An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.
17
votes
5answers
730 views
Does PCI compliance really reduce risk and improve security?
Might as well bring this hot topic to here!
For those not in the know: https://www.pcisecuritystandards.org/
12
votes
3answers
2k views
Nessus vs third-party scans
As part of our PCI-DSS compliance process we get scans done by a third party. Based on the form and wording of the output, it's pretty clear they're using Nessus for most of their heavy lifting. Same ...
7
votes
3answers
175 views
Securing an E-commerce site
I'm building a custom e-commerce site, and the user will input their credit card details on the site instead of being directed to the payment gateway's site.
I'm confused as to what the critical ...
7
votes
7answers
2k views
Storing credit cards for automatic payments?
I have no experience with storing credit cards and I do not know anything about the legal end of this.
The company I work for / develop for wants to store credit cards to process auto payments for ...
5
votes
3answers
464 views
Where do I securely store the key for a system where the source is visible?
I have a customer with an Access database (ugh!) in which credit cards are stored in plaintext (yikes!), so amongst other changes I'm doing in the app, I'm applying some encryption in there.
I've ...
4
votes
2answers
241 views
Is PCI DSS applicable to other solutions than those dealing with payment cards?
According to this quote from "applicability" section of PCI DSS it's not:
The primary account number is the
defining factor in the applicability
of PCI DSS requirements. PCI DSS
requirements ...
2
votes
3answers
115 views
PCI Compilance - Custom payment processor
Consider following situation:
We have location A where we have our online store.
We have location B where we have payment processing. Server is dedicated to do only payment processing jobs
We can ...
2
votes
2answers
92 views
HTML 5 postMessage PCI compliant
We're building an application (App-A) that will allow a user to enter credit card information. This application will live on a non PCI compliant zone.
We have another application (App-B) that also ...
9
votes
2answers
468 views
logging requirements for PCI for web applications
Does PCI dictate how much should be logged at an application level or simply what shouldn't be logged?
I'm struggling with too much logging right now and some people who think we should have it. From ...
18
votes
1answer
1k views
Has anyone achieved PCI compliance on AWS?
All the FAQs, documents and statements published by AWS aside, did any Level 1 merchant or service provider actually achieve PCI compliance on AWS yet? We're evaluating moving some of our services to ...
7
votes
4answers
1k views
Is Facebook Connect or Twitter OAuth PCI Compliant?
We have a system that stores credit cards securely on file. We'd love to allow users to sign up using Facebook Connect or Twitter.
Obviously this wouldn't be secure if we were trusting just any old ...
6
votes
3answers
2k views
Storing Credit Card Numbers
I'll be making a website with a membership type of option for the website, and I'll be most likely using Authorize.Net to make the transactions, however, I need to know what kind of encryption I can ...
4
votes
2answers
2k views
PCI DSS requirement 6.4.2 separation of duties between development/test environments
6.4.2 Is there separation of duties between personnel assigned to the development/test environments and those assigned to the production environment?
What does the separation of duties here mean? ...
2
votes
2answers
459 views
Why does Amazon ask for the CVC/CVV if it bills without it?
I have a follow-up question relating to this question:
How does Amazon bill me wihout the CVC / CVV / CVV2?
If amazon.com can bill without the CVV why does it ask for it the first time information ...
17
votes
4answers
1k views
Why doesn't the client's web browser need to be PCI compliant?
A hypothetical online store that accepts credit card payment will have to be PCI compliant because it receives (transmit), process and possibly store credit card numbers.
But the client's web browser ...
7
votes
4answers
388 views
Wireless Activity Monitoring for PCI DSS Compliance
In an effort to be PCI DSS compliant, I took a trustkeeper.net questionnaire. I failed the question that asks
Is the presence of wireless access points tested for by using a wireless analyzer at ...
5
votes
1answer
346 views
PCI - what qualifies as public access?
My development staff is in the process of automating our end of month process.
There is a small manual step that needs to be executed.
We have been thinking about the PCI ramifications for making ...
2
votes
3answers
242 views
Vulnerability scanning applicability for PCI DSS
I'm fully up to speed on PCI DSS requirements and have attend the ISA course recently. The course was helpful and I was able to bounce ideas off of the trainer. However I keep coming back to one ...
