The tag has no usage guidance.

learn more… | top users | synonyms

3
votes
3answers
44 views

Boundaries of Personally Identifiable Information - PCI-DSS

I am attempting to ascertain the boundaries of personally identifiable information. For example does the combination of John and Doe equate to personally identifiable information since there could ...
3
votes
2answers
62 views

Risks of using a webpage without SSL/TLS for donations

There is a site called www.mysite.com. It uses Qgiv for taking donations and has some HTML5 data-attributes like: <div class="qgiv-embed-container visible-lg-block" > data-qgiv-embed="true" ...
1
vote
2answers
35 views

PA-DSS & DTMF application

If the payment application is not storing any credit card information, does it needs to be PA-DSS? The application takes the Credit card information using DTMF and pass-through via secure XML for ...
2
votes
1answer
57 views

PCI Scope, Tokens, and Processor APIs

A merchant receives a processor provided payment token in response to an authorization from an online order (for the sake of this question assume this part of the process has all its PCI t-s crossed ...
3
votes
1answer
70 views

PCI DSS compliant without private VLAN

I understand that it may be a best practice to hide in-PCI-scope-elements like databases inside a VLAN without a public address and also strict firewall rules. However, my questions is: can ...
3
votes
2answers
149 views

Clarification of PCI DSS 3.1 requirement 6+8

I'm quite puzzled about the PCI requirements when it comes to session timeouts and scope definitions. The login is the end user/customer login to the public facing control panel in which they can ...
4
votes
1answer
52 views

ASV scan with reverse proxy

We are PCI compliant as a service provider, however our service port forwards some web traffic at TCP level. Customers use our PCI compliant service and can choose to upload a TLS/SSL certificate to ...
2
votes
1answer
201 views

Using a CDN to reduce PCI DSS scope

A common scenario for e-commerce credit card types of transactions is a website with a connection to a third party payment processor. For a number of reasons you might not want to use an iFrame or ...
0
votes
1answer
243 views

PCI requirement 8.3 - 2FA for all network access originating outside the network

Requirement 8.3: Incorporate two-factor authentication for remote network access originating from outside the network by personnel (including users and administrators) and all third parties, ...
5
votes
2answers
285 views

Source code scanning - PCI Requirement - Service Provider

I've been doing a lot of research regarding the requirements for source code scanning but haven't found anything conclusive when it comes to my question below. So I need some guidance from PCI Experts ...
1
vote
1answer
116 views

Can Windows 8 be PCI compliant?

I am in the process of getting PCI. I am in the last step in which I would need a secure PC on my internal network. All the scans I must run are only available through a plugin in browsers for Windows ...
6
votes
5answers
166 views

Can I show Credit Card Data to final customers and be PCI Compliant?

I work with reservation management syatems. In the hospitality industry there is the concept of credit card as guarantee. By it when making any kind of reservation you are asked for your credit card ...
1
vote
0answers
34 views

PCI process, how to solve mambo vulnerability CVE 2006-0871 on debian 8?

I am involved in the process of becoming pci-dss compliant. I am really close to get it although I am having this vulnerability on the server when I am doing an external scan. Does someone know how to ...
0
votes
2answers
163 views

PCI-DSS, what is the best distro? [closed]

What is the best distro of Linux to get PCI-DSS compliant? I am using Debian 8 because I think Debian is one of the most stable versions, but it seems not to be enough, I am struggling with a lot of ...
2
votes
1answer
258 views

What are the differences between DIACAP and RMF?

I am currently certifying systems (products) under DIACAP (DoD Information Assurance Certification and Accreditation Process). In the future we will need to use RMF (Risk Management Framework). What ...
0
votes
1answer
228 views

Is PCI SAQ A or A-EP applicable for my use case?

I read the FAQ over here andI feel that we do not need to be PCI Compliance but I have read many other posts, articles etc which seem to contradict my assumption. So I was wondering if any of you guys ...
2
votes
1answer
159 views

PCI DSS - network design - users connect to internet via proxy; should we place it at the last hop or before firewall?

We need to be PCI compliant. PCI user VLAN is connecting to Internet via proxy, but I need confirmation about the location of the proxy. PCI user traffic flow: PC ==> ASA FW ==> IPS ...
3
votes
1answer
228 views

Does PCI compliance requires DRP even if we dont store Card data

Our company is does not store any credit card details. We are storing it in a cloud platform which is already PCI compliant. We just require to access the Cloud portal from our company. I understand ...
3
votes
2answers
204 views

Backup procedure for PCI

Our company is does not store any credit card details but we do transmit them. We are storing it in a cloud platform which is already PCI compliant. We just require to access the Cloud portal from ...
1
vote
1answer
273 views

Can we use same Active directory / Proxy servers for PCI and Non PCI Segment users?

