An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

learn more… | top users | synonyms

0
votes
1answer
25 views

PCI DSS Compliance for a Level 4 organization

We are a small company and process less than 500 Credit Card transactions each year so we fall under Level 4 category merchants. The company heads wants to make sure that we are PCI compliant at all ...
3
votes
1answer
141 views

Is storing CVV compliant with PCI standards?

From personal, job-related experience I know that many "Booking Engines" store the CVV info for customers' credit cards from the time a reservation is made until the time the guest leaves the hotel. ...
0
votes
1answer
27 views

PCI Compliance - Antivirus in host and virtual environment?

We have a couple servers with a host system, and virtual DB and Web instances. Is it possible to be compliant with PCI if you install the Antivirus only on the host system, or does it need to be ...
2
votes
0answers
30 views

Advice on if I should talk at my local user group about NIST, InfoSec etc [closed]

I have been toying with the idea for a while now about doing my first talk, on my last project I was building a Risk Management portal for information security so I had to read all about Risk ...
-1
votes
0answers
25 views

Which PCI DSS SAQ applies when you store only the last 4 digits of the PAN and the expiry date? [closed]

Which PCI DSS SAQ applies when you store only the last 4 digits of the PAN and the expiry date?
0
votes
0answers
47 views

PCI-DSS: Recomendations for Mixed-Mode Virtual Environments

We are PCI-DSS 2.0 compliant. We have three internal networks: GENERAL (workstations, app file servers) workstations can RDP to the PCI servers in order to work on the cardholder data. MANAGEMENT ...
0
votes
2answers
52 views

Storing CardHolder Data using RC2 encryption

I would like to know if storing credit cardholder data using RC2 encryption requires to be compliant with PCI DSS. Currently the 16 digit PAN number and expiry date is stored in the database. The PAN ...
1
vote
1answer
67 views

PCI DSS 3.0 - Is restricting SSH and/or RDP outbound required?

This question comes up a lot as I do evaluations for different customers. I currently recommend the following: All outbound SSH & RDP blocked by default from user network (non-CDE) All outbound ...
2
votes
2answers
40 views

PCI DSS - mask PAN and log individual access to PAN

How do you re-conciliate two PCI DSS requirements in applications: 3.3 Mask PAN when displayed (the first six and last four digits are the maximum number of digits to be displayed), such that only ...
0
votes
0answers
15 views

PCI service provider and separation

This is connection to my previous question: Shared Database and PCI Compliance However, this question relates to the requirement "Appendix A: Additional PCI DSS Requirements for Shared Hosting ...
4
votes
1answer
67 views

PCI Compliance and PayPal

First, please forgive my ignorance. Until this week, the only "credit card security" I understood was how to hack systems and why to write PHP pages with the types of features I do (msqli, pdo, ...
1
vote
1answer
61 views

Can you store sensitive app config vars in the environment and be PCI compliant?

Note: this is a cross post from my question on SO. Feel free to keep the one in the more relevant location and close the other. We have a rails app which will be deployed on torquebox/jboss. (This in ...
0
votes
2answers
95 views

PCI Compliance - Encrypted Mobile Apps

My company (health care) went through a PCI audit and needs to solve some major issues. Our branches collect CHD on paper and saves them to a network drive as a pdf that our corp office accesses to ...
-1
votes
2answers
45 views

Tools to check the firewall Configurations as per PCI standards [closed]

How do you audit the Firewall rules and configuration policies as per PCI standard. What are the tools used for it.
2
votes
1answer
38 views

PCI - prohibiting direct connections to the Cardholder Data Environment

In PCI 1.3.3 it states: Are direct connections prohibited for inbound or outbound traffic between the Internet and the cardholder data environment? A Cardholder Data Environment (CDE) ...
1
vote
1answer
49 views

What is the difference between Internal and External scan in PCI

Is each firewall interface IP is considered as external IP?. Do we need to scan each interface IP??. What is an internal scan? What are the elements for internal, how we do it?.
0
votes
3answers
917 views

