Tag Info

New answers tagged

0

It is a PCI DSS requirement to have a secure software development lifecycle. Requirement 6.3.2 states: 6.3.2 Review custom code prior to release to production or customers in order to identify any potential coding vulnerability (using either manual or automated processes) to include at least the following: Code changes are reviewed by ...


0

You should never display full readable credit card to anyone (includes authorized users). It is a bad security practice. If you do, then you'll need to implement even stronger access and monitoring controls in place to make sure the credentials for the authorized users are not compromised and hackers are not stealing away CC data. Better off simply ...


2

Scanning versus Manual Code Reviews Custom built, in-house software is in-scope for PCI compliance if it deals with PAN data. The PCI DSS, Requirement 6.6 expresses two options for in-house developers of software that handles PAN data: You can either do code reviews, or implement a web application firewall (WAF). Of course, it specifies the nature of the ...


0

Full disclosure, I work for Incapsula, we are a cloud-WAF provider. To answer your questions To pass TCP handshakes with a spoofed IP you`ll need to be in control of the router, which means you need to be in an ISP-like position. For more info, please see the @gowenfawr answer in this discussion (also linked in the OP). In short, while theoretically ...


2

Page 10 of the PCI DSS v3.1 states: "The PCI DSS security requirements apply to all system components included in or connected to the cardholder data environment. The cardholder data environment (CDE) is comprised of people, processes and technologies that store, process, or transmit cardholder data or sensitive authentication data." So your systems ...


-1

What I understand from your question is that, you are talking about backup of Logs. PCI requires that all logs should be stored in Central log server ( Refer to Requirement 10). There is no where mentioned your logs should be backedup in other media and store it offsite. Since you are not storing any card data locally, other card data storage on media is not ...


0

As one comment above says, you're trying to prove a negative and that's quite difficult! Using tools which search for regular expressions are useful but they often return many false positives and are unable to search many file types. As a result, the use of a tool should be a single tool within your arsenal. You can review what systems and application ...


2

Yes, you are responsible for addressing any gaps that you are aware of. It does not matter how you became aware you had a 1.3.8 violation; you're responsible for remediating it. The fact that it doesn't meet the threshold for remediation under 11.3 is not relevant.


0

The first thing I would do is run any proposed solution past your PCI auditor to ensure your not going to deploy anything which will cause issues and put the company outside of PCI compliance. It sounds like all you need is to have the card numbers tokenized in such a way that you will always get the same token given the same card number and there is no ...


0

There are no real consequences from the PCI DSS side itself, except possibly losing certification. But you should prepare for: lawsuits cancelled accounts and lost customers insurance claims (not related strictly to PCI DSS, but for real compensation paid to victims of leak) payment card issuer fines government fines, possibly including also losing license ...



Top 50 recent answers are included