Tag Info

New answers tagged

0

IANAQSA, and all quotes from Understanding SAQs for PCI DSS version 3: Based on the information you've provided, you'd be a SAQ D. SAQ A and A-EP are ruled out for you because they can have "no electronic storage, processing, or transmission of any cardholder data on the merchant's systems". When you say We accept CC information on our secured hosted ...


0

I agree with Shane Andrie. Dev machines considered in PCI scope is quite scary. I'd rather look in to moving them out of scope irrespectively of logging requirements. To answer your question: Yes, storing logs centrally is a PCI requirement. Please refer to requirement 10.5 (excl 10.5.5). 10.5.1 Limit viewing of audit trails to those with a job-related ...


-1

Short answer; Yes logs must be retained for a year, and the last 3 months logs must be easy to access. Lots more detail in the link below. Stack Exchange: what logs to retain for pci-dss


2

Disclaimer: IANAQSA, and if you're level 4, you probably don't have one. Be cautious. My Question is: Do the other offices (Singapore, Malaysia, India) access restricted to the Japan and Thailand as we are able to connect through private MPLS link? Or is it OK as we are connecting only through a private link. This is really a question of Scope - ...


0

My thoughts: Here is a good link that explains different SAQ levels. If you are a service provider, you need to fill out SAQ D for service provider. Your clients would definitely need to obtain PCI compliance as they are collecting CC data. Another thing that might help you with this discovery is the PCI third party security assurance information supplement ...


1

Let me give you a disclaimer first. Any advice given will be trumped by your QSA and because I have a limited scope of your network I can only provide guidance. Based on your question, you should have at a minimum, two zones, your DMZ where your application is running, and your internal zone where the data is being held ( I typically refer to this as the ...


2

IANAQSA... Is the reason for this explanation that the VPN connecting machine is not under PCI DSS scope, so it's treated as unsecure/public access, or does VPN eliminate that notion? First of all, if you have a VPN, you must have 2-factor authentication to make it PCI compliant. You didn't mention that, so I figured it should be made explicit. ...


5

According to PCI, you have 3 kind of networks: 1. INTERNAL (Cardholder Data Enviroment) 2. DMZ 3. INSECURE If your VPN network is considered as DMZ network, then it's under PCI scope, just like every other device in DMZ zone. If your VPN network is considered as INSECURE network, then you shouldn't allow direct connection to the servers in INTERNAL ...


0

Card companies have contracts in place with processors to force them to both be PCI compliant and to force them to make their merchants compliant. I guarantee you any bank or processor you contract with as a merchant will stipulate PCI compliance. To the degree of verification is on there part. If a breach occurs, the card companies can go after the banks, ...


0

Everything Tomasz listed, plus a few more: Significant costs to your organization (other than fines) such as the costs of audits or forensic investigations, costs associated with notifying affected clients/customers of the breach, etc. Any or all of the payment card brands could bar your organization from accepting their cards. Long lasting damage to your ...


1

It is a PCI DSS requirement to have a secure software development lifecycle. Requirement 6.3.2 states: 6.3.2 Review custom code prior to release to production or customers in order to identify any potential coding vulnerability (using either manual or automated processes) to include at least the following: Code changes are reviewed by ...


0

You should never display full readable credit card to anyone (includes authorized users). It is a bad security practice. If you do, then you'll need to implement even stronger access and monitoring controls in place to make sure the credentials for the authorized users are not compromised and hackers are not stealing away CC data. Better off simply ...



Top 50 recent answers are included