PCI prohibit direct outbound connections on EC2

I am using EC2 instances to power our web service that needs to be PCI SAQ-C compliant. I am trying to figure out what point 1.3 of the self assessment really means: 1.3 Does the firewall ...
2
votes
2answers
85 views

What are the insecure Protocols in terms of PCI DSS

What are the insecure protocols which should be disabled according to PCI DSS standard. How to check those are disabled in Firewalls and Servers.
6
votes
3answers
5k views

PCI DSS requirement 6.4.2 separation of duties between development/test environments

6.4.2 Is there separation of duties between personnel assigned to the development/test environments and those assigned to the production environment? What does the separation of duties here mean? ...
1
vote
2answers
45 views

Shared Database and PCI Compliance

Say we have a cloud based web application which is SaaS. This application is to be made PCI compliant as a service provider, as client card data passes through the application. This application uses a ...
1
vote
1answer
33 views

Code deployment in PCI CDE

The PCI DSS v3 standard states the following: Network Segmentation To be considered out of scope for PCI DSS, a system component must be properly isolated (segmented) from the CDE, such that ...
0
votes
1answer
27 views

Do we require to eliminate share drive access to PCI users?

Do we really require to eliminate the share drive access to the PCI users. We have a file server outside PCI VLAN. But PCI users have access to it. We dont have any DLP solutions. Does the PCI ...
1
vote
2answers
432 views

If am using Stripe am I SAQ A-EP in PCI V3

We are going through the PCI process at the moment and because v2 goes out of date on December 2014, I opted to use PCI v3. Because with Stripe you put the form inside your application and post to ...
3
votes
2answers
2k views

How to satisfy requirement 10.6 of PCI DSS?

The company I'm working for is applying for PCI compliance and I'm in charge of writing most of the required procedures and policies. The problem is that I don't have any experience with IT security, ...
0
votes
2answers
96 views

Security Modules - Hardware vs. Software

In terms of PCI requirements and compliance, is a software-based key management module like Gazzang zTrustee an acceptable solution to the PCI requirements that a (hardware) HSM solution like AWS ...
0
votes
3answers
51 views

Is PCI-DSS compliance required for non-credit card payment source?

We have a banking application that allows you to pay your bills (using your savings/checking account) -- including your credit card bills. However our system was set up such that you enter the credit ...
1
vote
1answer
33 views

PCI Compliance for attachment in email

I am wondering if they are any PCI compliance issues around users of a service sending email with attachments that may or may not contain sensitive information through said service? As an example, if ...
2
votes
1answer
57 views

Conversant, CNAME, Cookies, and PCI complaince

We have been asked to evaluate Conversant Tracking. http://www.conversantmedia.com/solutions/enterprise-solutions From what I can tell its pretty straight forward tracking, like google re-marketing, ...
0
votes
3answers
74 views

PCI Compliance Check-list

I'm currently attempting to wrap my head around PCI compliance - and what I need to do for my business to be compliant. I would like some confirmation on what I've found so far. I accept payments in ...
22
votes
2answers
688 views

Effect on PCI compliance of not checking SSL certificate?

PCI DSS states: "[You must...] verify that only trusted SSL/TLS keys/certificates are accepted." Long story short, our payment service provider just asked us to please stop verifying their ...
0
votes
1answer
51 views

masking credit cards PAN with zeros

The PCI-DSS only requires you to protect the PAN if you are storing MORE THAN the first six and last four digits. Can an all zero mask be used? E.g. 4111 1100 0000 1234 to make it PCI compliant / not ...
3
votes
3answers
415 views

What type of PCI Compliance do I need if I don't hold any card data

I am working with a company that is "PCI Compliant" and in order for them to give me any of their data (customer name, email) they ask that I be "PCI Compliant" even though this data is not credit ...
3
votes
3answers
411 views

PCI compliance if not storing or transmitting credit card data

I have a networked product that we install on customer networks. The device is does not pass any of the CC data, but only sits on the same network (think Nest or Dropcam). The customer networks ...
1
vote
1answer
71 views

My app is asking for card details, but does not stores them. Do I need PCI compliance?

