure or application upgrade or modification (such as an operating ...
0
votes
1answer
417 views

Which is the Best Cipher Mode and Padding Mode for AES Encryption? [closed]

As per PCI-DSS 3.4 requirement: For storing Credit Card Data Strong Cryptography should be used. I decided to use AES Encryption which is a strong and mostly recommended crypto for encrypting ...
8
votes
1answer
187 views

What is the difference between HSM and Key server?

As per PCI-DSS requirements, we have to use either HSM (Hardware Security Module), or Key Server to store the KEK (Key Encryption Key). If I'm storing encrypted DEK (Data Encryption Key) in an App ...
1
vote
0answers
25 views

How to store Initialization Vector securely for AES Encryption? [duplicate]

I'm using AES Encryption for encrypting credit card details and so I will store my DEK in Ecnrypted form and do we need to encrypt the Initialization vector for storage?
3
votes
1answer
300 views

How to decrypt the Encrypted DEK using KEK which are separated in servers?

Decrypting the DEK using KEK under PCI-Standards, which are separated by Servers: Let say for example we have server1 and server2 Server1: It is in East US, called it as Application Server. ...
3
votes
2answers
68 views

Legacy system PCI Compliance

I have a legacy system that collects and stores credit card numbers ( BAD! ). We are in the process of replacing that system in phases. We are going to integrate with a credit card processing system ...
5
votes
1answer
172 views

What does the PCI-DSS statement “Store separately from the data encrypting key” mean?

As per the PCI-DSS 3.5.2 requirement Encrypted with a key-encrypting key that is at least as strong as the data-encrypting key, and that is stored separately from the data encrypting key. Does this ...
5
votes
3answers
300 views

Failed PCI-DSS Compliance | Submitting Evidence

One of our web servers that is managed by a service provider (completely in their control, we have no login access) just failed PCI-DSS vuln. scan by TrustKeeper. The vuln scan detected the box as a ...
3
votes
1answer
162 views

Is it safe to save customer information from Stripe? Do we need to be PCI compliant?

Following their tutorial, Stripe allows to save customer and charge them later. But, does one have to be PCI compliant? In their API Reference, it seems they give lot of information to be stored ...
0
votes
1answer
88 views

What is the diffference between HSM and PTS-approved point-of-interaction device?

According to PCI-DSS requirement 3.5.2: We should store secret keys in a cryptographic device. Cryptographic devices: 1.HSM 2.PTS-approved point of interaction device My questions: I have some ...
0
votes
2answers
207 views

How to implement PCI DSS requirement 3.5.2?

According to PCI-DSS requirement 3.5.2: Secret and private keys used to encrypt /decrypt cardholder data should be stored in one of the following forms at all times: Encrypted with a key-encrypting ...
3
votes
4answers
173 views

Risk management with software code analysis

I am a programmer by day and I am working on a project that is focused around risk management based on PCI-DSS controls within an organisation. I have been thinking lately that a lot of PCI-DSS ...
13
votes
3answers
3k views

Nessus vs third-party scans

As part of our PCI-DSS compliance process we get scans done by a third party. Based on the form and wording of the output, it's pretty clear they're using Nessus for most of their heavy lifting. Same ...
4
votes
3answers
2k views

PCI-DSS compliance for business with only swipe terminals

I support the IT infrastructure for a small retail business which is now required to undergo a PCI-DSS assessment. The payment service and terminal provider (Streamline) has asked that we use ...
0
votes
1answer
106 views

How to store media backups in a secure location(Offsite facility) as per PCI DSS requirement 9.5.1?

In PCI DSS Version 3.0, Requirement 9.5.1: According to this requirement 9.5.1, we have to store the media backups in a secure location, preferably an off-site facility, such as an ...
1
vote
2answers
238 views

PCI DSS - only one primary function per server

The PCI DSS says that a server can have only one primary function and i'm a little confused over what it means by 'one primary function' we have a webserver with database - web pages and email is ...
0
votes
2answers
285 views

Is it PCI compliant to send credit card details to the server without saving them there?

Considering I use SSL the whole process. I have an IOS client that I want to use to enter the user's credit card details. I want to do the whole charging and processing on the server side, so I send ...
1
vote
2answers
142 views

Does server RAM count as storage for PCI Compliance?

We are an eCommerce website. I'm working on our PCI compliance at the moment, and I'm trying, if at all possible, to argue that our organisation falls under SAQ A rather than D. We do not sensitive ...
1
vote
1answer
91 views

PCI DSS compliance for storing PAN and PII in multi-tenant environment

I wanted to know if I can still be PCI compliant if I store card holder and PII information for multiple tenants in the same database? I.e., have an identifier on the table level to identify the ...
2
votes
1answer
110 views

After the Cryptoperiod timespan, do we need to encrypt all the data again?

As per PCI-DSS we need to dispose the old keys after the timespan. After the cryptoperiod (lets say one year) time span, do I need to encrypt all (20k card holders) the data once again with the newly ...
1
vote
1answer
317 views

How to process or manage Key-Encryption-Key using HSM?

Let's consider two Encryption keys: 1.Data-Encryption-Key(DEK) 2.Key-Encryption-Key(KEK) KEK will be securely stored in HSM, which will be encrypted using master key. Data Encryption Key will be ...