An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

learn more… | top users | synonyms

4
votes
3answers
97 views

Can I show Credit Card Data to final customers and be PCI Compliant?

I work with reservation management syatems. In the hospitality industry there is the concept of credit card as guarantee. By it when making any kind of reservation you are asked for your credit card ...
4
votes
3answers
137 views

Dealing with credit card data that is not charged directly

I have a client who is a reseller for vacation packages. For years they've had a payment form on their site where the end user would fill out their credit card data and the information is emailed to ...
5
votes
2answers
123 views

Determining PCI DSS SAQ level

I have a B2B SaaS that my clients then use with their own customers to gather data in a face-to-face scenario with iPads, I would like to expand it to take credit card details. The credit card details ...
2
votes
2answers
77 views

Tools to demonstrate NO storage of cardholder data

Our organization has been asked to comply with PCI DSS. As part of IT Department, we need to demonstrate that none of our IT infrastructure stores any carhdolder data nor sensitive authetication ...
2
votes
1answer
49 views

Distributed tokenization for credit card numbers

I have two locations within the same firm that hold credit card numbers. I want to be able to "join" on credit card number to do business analytics after transmitting card number-linked data from one ...
1
vote
1answer
43 views

PCI DSS 3.0 and card swipe terminals for our merchants

We run an online software service that collects and transmits card transactions for small merchants. They use card swipe terminals connected to their business PCs that direct the traffic straight ...
1
vote
1answer
72 views

Confusion regarding PCI compliance in an office

We use myvirtualmerchant.com (previously Converge, owned by Elavon) to process payments in our doctor's office. Recently, they emailed us that we have to fulfill their partner company's (Trustwave ...
1
vote
1answer
67 views

PCI DSS - Network Design - users connect to internet via proxy;Should we place it at the last hop or before FW?

We need to be PCI compliant. PCI user VLAN is connecting to Internet via proxy but i need confirmation about the location of the proxy. PCI user traffic flow PC ==> ASA FW ==> IPS(integrated with ...
1
vote
1answer
71 views

Does PCI compliance requires DRP even if we dont store Card data

Our company is does not store any credit card details. We are storing it in a cloud platform which is already PCI compliant. We just require to access the Cloud portal from our company. I understand ...
0
votes
1answer
36 views

PCI Compliance and fines

Our organisation has validated compliance with PCI DSS. What are the consequences to us if we had been breached by a security incident related to credit card information, considering we have validated ...
2
votes
0answers
39 views

PCI 3.1 - SAQ D - Supporting Servers

For the past year and a half now, I've been working as the sole individual at a small retail hardware store trying to attain proper (read: not checkbox) compliance, and I am beginning to enter the ...
2
votes
0answers
60 views

How to design a right VPN connection for an organisation (Interconnected MPLS link or Individual FW)

Thanks in advance for your advice We have to implement VPN connection for nearly 7 countries Option 1 : As we have private MPLS link to all 7 countries. It is been outsourced Third party. They ...
2
votes
0answers
76 views

How can I determine whether or not a POS terminal violates requirements in the PCI DSS?

The business I work for uses an Equinox Optimum T4220 (hardware number 060001) in dial-out mode. I see two search results1 for "T4220" listed on the PCI SSC's website under Approved PIN Transaction ...
1
vote
0answers
30 views

PCI process, how to solve mambo vulnerability CVE 2006-0871 on debian 8?

I am involved in the process of becoming pci-dss compliant. I am really close to get it although I am having this vulnerability on the server when I am doing an external scan. Does someone know how to ...
1
vote
0answers
39 views

Internal Vulnerability scans - defining the applicability

If a service provider has a network with thin clients, and they use a citrix portal to access a PCI complaint service provider's cardholder data environment. If the environment is very similar to tho ...
1
vote
0answers
178 views

OSSEC not detecting deleted files?

I have configured 3 VMs: ossec server and two agents in CentOS 6 and Windows 2k8 R2. I have completed the setup and FIM and Log Management works smoothly. It also reports the new files. However, it ...
1
vote
0answers
139 views

Test S/KEY support for PCI compliance - CVE-2007-2243

In order for our business to be PCI compliant, we need to prove that we are not vulnerable to CVE-2007-2243. This states that: OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is ...
1
vote
0answers
83 views

PCI Compliance customer data being made available to another system?

Not completely au fait with PCI compliance, however we have our server checked each month by our host to check it is PCI compliant, because we have to keep it PCI Compliant for a specific ...
0
votes
0answers
72 views

PCI server room on premises: how to handle office visitors?

There is a server room which is part of PCI environment and located inside the office. Access to the server room itself is controlled according to PCI DSS Requirement 9: "Restrict physical access to ...
0
votes
0answers
171 views

PCI-DSS: Recomendations for Mixed-Mode Virtual Environments

We are PCI-DSS 2.0 compliant. We have three internal networks: GENERAL (workstations, app file servers) workstations can RDP to the PCI servers in order to work on the cardholder data. MANAGEMENT ...