I plan to build an Android/iPhone app. The app will contain a few forms and status screens. One of the screens will ask the user for their card details. Once they'll click submit they'll be sent over ...
2
votes
1answer
57 views

Handling unencrypted HTTP data for a PCI compliant system - in scope for PCI DSS v3 but not v2?

We currently have a custom, cloud based application that can analyse then route HTTP and HTTPS traffic through to a domain. So if a client wants to use our service, they re-point their DNS to our ...
2
votes
1answer
58 views

How do you back up cardholder data remotely without a network connection?

In the PCI DSS version 3 it says: 1.3.3 Do not allow any direct connections inbound or outbound for traffic between the Internet and the cardholder data environment. But in the event of hard ...
0
votes
1answer
220 views

What is an offsite facility as per PCI DSS requirement 9.5.1?

PCI DSS Version 3.0, Requirement 9.5.1 says that we have to store media backups in a secure location, preferably an off-site facility such as an alternative or backup site or a commercial storage ...
2
votes
2answers
79 views

Internal Update Server in PCI environment

I am curious to know if we require separate update server in our cloud based PCI environment. In our current setup webserver, appserver, dbserver, logserver, and jump server are independent instance. ...
4
votes
2answers
922 views

How to pass PCI DSS 2.0 anti-virus requirement (5.1) on Linux?

PCI DSS 2.0 Requirement 5.1 states: 5.1 Deploy anti-virus software on all systems commonly affected by malicious software (particularly personal computers and servers). This requirement ...
-1
votes
1answer
146 views

PCI compliant transparent data encryption at disk/folder level on Windows?

Is there a way to achieve PCI compliant data encryption at disk/folder level in Windows in a way that is transparent to applications(they must be able to write/read to encrypted folders/disks as if ...
8
votes
2answers
1k views

Is there a way for a consumer to report PCI non compliance?

Is there a way for a consumer to report PCI non compliance?
1
vote
3answers
113 views

How are HSMs used in payment processing on the server?

I came to know recently that HSMs are used in credit card processing on the server side but since I don't work in that space and stumped as to why its needed. I can see it used in an ATM machine - ...
1
vote
1answer
150 views

TrustWave PCI Compliance - OpenSSH

First time 'asker' on here, but wanted to say thanks to how much I've used this site and reading answers to questions I've had! Anyway, lately I've been having issues with a customer of ours who's ...
4
votes
2answers
157 views

SAQ A-EP Requirements for VPS Hosting

We are hosting a site on a self-managed Digital Ocean VPS ("Droplet") that will be taking payments via Stripe using their stripe.js API. According to PCI, we have determined that we fall under the SAQ ...
0
votes
2answers
78 views

PCI compliance and external resources http/https

Firstly, if a site is PCI compliant, and new references to a 3rd-party file (e.g. image, Javascript, CSS, etc…) via http:// instead of https:// are added, does it violate PCI compliance? Secondly, ...
0
votes
1answer
267 views

What can a hacker do with a card number without CVV? [duplicate]

From my experience a card can not be used for online payment without a valid CVV, then why is it still always emphasized that card number must be protected? What can a hacker do, assume that he has ...
0
votes
4answers
208 views

Using a Public-Key-Encryption browser side to avoid PCI compliance

We're developing a web application in which certain not logged users (clients) need to send their credit card details to other users (merchants) - which, we'll assume, are PCI compliant. We are ...
5
votes
1answer
111 views

Is a Linux environment PCI compliant if the swap file is not encrypted and PANs are loaded into RAM?

Is a Linux environment PCI compliant if the swap partition/file is not encrypted and PANs are loaded into RAM by an application?
3
votes
1answer
458 views

How can Stripe be PCI-compliant?

According to the Stripe FAQ, they are PCI-compliant. Also, in their API documentation, one of the parameters to create a new card is the CVC (although, granted, it is optional). So, I assume they ...
1
vote
2answers
60 views

pci compliance and temporary files

Does storing temporarily a non-encrypted file containing some PANs violate pci requirements? (for example because it is being processed by an application, or to open it on a file editor)