The tag has no wiki summary.

learn more… | top users | synonyms

4
votes
2answers
38 views

Source code scanning - PCI Requirement - Service Provider

I've been doing a lot of research regarding the requirements for source code scanning but haven't found anything conclusive when it comes to my question below. So I need some guidance from PCI Experts ...
1
vote
1answer
74 views

Can Windows 8 be PCI compliant?

I am in the process of getting PCI. I am in the last step in which I would need a secure PC on my internal network. All the scans I must run are only available through a plugin in browsers for Windows ...
4
votes
3answers
98 views

Can I show Credit Card Data to final customers and be PCI Compliant?

I work with reservation management syatems. In the hospitality industry there is the concept of credit card as guarantee. By it when making any kind of reservation you are asked for your credit card ...
1
vote
0answers
31 views

PCI process, how to solve mambo vulnerability CVE 2006-0871 on debian 8?

I am involved in the process of becoming pci-dss compliant. I am really close to get it although I am having this vulnerability on the server when I am doing an external scan. Does someone know how to ...
0
votes
2answers
67 views

PCI-DSS, what is the best distro? [closed]

What is the best distro of Linux to get PCI-DSS compliant? I am using Debian 8 because I think Debian is one of the most stable versions, but it seems not to be enough, I am struggling with a lot of ...
1
vote
0answers
30 views

What are the differences between DIACAP and RMF?

I am currently certifying systems (products) under DIACAP (DoD Information Assurance Certification and Accreditation Process). In the future we will need to use RMF (Risk Management Framework). What ...
0
votes
1answer
99 views

Is PCI SAQ A or A-EP applicable for my use case?

I read the FAQ over here andI feel that we do not need to be PCI Compliance but I have read many other posts, articles etc which seem to contradict my assumption. So I was wondering if any of you guys ...
1
vote
1answer
67 views

PCI DSS - Network Design - users connect to internet via proxy;Should we place it at the last hop or before FW?

We need to be PCI compliant. PCI user VLAN is connecting to Internet via proxy but i need confirmation about the location of the proxy. PCI user traffic flow PC ==> ASA FW ==> IPS(integrated with ...
1
vote
1answer
71 views

Does PCI compliance requires DRP even if we dont store Card data

Our company is does not store any credit card details. We are storing it in a cloud platform which is already PCI compliant. We just require to access the Cloud portal from our company. I understand ...
3
votes
2answers
94 views

Backup procedure for PCI

Our company is does not store any credit card details but we do transmit them. We are storing it in a cloud platform which is already PCI compliant. We just require to access the Cloud portal from ...
1
vote
1answer
97 views

Can we use same Active directory / Proxy servers for PCI and Non PCI Segment users?

Can we use the same AD server for both PCI VLAN user and Non PCI VLAN users? How about proxy, we have a Proxy but both PCI and Non PCI user's traffic are flowing through those Proxy. But we have ...
1
vote
1answer
192 views

PCI DSS - Recorded Phone Conversations

I am using the using the following image from FishNet Security as a sort of guide for the data flow diagram required by PCI DSS as defined by: 1.1.3 Current diagram that shows all cardholder ...
0
votes
1answer
90 views

PCI Compliance - Antivirus in host and virtual environment?

We have a couple servers with a host system, and virtual DB and Web instances. Is it possible to be compliant with PCI if you install the Antivirus only on the host system, or does it need to be ...
0
votes
0answers
172 views

PCI-DSS: Recomendations for Mixed-Mode Virtual Environments

We are PCI-DSS 2.0 compliant. We have three internal networks: GENERAL (workstations, app file servers) workstations can RDP to the PCI servers in order to work on the cardholder data. MANAGEMENT ...
1
vote
2answers
103 views

Shared Database and PCI Compliance

Say we have a cloud based web application which is SaaS. This application is to be made PCI compliant as a service provider, as client card data passes through the application. This application uses a ...
1
vote
1answer
158 views

Code deployment in PCI CDE

The PCI DSS v3 standard states the following: Network Segmentation To be considered out of scope for PCI DSS, a system component must be properly isolated (segmented) from the CDE, such that ...
2
votes
1answer
97 views

Handling unencrypted HTTP data for a PCI compliant system - in scope for PCI DSS v3 but not v2?

