New answers tagged pci-dss
2
I have yet to encounter any security best practice that says "All JS scripts should be omitted when presenting web pages with personal/credit card data".
Is there a way to hack your JS Widget in such a way as to pose a threat if the widget and customer credit card data are on the same page? Maybe. You'd need to really review the widget, and how it can ...
0
To me, there are no inherent risks to allowing the widget on a CC processing page. There are many sites that have various snippets on these pages (like Google analytics). Your code doesn't have access to the CC information on the form unless it's coded to do so anyway, plus the code's should be on their server anyway so it couldn't be modified maliciously.
3
If I understand correctly, you are trying to proactively protect your clients from the perception of potential risks by suggesting that your own code should not be run on certain pages. Your efforts might not be necessary.
Let your clients protect themselves by letting them choose for themselves. Alter your documentation to say, "install on every page, but ...
4
Most ecommerce sites include google analytics code on payment pages. Payment pages are also a prime candidate for a/b testing using JS tools such as optimizely or visual-website-optimizer.
There are also integrations to third-party product subscription engines that rely on JS passing CC data from the cart back to the service's mother ship (e.g. ...
6
There exists a policy shipped as part of the distribution service called "Prepare for PCI-DSS audits (section 11.2.2)". This is a policy that has all plugins enabled, TCP scan of all ports, safe checks enabled, web tests enabled, the PCI-DSS setting enabled, and several other things that are less important. I would recommend copying this policy to something ...
1
Honestly, based on whats been discussed in the comments, this doesn't sound like a hosting provider you trust at all. If that's really the case, the PCI auditor was right to fail you on this count. Why are you trusting them with PCI data?
You need to either move these assets in house or move them to a different provider that you trust.
In addition, rather ...
-1
If you have to have this type of interaction with the Service Provider, you have a bigger security risk than Windows Server 2003 SP1... that bigger security risk IS the security provider.
Fire them as quickly as you can, and find another.
3
In order for such evidence to be accepted, it needs to be possible to tie the information in the image showing the Service Pack level to the system (IP address/URL) being scanned by Trustkeeper. A screenshot that has different windows open that shows you're providing appropriate evidence for the correct system should do the trick.
Do you know if the Service ...
1
Is a commercial software vendor who sells software for use in the
United States, subject to, or legally required to implement PCI-DSS if
their software includes a feature which will allow the collection and
storage of credit card information, but which does not do payment
processing itself as part of the software's features?
NO. They are not ...
0
The relevant PCI-DSS section says:
3.4 Render PAN unreadable anywhere it is stored (including on portable digital media, backup media, and in logs) by using any of the following approaches:
* One-way hashes based on strong cryptography (hash must be of the entire PAN)
* Truncation (hashing cannot be used to replace the truncated segment of PAN)
* Index ...
0
PCI-DSS covers HOW data can be stored.
The merchant agreement, and more importantly cardholder acceptance rules determine WHEN card data can be stored. For example, see Card Acceptance Guidelines for Visa Merchants.
http://usa.visa.com/merchants/new-acceptance/merchant-guidelines.html
1
if your application touches the payment data, it's within scope for PA-DSS. Some POS solutions pop up a separate window for payments that fall under the 3rd party app. The 3rd party and attached hardware touch the payment, and send the response code back to the merchant application so you can complete the sale. This pulls PA DSS out of scope. PCI DSS is ...
1
Why would you be testing CPanel for PCI compliance? How did you come to arrive at C-VT as the applicable SAQ?
Which PCI requirement is this being done to meet?
One thing is for sure: CPanel should NEVER be exposed to the open Internet. So if you are scanning it from over the net you can forget PCI compliance.
I do PCI for a living.
3
In terms of scanning the system for compliance, it's a question of running vulnerability scans and see if they pass externally and if the risk is acceptable internally. In terms of whether the system is configured in a compliant manner takes more work as per the following list:
Is networking limited to protocols required for business purposes with no ...
1
I'm not sure what a self-test is, however you don't need to pay anything for tools in order to test against the PCI standards. There are loads of free tools out there, there are even security and forensics specific OS distros out there that cost absolutely nothing. So get a copy of the Backtrack or Kali OS distro and run it off a USB or as a virtual machine ...
0
Your 'solution' there has one big problem: you have to put your Authorise.net ID and API key into the form so A.net can process the transaction and send the money to the right place.
All a hacker would have to do to get the API key and A.net ID is right click and select 'View Source' to get the merchant's API key and A.net ID. If you try to block that with ...
4
If you're servers do not store, process or transmit cardholder data in any capacity at any time, your systems are not in scope for PCI compliance and you've effectively outsourced the handling of such data to authorize.net - this means PCI is simplified as you've a reduced scope and would complete a less onerous Self Assessment Questionnaire (SAQ). As a ...
3
First, I am not a lawyer, you should talk to a a lawyer or a PCI specialist rather than some random person on the Internet. That said, my understanding of Direct Post is that the client sends the PCI to Authorize.Net's server. It is never touched by your server, so it should not require PCI compliance. PCI-DSS only requires that systems touching PCI be ...
0
I kind of hate answering my own question especially this late after the fact however I did find a great resource that explains exactly what needs to be logged from the windows auditing to meet our needs.
Account Management
Audit Application Group Management Success, Failure
Audit Computer Account Management Success, Failure
Audit Distribution Group ...
Top 50 recent answers are included
