New answers tagged

0

They can use windows XP provided they use a browser that doesn't use the Windows SSL/TLS stack. Chrome and Firefox use their own SSL/TLS stacks so they will continue to work. Internet Explorer uses the operating systems TLS stack so it will not work. I have not investigated other browsers or non-browser client applications but I would expect at least some ...


2

Encryption at Card Swipe protects the iPad from being in scope. A lot of card swipe hardware these days is configured to encrypt the card details using the public key of the card processor. The iPad simply passes the encrypted blob along; the merchant and the iPad do not have the private key required to decrypt to blob. Therefore, the merchant is never ...


-1

i really don't see what confused you. this is another form of POS device that needs to be managed according to the requirements described at the PCI requirements. Why do you think it's different from any other cashier that customers swipes a card through ?


3

Well, the first thing you'd do is put the iPad in "Guided Access" (single app mode) so that the only app that can be used is whatever point of sale software you've got on there. Next, put it on an isolated network segment that doesn't have external access and is properly secured, and you can actually have a pretty secure setup. At least as secure as ...


2

You'll just have to follow your PCI procedures. You'll have to create a change that allows the statsd server to exist. A manager will have to review/ok the change. It will cause a few dependent changes and activities: add a new statsd server to the DMZ (network change, system change, system hardening, configuration standards) add the statsd service and ...


2

There is a reason for encrypting the data where its stored - that being the storage may be compromised (directly or from a backup copy). If we agree that maintaining the data in an encrypted form is a good idea, then access to the decryption key must be restricted. You didn't specify if the encryption was symmetric or asymmetric. In the case of the former, ...


1

Since the communication between web and app servers are secured through SSL/TLS, the data's already being encrypted in transit by the session key - so I think your two options are very similar. There might be a slight advantage for encrypting for the application server's HSM key right off the bat so that the data's plaintext is never on the application ...


2

IANAQSA! That data doesn't put you in scope, but you're probably in scope anyway, but dint of whatever relationship you're in that gets you access to that non-scoped data. To quote PCI-DSS 3.2 (emphasis as per source): The primary account number is the defining factor for cardholder data. If cardholder name, service code, and/or expiration date are ...


2

You compare the callcenter to Starbucks in how they're required to handle credit cards. The big difference is that Starbucks handles credit cards in an entirely different way compared to a callcenter. Starbucks barristas do not handle your credit card data in any way. What happens is that you insert your credit card into a machine that's provided by ...


11

Short version: The PCI-DSS does not explicitly call out the steps you describe. However, those are common sense steps that are reasonably encompassed by several PCI-DSS requirements. They are not at all uncommon and I have seen them as requirements to non-PCI-DSS contractual agreements by third parties in a card processing environment. Long version: ...


1

What you are hearing is about a security policy of the company or call-center as a precaution to prevent loss of card-holder data. I've heard of other companies that do the same thing around slightly different data sets. There are many arrests each year of call-center workers taking credit cards so this is likely simply a security control to help reduce ...


3

P2PE usage can eliminate PAN storage, because the POS system will not have access to the cleartext card data to retain from the start. However, if you need to run subsequent transactions on the same card, such as returns or adjustments, P2PE alone will not help you there. You need to understand from the vendor what your options are. Their answer may be to ...


0

This entire situation sounds wrong. The typical flow of a user purchase or transaction in this kind of environment would be as follows: Vendor site calls a payment provider API, passing details of the transaction: vendor ID, product name and identifier, cost breakdown, customer name and address if known, and sometimes other technical information such as ...



Top 50 recent answers are included