Can we use the same AD server for both PCI VLAN user and Non PCI VLAN users? How about proxy, we have a Proxy but both PCI and Non PCI user's traffic are flowing through those Proxy. But we have ...
1
vote
1answer
466 views

PCI DSS - Recorded Phone Conversations

I am using the using the following image from FishNet Security as a sort of guide for the data flow diagram required by PCI DSS as defined by: 1.1.3 Current diagram that shows all cardholder ...
0
votes
1answer
108 views

PCI Compliance - Antivirus in host and virtual environment?

We have a couple servers with a host system, and virtual DB and Web instances. Is it possible to be compliant with PCI if you install the Antivirus only on the host system, or does it need to be ...
1
vote
2answers
161 views

Shared Database and PCI Compliance

Say we have a cloud based web application which is SaaS. This application is to be made PCI compliant as a service provider, as client card data passes through the application. This application uses a ...
1
vote
1answer
254 views

Code deployment in PCI CDE

The PCI DSS v3 standard states the following: Network Segmentation To be considered out of scope for PCI DSS, a system component must be properly isolated (segmented) from the CDE, such that ...
3
votes
1answer
138 views

Handling unencrypted HTTP data for a PCI compliant system - in scope for PCI DSS v3 but not v2?

We currently have a custom, cloud based application that can analyse then route HTTP and HTTPS traffic through to a domain. So if a client wants to use our service, they re-point their DNS to our ...
1
vote
1answer
1k views

TrustWave PCI Compliance - OpenSSH

First time 'asker' on here, but wanted to say thanks to how much I've used this site and reading answers to questions I've had! Anyway, lately I've been having issues with a customer of ours who's ...
2
votes
2answers
2k views

If am using Stripe am I SAQ A-EP in PCI V3

We are going through the PCI process at the moment and because v2 goes out of date on December 2014, I opted to use PCI v3. Because with Stripe you put the form inside your application and post to ...
0
votes
1answer
191 views

Is a PCI scan required for LAN outer firewall with no open ports?

I have recently been trying to get my company ip addresses scanned with Comodo HackerGuardian. My website needed some adjustments to ssl but after they were made it passed the scan. As we also have a ...
1
vote
1answer
258 views

Does PCI DSS 1.4 include tablets and smartphones?

1.4 install personal firewall software on any mobile and/or employee-owned computers with direct connectivity to the Internet (for example, laptops used by employees), which are used to access the ...
1
vote
1answer
140 views

PCI Compliance relating to 'other' passwords

I see PCI compliance related only to password security, as far as storage and transmission goes, for user names and email accounts. How does this relate to passwords for programs that run on a PCI ...
1
vote
3answers
205 views

PCI Definition of “Transmission”

I am working at a company that is PCI compliant, but I believe they have interpreted some of the requirements incorrectly. Because of this, they are laboring to create work-arounds which I suspect are ...
1
vote
1answer
141 views

Data Protection act, who is liable? [closed]

Recently, a large UK shopping chain had the staff payroll database leaked (including bank details, all unencrypted) We've been told that we cannot take legal action and have so far been denied ...
1
vote
1answer
97 views

PCI approved device, does it matter if my POS is PCI compliant if it just passes info to the gateway and does not store the encrypted card data?

If my Hardware device is on the PCI list from here https://www.pcisecuritystandards.org/approved_companies_providers/approved_pin_transaction_security.php Does my POS need to be PCI compliant since ...
3
votes
3answers
2k views

PCI DSS - only one primary function per server

The PCI DSS says that a server can have only one primary function and i'm a little confused over what it means by 'one primary function' we have a webserver with database - web pages and email is ...
0
votes
2answers
1k views

Encryption of PCI data, and PCI-DSS scoping

I read another question which made me think... If you encrypt PCI data (credit card numbers, etc.) using PGP or AES and send it through a firewall, is that firewall in scope? Alternatively, what ...
2
votes
2answers
186 views

PCI-DSS Is the infrastructure really in-scope?

Say I have an application that takes credit cards, but this is actually a payment gateway on the internet that I don't control. The web site used HTTPS and only returns if the card was authorized or ...
1
vote
2answers
113 views

Antivirus / Wireless PCI v2 Controls Scope

Do the Antivirus / Wireless controls within PCI v2 apply for the entire organisation, or just for the PCI scope?
1
vote
0answers
88 views

PCI Compliance customer data being made available to another system?

Not completely au fait with PCI compliance, however we have our server checked each month by our host to check it is PCI compliant, because we have to keep it PCI Compliant for a specific ...
3
votes
1answer
708 views

Is it OK to generate a token for a credit card without the user's permission? Is that PCI compliant?

Is it PCI compliant to generate a token for every card used for processing, regardless of whether the client asked for his card to be saved or not?
5
votes
1answer
694 views

PCI-DSS Network Segmentation and encrypted administrative interfaces

I'm using the 3/2/1 network segmentation model from the open pci dss scoping toolkit and I'm running into a bit of a mental roadblock. I have a phone system (Mitel 5000 series, if it matters) that is ...