We currently have a custom, cloud based application that can analyse then route HTTP and HTTPS traffic through to a domain. So if a client wants to use our service, they re-point their DNS to our ...
1
vote
1answer
693 views

TrustWave PCI Compliance - OpenSSH

First time 'asker' on here, but wanted to say thanks to how much I've used this site and reading answers to questions I've had! Anyway, lately I've been having issues with a customer of ours who's ...
2
votes
2answers
1k views

If am using Stripe am I SAQ A-EP in PCI V3

We are going through the PCI process at the moment and because v2 goes out of date on December 2014, I opted to use PCI v3. Because with Stripe you put the form inside your application and post to ...
0
votes
1answer
126 views

Is a PCI scan required for LAN outer firewall with no open ports?

I have recently been trying to get my company ip addresses scanned with Comodo HackerGuardian. My website needed some adjustments to ssl but after they were made it passed the scan. As we also have a ...
1
vote
1answer
164 views

Does PCI DSS 1.4 include tablets and smartphones?

1.4 install personal firewall software on any mobile and/or employee-owned computers with direct connectivity to the Internet (for example, laptops used by employees), which are used to access the ...
1
vote
1answer
87 views

PCI Compliance relating to 'other' passwords

I see PCI compliance related only to password security, as far as storage and transmission goes, for user names and email accounts. How does this relate to passwords for programs that run on a PCI ...
1
vote
2answers
131 views

PCI Definition of “Transmission”

I am working at a company that is PCI compliant, but I believe they have interpreted some of the requirements incorrectly. Because of this, they are laboring to create work-arounds which I suspect are ...
1
vote
1answer
129 views

Data Protection act, who is liable? [closed]

Recently, a large UK shopping chain had the staff payroll database leaked (including bank details, all unencrypted) We've been told that we cannot take legal action and have so far been denied ...
1
vote
1answer
82 views

PCI approved device, does it matter if my POS is PCI compliant if it just passes info to the gateway and does not store the encrypted card data?

If my Hardware device is on the PCI list from here https://www.pcisecuritystandards.org/approved_companies_providers/approved_pin_transaction_security.php Does my POS need to be PCI compliant since ...
3
votes
3answers
995 views

PCI DSS - only one primary function per server

The PCI DSS says that a server can have only one primary function and i'm a little confused over what it means by 'one primary function' we have a webserver with database - web pages and email is ...
0
votes
2answers
807 views

Encryption of PCI data, and PCI-DSS scoping

I read another question which made me think... If you encrypt PCI data (credit card numbers, etc.) using PGP or AES and send it through a firewall, is that firewall in scope? Alternatively, what ...
2
votes
2answers
152 views

PCI-DSS Is the infrastructure really in-scope?

Say I have an application that takes credit cards, but this is actually a payment gateway on the internet that I don't control. The web site used HTTPS and only returns if the card was authorized or ...
1
vote
2answers
110 views

Antivirus / Wireless PCI v2 Controls Scope

Do the Antivirus / Wireless controls within PCI v2 apply for the entire organisation, or just for the PCI scope?
1
vote
0answers
83 views

PCI Compliance customer data being made available to another system?

Not completely au fait with PCI compliance, however we have our server checked each month by our host to check it is PCI compliant, because we have to keep it PCI Compliant for a specific ...
2
votes
1answer
503 views

Is it OK to generate a token for a credit card without the user's permission? Is that PCI compliant?

Is it PCI compliant to generate a token for every card used for processing, regardless of whether the client asked for his card to be saved or not?
4
votes
1answer
584 views

PCI-DSS Network Segmentation and encrypted administrative interfaces

I'm using the 3/2/1 network segmentation model from the open pci dss scoping toolkit and I'm running into a bit of a mental roadblock. I have a phone system (Mitel 5000 series, if it matters) that is ...